36C26018Q0065-001.docx

36C26018Q0065

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

11-21-2017 Tamara Potwora 360 852 9877 11-30-2017 9:00 Department of Veterans Affairs Network Contracting Office 20

5115 NE 82nd Ave, Suite 102 Vancouver WA 98662

X

561320 $27.5 Million N/A X

N/A

Department of Veterans Affairs VA Southern Oregon Rehabilitation Center

8495 Crater Lake Hwy.

White City OR 97503 Department of Veterans Affairs Network Contracting Office 20

5115 NE 82nd Ave, Suite 102 Vancouver WA 98662

Department of Veterans Affairs

FMS-VA-2(101)

Financial Services Center PO Box 149971 Austin TX 78714-9971

See CONTINUATION Page Physical Therapists VA Southern Oregon Rehabilitation Center

Period of Performance:

12/15/2017 to 06/15/2018

See CONTINUATION Page x

Tamara Potwora Contracting Officer

B.1 - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

(continuation from Standard Form 1449, block 18A.)

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C260 NCO 20 assigned Contracting Officer Department of Veterans Affairs Network Contracting Office 20 5115 NE 82nd Ave, Suite 102 Vancouver WA 98662

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Department of Veterans Affairs

FMS-VA-2(101)

Financial Services Center PO Box 149971 Austin TX 78714-9971

5. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

PHYSICAL MEDICINE & REHABILITATION OUTPATIENT PHYSICAL THERAPY SERVICES

FOR THE

V.A. SOUTHERN OREGON REHABILITATION CENTER & CLINICS

1.0. INTRODUCTION:

The V.A. Southern Oregon Rehabilitation Center & Clinics (SORCC) has and continues to experience peaks in workload that requires additional physical therapist practitioners. The primary purpose of this Contract will be to supplement V.A. SORCC Physical Therapy staff throughout the calendar year.

2.0 SCOPE OF WORK

2.1 The Physical Therapy (PT) Practitioners shall see an average of 8-10 patients per day in the PMRS PT Outpatient Clinic located at the VA Southern Oregon Rehabilitation Center & Clinics.

2.2. The OP Physical Therapist will be assigned to Physical Medicine & Rehabilitation Services from Monday – Friday, 8:00 a.m. to 4:30 p.m., shifts are five (5) days per week, with 30 minutes for lunch. There is no on-call duty or holiday duty for this position.

2.3. The OP PT Practitioner(s) shall have responsibility for examining, evaluating, diagnosing and treating veterans with neuromusculoskeletal conditions, among others, in a fast-paced, direct-access environment. The PT Practitioners shall complete all appropriate documentation of services in the Computerized Patient Record System (CPRS) including all required clinical reminders.

2.4. Location of Services: Under this task order, the Contractor is required to provide one (1) Outpatient Physical Therapist Practitioners at the location below:

V.A. Southern Oregon Rehabilitation Center & Clinics 8495 Crater Lake Hwy White City, OR 97503

3.0. PROVIDER QUALIFICATIONS:

3.1. The Contractor should provide resumes and copies of the required certification/education for one (`) candidates to fill the initial requirement of one (1) candidates who fulfills the following requirement.

a. Have an unrestricted license in a US state that licenses Physical Therapists;

b. Speak, read and write English proficiently;

c. Provide evidence of demonstrated current clinical competence to perform appropriate outpatient care services;

d. Be a US citizen or permanent resident;

e. Have passed the FSBPT’s National Physical Therapy Examination;

f. Have a professional degree and education applicable to medical staff members, e.g., BPT, MPT, DPT.

g. Provide evidence of current professional liability insurance;

h. Names of most current employer(s) and three (3) peer reference contacts;

i. Current copy of ACLS and BLS certifications;

j. Must be computer literate, as VA SORCC utilizes a computerized patient medical record;

k. Must be able to type at a moderate speed, 30 words per minute, as this facility utilizes a computerized medical record;

l. Provide the following health related information for each candidate:

(1) Evidence of current TB surveillance status;

(2) Evidence of current Hepatitis B vaccination and titer;

3.2. Providers assigned by the Contractor to perform the services stated in this PWS shall be able to be credentialed and receive privileges by the RVAHS.

