36C26119Q0295-001.docx

36C26119Q0295

OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL

BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SI

GN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGN

ATURE OF OFFEROR/CONTRACTOR

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR

LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

36C26119Q0295 04-11-2019 Daniel.Szambelan@va.gov 04-19-2019 Department of Veterans Affairs VA Sierra Pacific Network (VISN 21)

VA

Pacific Islands Health Care System 459 Patterson Rd Honolulu HI 96819-1522 X X 561410 $32.5 Million X N/A X "See Delivery Schedule"

Department of Veterans Affairs VA Sierra Pacific Network (VISN 21) VA Pacific Islands Health Care System 459 Patterson Rd Honolulu HI 96819-1522

Department of Veterans Affairs FMS VA-9(101) Financial Services Center PO Box 149971 Austin TX 78714-9971 See CONTINUATION Page The contractor shall provide medical transcription services in accordance with the Statement of Work. This is a contract as an Indefinite Delivery Indefinite Quantity (IDIQ) Contract for Five (5) years.

The minuim order for this IDIQ shall be meet by the first order.

See page 67 for instructions on submitting an offer.

The Government contemplates an award to a single source wich will result in a multpile year IDIQ contract.

VA Point of contact for questions about this solicitation can be sent to daniel.szambelan@va.gov See CONTINUATION Page X X Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C261 Department of Veterans Affairs VA Sierra Pacific Network (VISN 21) VA Pacific Islands Health Care System 459 Patterson Rd Honolulu HI 96819-1522

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Department of Veterans Affairs FMS VA-9(101) Financial Services Center

PO Box 149971 Austin TX 78714-9971 ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 PRICE/COST SCHEDULE

The guaranteed minimum award amount for this contract is $1,000.00. The Maximum aggregate value of orders that can be placed is under this contract is $6,000,000.00. The Government does not guarantee that it will place any orders under this contract in excess of the guaranteed minimum award amount.

Base Period: Date of Award – 31 May 2020

BASE TOTAL

Year One (1): 01 June 2020 – 31 May 2021

YEAR ONE TOTAL

Year Two (2): 01 June 2021 – 31 May 2022

YEAR TWO TOTAL

Year Three (3): 01 Jun 2022 – 31 May 2023

YEAR THREE TOTAL

Year Four (4): 01 Jun 2023 – 31 May 2024

YEAR FOUR TOTAL

Base Year Total Estimated

Year One (1) Total Estimated

Year Two (2) Total Estimated

Year Three (3) Total Estimated

Year Four (4) Total Estimated

Contract Value GRAND TOTAL ESTIMATED

36C26119Q0295

Page 1 of Page 1 of Statement of Work Medical Transcription Services for Veterans Integrated Service Network 21

1. 0 General Information: The Contractor shall provide off-site medical transcription services for and in support of Veterans Integrated Service Network (VISN) 21 facilities which include the following:

1.1 Veteran Affairs (VA) Central California Health Care System (VACCHCS) at 2615 E. Clinton Avenue, Fresno, California, 93703

1.2 VA Northern California Health Care System (VANCHCS) at 150 Muir Road, Martinez, California, 94553

1.3 VA Palo Alto Health Care System (VAPAHCS) at 3801 Miranda Avenue, Palo Alto, California, 94304

1.4 San Francisco VA Medical Center (SFVAMC) at 4150 Clement Street, San Francisco, California, 94121

1.6 All transcription and verification shall be performed in the United States of America. There are no exceptions.

1.7 The Contractor shall certify that all personnel providing transcription services for the VA under the terms of this contract are residents of and located within the United States. The Contractor shall further certify that no dictated material originating from the VA will be sent electronically, or otherwise, to a location outside of the territory of the United States

2.0 General Task: The Contractor shall provide personnel, hardware, software, applicable dictation equipment and transcribers, utilities, supplies, materials, equipment, telephone lines, and internet connectivity, everything necessary to perform the work in accordance with (IAW) the terms and conditions described herein.

2.1 Medical transcription services shall be provided for dictated material that includes a high incidence of technical terminology, and requires a comprehensive knowledge of the specialized vocabulary particular to a wide variety of medical fields. The Contractor shall transcribe reports utilizing headers and footers and appropriate formats as provided by each facility. The Contractor shall transmit and/or upload completed reports using transmission and batch protocols provided by VA.