3.3. One (1) providers will be actively performing the services under this task order at the duty locations stated in paragraph 2.4 above.

4.0. GENERAL REQUIREMENTS:

4.1. The services to be performed by the Contractor shall be performed in accordance with VA policies and procedures and the regulations of the Medical Staff Bylaws of the Southern Oregon Rehabilitation Center & Clinics.

4.2. The services to be performed by the Contractor will be under the direction of the Chief Physical Medicine & Rehabilitation Services (PMRS), at each facility where services are provided within the Southern Oregon Rehabilitation Center & Clinics.

4.3. The Contractor’s employees must be present at the VA facility during working hours and must be performing the required services identified in the Performance Work Statement (PWS), or the cost will be decreased accordingly during each billing cycle. The payments for holiday time (for work performed in the case of an emergency) and for any leave, including sick leave or vacation time, is the responsibility of the Contractor.

4.4. The Contractor shall be required to use the hospital computer system, to include but not limited to checking electronic reports on a daily basis for accuracy and completeness, writing orders (i.e. Lab, consults, and admission) and approving patient results via electronic signature. It is the responsibility of Contractor to ensure that all CPRS (Computerized Patient Record System) entries are signed off before leaving the facility.

4.5 Contractor must immediately report any incident which may compromise patient safety to the Chief of PMRS.

4.6. The parties agree that providers of said services shall not be considered VA employees for any purpose, and shall be considered employees of the Contractor.

4.7. The Contractor shall be responsible for protecting the personnel furnishing services under this contract. To carry out this responsibility, the Contractor shall provide the following for those personnel:

a. Worker’s Compensation;

b. Professional liability insurance;

c. Health examinations;

d. Income tax withholding; and

e. Social security payments.

4.8. The services covered by this contract shall be furnished by the Contractor during work hours as defined herein. The Contractor may be required to work outside of regular hours as directed by the Contracting Officer or Contracting Officers Representative.

4.9. The following terms have the stated meanings:

4.9.1. Business Hours: 7:00 AM – 7:00 PM.

4.9.2. Work Schedule: 8-hour daily work schedule, not including lunch, within business hours as defined above, as established by the PMRS Service Chief. There will be no more than 40 hours per week and no more than 5 days per week.

4.9.3. Work days and work hours are subject to change based on the need of the facility and need of the veterans being served. Five day work schedules may include weekends and holidays.

4.9.4. National holidays: The ten holidays observed by the federal government are:

New Year’s Day Martin Luther King, JR’s Birthday President’s Day Memorial Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day Plus any other day specifically declared by the President of the United States to be a federal holiday.

4.10. A record keeping system, maintained by the Chief of PMRS, will verify services rendered or designee, who assures the VA, pays for only those services actually requested.

4.11. Physical Therapists will see patients in a timely manner.

4.12. The Government will evaluate the quality of professional and administrative services provided, but retain no control over the medical, professional aspects of services rendered (e.g., professional judgments, diagnosis for specific medical treatment). Focused Provider Practice Evaluation (FPPE), Ongoing Provider Practice Evaluation (OPPE), and/or other monitoring reported to the cognizant facility Medical Executive Board as defined by the Rules and Bylaws of the Medical Staff; clinical performance measures and clinical reminder completion as monitored at the service level and reported to the COR by exception (i.e., failure to meet); and workload monitoring via review of schedules and the Primary Care Management Module (PCMM) panel management reports. The method by which services will be evaluated is described in the Quality Assurance Surveillance Plan (QASP) in section D.1, below.

4.13. Placement Fees: If a contractor employee decides to apply for and is offered a VA civil servant position, the contractor physician will finish the current commitment (e.g., 13 week assignment) under this contract. The VA will not pay recruitment placement fees to the contractor.

5.0 Infection Control Compliance

5.1. Contractor shall provide written certification of training compliance with the Blood borne Pathogens Standards, 29 CFR Part 1910.1030 (copy available on request) to the COR, prior to Contractor compensating work shall receive certification.

5.2. MANTOUX TESTING

5.2.1. Contractor shall provide evidence to the COR:

0. Negative PPD test within fourteen (14) calendar days prior to employee beginning service. If an earlier PPD test was given over twelve (12) months previously, the current test shall be a 2-step Mantoux test.

0. Medical evidence that personnel are disease free for personnel having a positive PPD.

0. A regular annual re-testing program for TB shall be established and maintained by the Contractor. Contractor shall provide evidence of retests to COR within ten (10) calendar days of retest.

5.3 HEPATITIS B VACCINATION.

5.3.1. The Contractor shall consider the need for Hepatitis B vaccine and vaccination series within ten (10) days of contract employment and follow-up if there has been an exposure incident. VA shall not provide the vaccine or vaccination series.

5.3.2. VA Form 10-5549c, Information About Hepatitis B Vaccine (Recombinant), Consent Form, or VA Form 10-549d, Hepatitis B Vaccine Declination (Mandatory) shall be submitted to the COR within thirty (30) days of waiver, or completion of the first in the series of the Hepatitis B vaccine, and at completion of the vaccination series.

5.4. Training for Infection Control and Safety

5.4.1. VA shall provide training for infection control and safety including standard precautions, electrical safety, fire safety, and a general orientation of safe work practices.

5.4.2. VA shall provide personal protective equipment (PPE), as required, as well as training on use. Failure to returns items issued to the Contractor’s employee following termination of employment shall result in a charge against payment of the Contractor’s invoice.

APPENDIX A - SPECIAL CONTRACT REQUIREMENTS

1.0. INTRODUCTION: Under the authority of Public Law 104-262 and 38 USC 8153, the Contractor agrees to provide Health Care Resources in accordance with the terms and conditions stated herein, to furnish to the White City VA Healthcare Systems, the services and prices specified in the Performance Work Schedule of this contract. This is an estimated quantity task order to be written against a master contract under the National Acquisition Center (NAC) Federal Supply Schedule (FSS) for commercial healthcare services. Award will be made for non-personal health care services, as defined in FAR 37.01, under which the Contractor is an independent contractor, may be awarded from this Solicitation. The Government may evaluate the quality of professional and administrative services provided, but retains no control over the medical, professional aspects of services rendered (e.g., professional judgments, and/or diagnosis for specific treatment).

North American Industry Classification System (NAICS) Code 561320 applies to this acquisition. See FAR clause titled 52.212-1 Instructions to Offerors- Commercial Items.

2.0. SERVICES:

2.1. The services specified in the Special Contract Requirements and the Price/Cost Schedule may be changed by written modifications in accordance with FAR Part 43.103, Types of Contract modifications.

2.2. The services to be performed by the Contractor at their facilities will be performed in accordance with the Contractor’s policies and procedures and the regulations of the medical staff by laws.

3.0. TERM OF CONTRACT: This contract is effective contract effective period is on page 1 block 20. The contract is subject to the availability of funds. The VA will assign no new cases after the effective period unless the Contracting Officer exercises the option and provides documentation of approved funding.

4.0. QUALIFICATIONS: Personnel assigned by the Contractor to perform the services covered by this contract shall be qualified in accordance with section 2.0, Provider Qualifications, of the Performance Work Statement.

5.0. CONTRACT PERFORMANCE MONITORING: The VA Healthcare System Contracting Officer’s Representative (COR) appointed by the Contracting Officer (CO) will be the Government official responsible for monitoring Contractor compliance under this contract. After contract award, any incidents of Contractor noncompliance as evidenced by the monitoring procedures shall be forwarded immediately to the Contracting Officer.