2.2 Dictation Subjects: Materials to be transcribed include a high incidence of technical terminology requiring a strong command of English grammar, a good vocabulary, and a working knowledge of specialized medical terminology peculiar to a wide variety of subjects in the fields of medicine, psychiatry, surgery, and others. Some of the medical subjects to be transcribed are included Discharge Summaries, Operative Reports, History and Physical Reports, Procedure Reports, Consultation Reports, Radiology Report, Nuclear Medicine Reports, Special Procedure Reports, Compensation and Pension Exam Reports (specific History and Physical), miscellaneous medical Progress Notes, Anatomic Pathology and Cytology notes.

2.3 Record Retention: Contract files including contract documents, invoices, purchase orders, etc., shall be maintained in accordance with FAR 4.703 (three years unless otherwise specified) and Records Control Schedule (RCS) 10-1, specific to document retention as indicated. The Contractor’s voice files and word processing files of transcribed documents will be destroyed six (6) months following transcription of such voice files and uploading into VISTA TIU. VA Form 7468 must be completed for record destruction and sent to the COR.

3.0 Definitions:

3.1 STAT – Immediately. Report shall be transcribed within 2-4 hours because the patient is being admitted to the hospital or being transferred to another health care facility.

3.2 Character - Printable ASCII characters, including a single space, <CR><LF>. A space between words is counted as one ASCII character. Carriage returns to create blank lines are excluded.

3.3 Line – A full line is 65 keystrokes/characters. Special formatting (underlining or bolding) or vertical spaces between lines, between paragraphs, or between text and footers, are not billable. Pre-transcribed radiology/nuclear medicine narratives cut and pasted into reports shall count towards line count.

3.4 Report Type – a type of report, e.g., discharge summary, operative report, progress notes/minor procedures, compensation and pension report.

3.5 Contracting Officer (CO) will delegate a Primary Contracting Officer’s Representative (COR) to represent the interests of the VISN 21. The CO will also delegate Alternate CORs for each of the site. The Primary COR will be responsible for providing technical support to the Contractor and who will work with the Contractor to identify and resolve problems specific and unique to each site.

3.6 Alternate Contracting Officer Representative (COR) – Each VISN 21 site will provide a certified Alternate COR to monitor the contract and to report issues relating to his/her site to the VISN 21 COR.

3.7 VistA – Veterans Health Information Systems and Technology Architecture platform, based on American Standard Code for Information Interchange (ASCII) format.

3.8 Turnaround Time (TAT) - Turnaround time is determined by comparing Date/Time of dictation with the date/time of entry into VistA.

3.9 Visible Black Character. A Visible Black Character is defined strike-able and visible characters and includes any printed letter, number, symbol, and/or punctuation mark excluding any or all formatting (e.g., bold, underline, italics, table structure, formatting codes). All visible black characters can be seen with the naked eye as a mark, regardless of whether viewed electronically or on a printed page.

3.10 Visual Black Character (VBC) Line or ASCII no Spaces Line. A VBC Line is defined as the total number of characters you can see with the naked eye, divided by 65. It includes any character contained within a header or footer. Spaces, carriage returns, and hidden format instructions, such as bold, underline, text boxes, printer configurations, spell check, etc., which are not counted in the total character count. A VBC Line is calculated by counting all visual characters and simply dividing the total number of characters by 65 to arrive at the number of defined lines.

3.11 QASP (Quality Assurance Surveillance Plan). This plan provides a systemic method to evaluate performance for the stated contract. The QASP explains what will be monitored, how monitoring will take place, who will conduct the monitoring and how monitoring efforts and results will be documented.

3.11.1 The QASP is a “living document” and the Government may review and revise it on a regular basis. However, the Government shall coordinate changes with the Contractor. Copies of the original QASP and revisions shall be provided to the contractor and Government officials implementing surveillance activities.

4.0 Contractor’s Responsibilities and Tasks:

4.1 The specialized vocabularies shall encompass a variety of subjects in fields of medicine and surgery to include: Anesthesiology, Cardiology, Dermatology, Dentistry, Drug and Alcohol treatment, Endocrinology, General Medicine, Gastroenterology, General Surgery, Gynecology, Hematology, Immunology, Neurology, Neurosurgery, Oncology, Ophthalmology, Oral Surgery, Orthopedics, Otolaryngology, Peripheral Vascular Surgery, Psychiatry, Psychology, Plastic Surgery, Pulmonary Disease, Renal, Rheumatology, Urology, Spinal Cord Injury, Thoracic Surgery, and Research.

4.2 Method of getting transcribed reports into VistA shall vary depending on the type of reports. Specialized reports include, but are not limited to: Interventional Radiology, Computerized Tomography, Ultrasound, Doppler Ultrasound, Neuro-Radiology, Nuclear Medicine, Magnetic Resonance Imaging (MRI), General Radiology, Pathology and Compensation and Pension.

4.3 Transcription of specialized reports shall be performed in real-time and directly into the appropriate VistA package.

4.4 Turn-around time (TAT):

4.5 Transcription/Document Format: Specific report formats provided by the appropriate VA Medical Facility COR shall be followed. The COR will supply the Contractor with samples.

4.6 System Access: Any remote access to VA systems that contain sensitive information shall be performed through the One-VA VPN. After contract award and prior to VA granting VPN access, the Contractor shall be required to complete all security requirements.

4.7 Transmission Upload Requirements: All VA medical facilities covered by the resultant contract will provide access to VistA after award of the contract. Transcribed documents shall be either electronically transmitted or capable of being uploaded into each VA medical facility mainframe computer system (herein referred to as VistA) or uploaded directly into VistA from the Contractor.

4.8 Validation of turn-around time: Within 24 hours of the request, the Contractor shall be able to produce accurate automated reports showing the following;

4.9 Variations: Material is dictated by many different physicians and other personnel, which will require the Contractor and his/her equipment to adapt to variations on accents, speech, tone, voice volume, speed, delivery, pronunciation and enunciation.

4.10 Technical Support: The Contractor shall provide a 24-hours per day, seven days a week emergency toll-free telephone number to allow employees to alert the Contractor of technical problems which prevent staff and employees from dictating, using any of the features of the dictation system, accessing transcribed documents, signing onto the Contractor’s system as a transcriber, etc. The Contractor shall return the emergency notification within 60 minutes to verify receipt of the call and to indicate what action is being taken.

4.11 Help Desk: The Contractor shall provide toll-free telephone support between the hours of 0700 PST (Pacific Standard Time) and 1900 PST, Monday through Friday, including Federal holidays (See SOW 9.2). The Contractor shall have access to digitized voice recordings, transcribed work, VistA, and shall be able to directly respond to requests from VA medical facilities practitioners regarding needed fixes or transcription errors and to re-transmit transcribed work, or to contact the individual responsible for re-transmitting the work if required. The Contractor shall be able to relay common errors to regular transcription staff in the event the responsible transcriber is not available during business hours

4.12 Estimated Volume of Work: The Contractor shall have a plan to address periodic fluctuations (increase or decrease) in the VA workload.

5.0 Contractor Personnel and Qualifications:

5.1 The Contractor shall ensure that proper staffing levels are maintained at all times as stated in the SOW.

5.2 The Contractor shall meet the following mandatory minimum experience and training requirements. The Contractor shall submit in writing to the COR or designated representative identifying employees who have met the mandatory minimum requirements prior to the start of work.

5.2.1 Must possess High School Diploma or equivalent.

5.2.2 Have a minimum of two years of experience in medical transcription field or a Medical Transcription program certificate of completion from a university, community college or vocational school.

5.2.3 Basic knowledge of medical terminology, anatomy and physiology, disease processes, signs and symptoms, medications, and laboratory values.

5.2.4 Knowledge of medical transcription guidelines and practices.

5.2.5 Have and possess proven skills in English usage, grammar, punctuation, style and complex medical terminology (provide examples from similar experience).

5.3 The Contractor shall provide a Contract Manager and an alternate in absence of the Manager who shall act with the full authority for the Contractor. The Contractor shall provide toll-free telephone numbers to reach the Contract Manager and/or alternate(s). The Manager or designated alternate(s) shall be available 24-hours per day, seven days a week, 365 days in the year.