6.0. COMPLIANCE WITH VETS-100 REPORTNG REQUIREMENTS: In accordance with Public Law 105-359, section 1354 (enacted November 30, 1998); awards will not be made under this solicitation unless the Contracting Officer is able to confirm that the offeror is registered with the Department of Labor, VETS-100 certification and has complied with requirements to file a VETS-100 report for the preceding fiscal year under Title 38 Section 4212(d). The contracting officer may require the offeror to furnish evidence of filing. For questions and information on filing VETS-100 reports, contact the VETS-100 Processing Center at (703) 461-2460. NOTICE – Federal Acquisition Clause 52.222-37 Employment Reports on Disabled Veterans and Veterans of the Vietnam Era is incorporated by reference in this contract. Public Law (P.L.) 105-339, Section 1354 provides that no agency may enter into a contract with a Contractor who has not filed a VETS-100 report for the preceding year under Title 38 Section 4212(d). A contract can be placed with that Contractor as soon as the report required by Section 4212(d) for the fiscal year concern is filed with the Department of Labor. P.L. 105-339 also increased the threshold of covered contracts and subcontracts from $10,000 to $25,000. You are therefore strongly urged to complete this report as soon as possible to avoid delays in the contract award process. This can be done “on-line” at www.vets100.cudenver.edu/

7.0. CONTRACT MODIFICATIONS: The Contracting Officer is the only person authorized to approve changes or modify any of the requirements under this contract. The Contractor shall communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer is authorized to make commitments or issue changes that will affect price, quantity, or quality of performance of this contract. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change shall be considered to have been made without authority and no adjustment will be made in contract price to cover any increase in prices incurred as a result thereof. The Contractor must obtain written authorization from the Contracting Officer for any services required outside the scope of work provided herein.

8.0. MEDICAL RECORDS:

8.1. Medical records and other patient information shall be provided pursuant to VA policy and standards which are designed to protect the confidentiality of the patient’s medical records in accordance with applicable state and federal laws and recognized standards of professional practice. It will be the responsibility of the White City VA Healthcare System to obtain and provide evidence of patient’s written authorization prior to release of patient information to non-VA physicians working on behalf of the Contractor.

8.2. When the patient is released from inpatient care, Contractor shall provide the VA with copies of all inpatient records, upon request and in compliance with Contractor’s policies and procedures related to release of information.

9.0. PAYMENT:

9.1. The Contractor shall provide monthly invoices in arrears that reference the task order number and the IFCAP PO number, the Contract Line Item Number(s) (CLIN), unit of issue, unit price and total amount.

9.2. The VA agrees to reimburse the Contractor according to the terms of the contract for services performed under this contract.

9.3. Sums due to the Contractor will be paid within 30 days of receipt of a properly prepared claim submitted by the Contractor.

9.4. Claims submitted by the Contractor to the VA for services rendered a VA beneficiary under the terms of this Contract shall be in full. Neither the beneficiary, his/her insurer nor any other third party shall be billed by the Contractor. This provision shall survive the termination or completion of this Contract.

9.5. Refer to Title 42 Code of Federal Regulations (CFR) Sections 412.4, 415.170, 415.172, 415.178, 415.180 and 415.190 as conditions of payment.

10.0. HIPAA COMPLIANCE: In accordance with 45 C.F.R. Parts 160, 162 and 164 (Health Insurance Portability and Accountability Act) and 38 U.S.C. 5701, 38 U.S.C. 5705, 38 U.S.C. 7332,5 U.S.C. 552a (Privacy Act), the Parties agree to hold all individually identifiable health information as that term is defined in the Health Insurance Portability and Accountability Act and regulations promulgated there-under (collectively, “HIPAA”) shared with, transferred or transmitted to, or otherwise obtained by the Contractor on or from or on behalf of the VA in the course of the Contractor providing the services under this Contract (“Protected Health Information”) strictly confidential, and provide protections to prevent the unauthorized disclosure of such information, including, but not limited to the protection required by applicable federal, VA, state and local laws, policies and/or regulations regarding the security and the confidentiality of patient health care information including, but not limited to, HIPAA. Specifically, the Contractor agrees as follows:

a. To maintain safeguards as necessary to ensure that the Protected Health Information is not used or disclosed except as required to perform its obligations under the Contract, as expressly permitted herein or as required or permitted by law;

b. To ensure that any sub-Contractors or agents to whom it provides Protected Health Information agree to the same restrictions and conditions that applies with respect to such information;

c. To make available its internal practices, books and records relating to the use and disclosure of Protected Health Information to the Department of Health and Human Services or its agents as required by HIPAA;

d. To incorporate any amendments or corrections to Protected Health Information when notified by the VA that the information is inaccurate or incomplete;

e. To, at termination of this Contract and as feasible, return or destroy all Protected Health Information that it still maintains or archive to meet the Contractor’s legal obligations related to retention of records;

f. To ensure that, as to any Protected Health Information held by the Contractor, the Contractor policies are in place to allow access to that Protected Health Information by the subject of that information as required by HIPAA;

g. To report to the VA any use or disclosure of Protected Health Information which is not allowed under the terms of the Contract. If at any time after the effective date of this Agreement it is determined that either party is in breach of this Section, the other party, in its sole discretion, may immediately terminate this Contract.

11.0. BAA The VA has recognized the Contractor as an entity that does not require a Business Associate Agreement (BAA) with their Contractors as long as they are conducting health care on VA’s behalf. Hospital based healthcare services qualifies as a medical service. Therefore, no BAA is required.

12.0. TRAVEL EXPENSES REIMBURSEMENT: The Government agrees to reimburse the Contractor on the same basis as federal employees are reimbursed for travel expenses. The Contractor shall be reimbursed for travel made at the direction of the Government, only. In accordance with Federal Acquisition Regulation (FAR) 31.205-46, Reimbursable travel expenses are as follows:

(a) Costs for transportation, lodging, meals, and incidental expenses.

(1) Costs incurred by contractor personnel on official company business are allowable, subject to the limitations contained in this subsection. Costs for transportation may be based on mileage rates; actual costs incurred, or on a combination thereof, provided the method used results in a reasonable charge. Costs for lodging, meals, and incidental expenses may be based on per diem, actual expenses, or a combination thereof, provided the method used results in a reasonable charge.

(2) Except as provided in subparagraph (a)(3) of this subsection, costs incurred for lodging, meals, and incidental expenses (as defined in the regulations cited in (a)(2)(i) through (iii) of this subparagraph) shall be considered to be reasonable and allowable only to the extent that they do not exceed on a daily basis the maximum per diem rates in effect at the time of travel as set forth in the --

(i) Federal Travel Regulations, prescribed by the General Services Administration, for travel in the contiguous United States, available on a subscription basis from the Superintendent of Documents, U.S. Government Printing Office, Washington, DC 20402 Stock No. 922-002-00000-2;

(ii) Joint Travel Regulation, Volume 2, DoD Civilian Personnel, Appendix A, prescribed by the Department of Defense, for travel in Alaska, Hawaii, and outlying areas of the United States, available on a subscription basis from the Superintendent of Documents, U.S. Government Printing Office, Washington, DC 20402, Stock No. 908-010-00000-1; or

(iii) Standardized Regulations (Government Civilians, Foreign Areas), Section 925, “Maximum Travel Per Diem Allowances for Foreign Areas,” prescribed by the Department of State, for travel in areas not covered in (a)(2)(i) and (ii) of this subparagraph, available on a subscription basis from the Superintendent of Documents, U.S. Government Printing Office,Washington, DC 20402, Stock No. 744-008-00000-0.

(3) In special or unusual situations, actual costs in excess of the above-referenced maximum per diem rates are allowable provided that such amounts do not exceed the higher amounts authorized for Federal civilian employees as permitted in the regulations referenced in (a)(2)(i), (ii), or (iii) of this subsection. For such higher amounts to be allowable, all of the following conditions must be met:

(i) One of the conditions warranting approval of the actual expense method, as set forth in the regulations referenced in paragraphs (a)(2)(i), (ii), or (iii) of this subsection, must exist.

(ii) A written justification for use of the higher amounts must be approved by an officer of the contractor’s organization or designee to ensure that the authority is properly administered and controlled to prevent abuse.

(iii) If it becomes necessary to exercise the authority to use the higher actual expense method repetitively or on a continuing basis in a particular area, the contractor must obtain advance approval from the contracting officer.

(iv) Documentation to support actual costs incurred shall be in accordance with the contractor’s established practices, subject to paragraph (a)(7) of this subsection, and provided that a receipt is required for each expenditure of $75.00 or more. The approved justification required by paragraph (a)(3)(ii) and, if applicable, paragraph (a)(3)(iii) of this subsection must be retained.

(4) Paragraphs (a)(2) and (a)(3) of this subsection do not incorporate the regulations cited in subdivisions (a)(2)(i), (ii), and (iii) of this subsection in their entirety. Only the maximum per diem rates, the definitions of lodging, meals, and incidental expenses, and the regulatory coverage dealing with special or unusual situations are incorporated herein.

(5) An advance agreement (see 31.109) with respect to compliance with subparagraphs (a)(2) and (a)(3) of this subsection may be useful and desirable.

(6) The maximum per diem rates referenced in subparagraph (a)(2) of this subsection generally would not constitute a reasonable daily charge:

(i) When no lodging costs are incurred; and/or

(ii) On partial travel days (e.g., day of departure and return). Appropriate downward adjustments from the maximum per diem rates would normally be required under these circumstances. While these adjustments need not be calculated in accordance with the Federal Travel Regulation or Joint Travel Regulations, they must result in a reasonable charge.

(7) Costs shall be allowable only if the following information is documented --

(i) Date and place (city, town, or other similar designation) of the expenses;

(ii) Purpose of the trip; and

(iii) Name of person on trip and that person’s title or relationship to the contractor.

(b) Airfare costs in excess of the lowest priced airfare available to the contractor during normal business hours are unallowable except when such accommodations require circuitous routing, require travel during unreasonable hours, excessively prolong travel result in increased cost that would offset transportation savings, are not reasonably adequate for the physical or medical needs of the traveler, or are not reasonably available to meet mission requirements. However, in order for airfare costs in excess of the above standard airfare to be allowable, the applicable condition(s) set forth above must be documented and justified.

(c)

(1) “Cost of travel by contractor-owned, -leased, or -chartered aircraft,” as used in this paragraph, includes the cost of lease, charter, operation (including personnel), maintenance, depreciation, insurance, and other related costs.

(2) The costs of travel by contractor-owned, -leased, or -chartered aircraft are limited to the allowable airfare described in paragraph (b) of this subsection for the flight destination unless travel by such aircraft is specifically required by contract specification, term, or condition, or a higher amount is approved by the contracting officer. A higher amount may be agreed to when one or more of the circumstances for justifying higher than allowable airfare listed in paragraph (b) of this subsection are applicable, or when an advance agreement under subparagraph (c)(3) of this subsection has been executed. In all cases, travel by contractor-owned, -leased, or -chartered aircraft must be fully documented and justified. For each contractor-owned, -leased, or -chartered aircraft used for any business purpose which is charged or allocated, directly or indirectly, to a Government contract, the contractor must maintain and make available manifest/logs for all flights on such company aircraft. As a minimum, the manifest/log shall indicate --

(i) Date, time, and points of departure;

(ii) Destination, date, and time of arrival;

(iii) Name of each passenger and relationship to the contractor;

(iv) Authorization for trip; and

(v) Purpose of trip.