5.4 The Contractor shall restrict the employment to any individuals who has been identified as a potential threat to the health, privacy, safety, security, general well-being or operational mission of the Department of Veterans Affairs (DVA) and its beneficiaries.

5.5 The Contractor shall furnish a list of all employees who are identified and trained to perform the duties of a Transcriber to the COR prior to the start of contract performance. The list shall include the full name and work assignment of each employee. The Contractor shall notify the respective COR of all additions, deletions, or changes at least five (5) days in advance of such changes whenever practicable, or as soon thereafter as is reasonably practicable.

6.0 Contractor’s Quality Control Plan (QCP):

6.1 The Contractor shall implement and maintain a complete quality control (QC) program that all requirements are provided for, as specified in all sections of this contract. One copy of the Contractors QCP shall be provided to the COR for review prior to contract performance. The Contractor’s QCP shall include but not be limited to the following:

6.1.1 A statement describing how the Contractor will meet the basic requirements of this contract (i.e. staffing levels, time to respond to an incident, equipment requirements) shall be provided to COR 15 days after effective date of Contract award and whenever there are major turnover of personnel. A major turn-over would be determined by the COR.

6.1.2 A method for identifying deficiencies in the quality of services performed before the performance deficiency becomes unacceptable. The QCP shall contain processes for corrective actions without dependence upon Government direction and shall maintain records of all Contractor QC inspections and corrective actions.

6.1.3 A method of recording or logging the daily activities of the Contractor, which would demonstrate the Contractor's ability to maintain the minimum requirements of this contract.

6.2 The Government will monitor the contractor's performance using the Contractor’s QCP and the Government’s Quality Assurance Surveillance Plan (QASP) as established by the COR.

6.3 The Contractor shall provide monthly QC assurance report. It shall include the results of the reviews, identification of problems and a plan of correction. Follow-up reviews shall ensure the highest quality transcription and clerical support.

6.4 The Contractor shall have a written security plan to assure that the requirements of the contract are met as specified herein. The plan shall be for the physical facility at the contractor’s place of business, as well as for the remote transcriptionists’ locations. It shall address security issues, including identifying the security system employed to maintain patient confidentiality, and identifying the virus protection to be used.

7.0 Quality Assurance Surveillance Plan (QASP)

7.1 QASP. The Government’s QASP is attached to this solicitation (Attachment E). The QASP will be used by the Government to monitor and evaluate the Contractor’s performance using mostly from customers complaints. The Government will used random, scheduled and unscheduled inspections of the various reports transcribed to determine the validity of the customers’ complaints. Performance will be recorded by the COR or designated representative and when an observation indicates defective performance, the COR will request the Contractor or designated representative to initial the observation.

8.0 Transcriptions – Error Rate

8.1 Transcriptions shall contain no more than one (1) error per report. Errors are defined as follows:

8.1.1 Omitted material that is legible or intelligible

8.1.2 Misspelled words

8.1.3 Transposed letters

8.1.4 Information located under wrong field within the document (e.g. History of Present Illness, Medications, etc.) or under the wrong document type (e.g. History and physical, Discharge Summary, etc.) unless it cannot be determined where it belongs.

8.1.5 Transcription that is not reflective of medical dictation, including material that is not part of the report such as dictator’s directions to the transcriptionist.

8.1.6 Punctuation that changes the meaning of a sentence

8.1.7 Unauthorized abbreviations (COR will provide a list of approved abbreviations)

8.1.8 Reports that are illegible or otherwise unclear

8.2 Three hyphens (---) shall identify missing/unintelligible text on reports uploaded into VistA.

8.3 In the event the Contractor experiences a problem in transcribing, e.g., poor transmission, inability to connect to VistA, or unfamiliar terminology, the Contract Manager shall immediately contact the COR or designated representative to identify the problem. The COR or designated representative shall attempt to resolve problems as they arise.

8.4 All transcription shall be accomplished using a 12-pitch or equivalent type-style element.

8.5 The Contractor shall be responsible for correct spelling, including unfamiliar words, checking medical dictionaries and references when needed to distinguish between similar-sounding terms. All material shall be transcribed in the tense dictated. Only terms approved by the Department of Veterans Affairs (DVA) shall be used.