(3) Where an advance agreement is proposed (see 31.109), consideration may be given to the following:

(i) Whether scheduled commercial airlines or other suitable, less costly, travel facilities are available at reasonable times, with reasonable frequency, and serve the required destinations conveniently.

(ii) Whether increased flexibility in scheduling results in time savings and more effective use of personnel that would outweigh additional travel costs.

(d) Costs of contractor-owned or -leased automobiles, as used in this paragraph, include the costs of lease, operation (including personnel), maintenance, depreciation, insurance, etc. These costs are allowable, if reasonable, to the extent that the automobiles are used for company business. That portion of the cost of company-furnished automobiles that relates to personal use by employees (including transportation to and from work) is compensation for personal services and is unallowable as stated in 31.205-6(m)(2).

FAR References can be viewed at the following link: http://farsite.hill.af.mil

APPENDIX B - VA INFORMATION AND INFORMATION SYSTEM SECURITY/ PRIVACY

1.0. GENERAL: Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2.0. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS:

2.1. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

2.2. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

2.3. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

2.4. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

2.5. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3.0. VA INFORMATION CUSTODIAL LANGUAGE:

3.1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

3.2. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3.3. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

3.4. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

3.5. The following statement on all fax cover sheets be included: This fax is intended only for the use of the person or office to which it is addressed and may contain information that is privileged, confidential, or protected by law. All others are hereby notified that the receipt of this fax does not waive any applicable privilege or exemption for disclosure and that any dissemination, distribution, or copying of this communication is prohibited. if you have received this fax in error, please notify this office immediately at the telephone number listed above.”

3.6. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/ subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

3.7. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

3.8. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

3.9. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

3.10. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

3.11. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

3.12. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

3.13. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4.0. SECURITY INCIDENT INVESTIGATION:

4.1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

4.2. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

4.3. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

4.4. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5.0. LIQUIDATED DAMAGES FOR DATA BREACH:

5.1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

5.2. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

5.3. Each risk analysis shall address all relevant information concerning the data breach, including the following:

a. Nature of the event (loss, theft, unauthorized access);

b. Description of the event, including:

(1) Date of occurrence;

(2) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

c. Number of individuals affected or potentially affected;

d. Names of individuals or groups affected or potentially affected;

e. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

f. Amount of time the data has been out of VA control;

g. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

h. Known misuses of data containing sensitive personal information, if any;

i. Assessment of the potential harm to the affected individuals;

j. Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

k. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

5.4. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 with a 3% increase per year per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

a. Notification;

b. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

c. Data breach analysis;

d. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

e. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

f. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

6.0. TRAINING:

6.1. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

a. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, relating to access to VA information and information systems;

b. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

c. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

d. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800- 16, Information Technology Security Training Requirements].

6.2. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

6.3. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

APPENDIX C - BACKGROUND INVESTIGATIONS PROCESS

1.0. The following explains the current process for Background Investigations (BI) that are required for contractor personnel to have routine access to a facility and to authorize access to VA/Federally owned information systems. This applies to all contractor personnel performing services for the facility, including CBOC’s (Community Based Outpatient Care). This must be completed prior to the start date. This is a federal law and is established under HSPD-12, FIPS Pub-201-1, EO 10450, and VA Directive 0710. The process is specific and required beyond any additional agency credentialing and vetting processes.

1.1. Contract employees shall wear agency identification badge as well as VA badge at all times while on the premises of the VA HCS.

1.2. Contractor Security Requirements: Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

1.3 Contractor Security Investigation Requirements: Background Investigations (BI) that is required to give contractor personnel routine access to a facility and to authorize access to VA/Federally owned information systems. This is required of all contractor personnel performing services for the facility, including CBOC’s (Community Based Outpatient Care). This must be completed prior to the start date.

1.3.1. This is a federal law and is established under HSPD-12, FIPS Pub-201-1, EO 10450, and VA Directive 0710.