8.6 The COR will randomly check for errors and verify line counts. Each individual section shall be responsible to check for errors and verify their individual line counts.

8.7 Complete reports with more than the allowable error rate shall be returned for correction at no additional charge to VA Medical Facility.

8.8 The Contractor shall meet all turnaround times as stated in SOW 4.4.

8.9 Reports lost or damaged by the Contractor shall be redone at no additional charge to the Government. The Contractor shall provide an explanation in writing to the COR within 24 hours of the lost or damage. (Reference Far 52.212-4(a)).

9.0 Work Hours for the Contractor:

9.1 The Contractor shall transcribe and process work from 7:00am to 7:00pm everyday including holidays.

9.2 Holidays are identified as the following Federal holidays are observed by the United States Government – New Year’s Day, Martin Luther King Day, President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran's Day, Thanksgiving Day, Christmas Day, and any other specifically declared by the President of the United States. When a holiday falls on a Sunday, the following Monday will be observed as a legal holiday. When a holiday falls on a Saturday, the preceding Friday is observed by U.S. Government agencies.

10.0 Contractor Furnished Equipment and Supplies:

10.1 The Contractor shall furnish all materials and equipment necessary to perform the tasks specified in this SOW.

10.2 The Contractor shall have the capability to store digitally dictated voice recordings for a period of not less than twelve (12) months, allowing VA Medical Facilities to review dictated reports during that period on an “as-needed basis.” Recordings shall be easily accessible.

10.3 The Contractor shall have the capability to store transcribed reports on a secure web browser site for a period of not less than twelve (12) months, allowing VA medical facilities to print a copy of any report transmitted during that period on an as-needed basis. Transcribed documents shall be easily accessible.

10.4 The Contractor shall provide 1-800 phone numbers for Government’s access.

10.5 The Contractor’s digital dictation system shall be capable of rewind and playback and capable of pausing five (5) minutes without disconnecting.

10.6 The Contractor shall provide the daily log of all transmitted reports to each VISN site specifically to the Technical Monitors by the beginning of the next work day.

10.7 The Contractor shall use a suite of web-based applications which completely automates the preparation, routing and delivery of the entire dictation, transcription and documentation process.

10.8 The Contractor shall maintain a “Secure-File Transfer Protocol” server with the capability for access by individual facility staff for retrieval of transcribed documentation.

11.0 Contractor’s Training Requirements:

11.1 The Contractor shall maintain an ongoing training plan. The COR will review the Contractor’s training records upon request and as needed. Upon request the Contractor shall provide copies of training records to the COR or designated representatives.

11.2 The Contractor shall complete the following VA mandatory training and other training deemed by the VA as mandatory training in the VA Talent Management System (TMS) online:

11.2.1 VA Privacy and Information Security Awareness and Rules of Behavior (VA 10176)

11.2.2 Privacy and HIPAA Training (VA 10203)

12.0 Contractor’s Contingency Plan

12.1 In the event of system downtime that exceeds 12 hours (3 hours for STAT transcription), system failure, or Act of God, the Contractor shall provide copies of documents by facsimile transmission or other expedient means;

12.2 The Contractor shall maintain the electronic file for upload as soon as possible when the system is available. The Contractor shall furnish a copy of its contingency services plan with their offer. The contingency plan shall have no more than a three-hour delay before implementation. The contingency plan shall include an alternate toll-free number to be used in case of equipment failure and specific instructions for system users.

12.3 Audio Tapes: The Contractor shall have the capability to provide transcription from audio tapes (any standard type/size) on an as-needed basis.

13.0 Security Requirements

13.1 The Contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA personnel, regarding information and information system security. These include, but are not limited to Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130 and guidance and standards, available from the Department of Commerce’s National Institute of Standards and Technology (NIST). This also includes the use of common security configurations available from NIST’s Web site at: http://checklists.nist.gov

13.2 To ensure that appropriate security controls are in place, the Contractor shall follow the procedures set forth in “VA Information and Information System Security/Privacy Requirements for IT Contracts” located at the following Web site:

http://www.iprm.oit.va.gov/docs/Security_and_Privacy_Requirements_for_IT_Contracts_Attachment.pdf

13.3 These provisions shall apply to all contracts in which VA sensitive information is stored, generated, transmitted, or exchanged by VA, the Contractor, the subcontractor or a third-party, or on behalf of any of these entities regardless of format or whether it resides on a VA system or the Contractor or the subcontractor’s electronic information system(s) operating for or on the VA’s behalf.

13.4 The Contractor and their personnel shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

13.5 The Contractor is required to complete and submit the Contractor Security Control Assessment (CSCA), version 1.2, dated 05/15/2009, or the latest version available (Attachment C).

13.6 Privacy Act: The Contractor shall be responsible for safeguarding all confidential information. The Contractor shall keep all information confidential pursuant to, and comply with all provisions of, the Privacy Act of 1974, HIPAA, the Freedom of Information Act, M-1, Part 1, Chapter 9 and other VA regulations.

13.7 Violation of the Privacy Act of 1974 may involve the imposition of criminal penalties. The Contractor shall protect against loss or misuse of all dictated and transcribed documents. The documents described in this solicitation are irreplaceable medication information. The Contractor shall insure the confidentiality of all patient information, and shall be held liable in the event of breach of confidentiality.

13.8 The Contractor shall ensure the confidentiality of all patient and provider information. The Contractor shall not retain information longer than herein required sensitive or patient identifying data and shall comply with all directives and regulations pertaining to the Privacy Act of 1974, Freedom of Information Act, and VA Manual M-1, Par, Chapter 9. Contractor and all contract employees shall be required to sign confidentiality statements.

13.9 The Contractor shall adhere to the following policies and laws are applicable to all services to be provided under this contract. These policies and laws are retrievable via the worldwide web.

13.9.1 Healthcare Insurance Portability and Accountability Act of 1996 (HIPPA)

13.9.2 Fraud and Related Activity in Connection with Access Devices and Computers, 18 U.S.C. 1029-1030

13.9.3 Electronic Communications Privacy Act of 1986, PL 99-508

13.9.4 Title 38, U.S.C. 5701, VA Claims Confidentiality Statute

13.9.5 Title 38, U.S.C. 5705, Confidentiality of Healthcare Quality Assurance Records

13.9.6 Title 38, U.S.C. 7332, Confidentiality of Certain Medical Records

13.10 Veterans Health Affairs (VHA) Business Associate Agreement (BAA): The Contractor shall execute a BAA upon award of the contract. (Attachment A)

14.0 Payments and Invoicing

An itemized invoice shall accompany each service order from the contractor. This invoice must show item number, description, quantity, unit, unit price, and totals for each design (advanced and basic) used. All invoices shall include contract number, purchase/delivery order number and detail of services provided. The itemized invoices submitted for payment through OLCS shall include the contract number, purchase/delivery order number and detail of services provided. All invoices will be submitted in accordance with these instructions.

VA uses a third party invoicing provider named Tungsten to provide us with electronic invoices. Please register with Tungsten so you can submit your invoice electronically to us for processing as it is a federal mandate. Contractor will need to go to the Tungsten website http://www.tungsten-network.com/uk/en/ for the registration process.

Invoices will be electronically submitted to the Tungsten website at http://www.tungsten-network.com/uk/en/ Tungsten direct vendor support number is 877-489-6135 for VA contracts.

The VA-FSC pays all associated transaction fees for VA orders. During Implementation (technical set-up) Tungsten will confirm your Tax Payer ID Number with the VA-FSC. This process can take up to 5 business days to complete to ensure your invoice is automatically routed to your Certifying Official for approval and payment. In order to successfully submit an invoice to VA-FSC please review “How to Create an Invoice” within the how to guides. All invoices submitted through Tungsten to the VA-FSC should mirror your current submission of Invoice, with the following items required. Clarification of additional requirements should be confirmed with your Certifying Official (your CO or buyer). The VA-FSC requires specific information in compliance with the Prompt Pay Act and Business Requirements.

For additional information, please contact:

Tungsten Support Phone: 1-877-489-6135 Website: http://www.tungsten-network.com/uk/en/ Department of Veterans Affairs Financial Service Center Phone: 1-877-353-9791 Email: vafscched@va.gov

15.0 Acronyms descriptions

15.1 CO – Contracting Officer

15.2 COR – Contracting Officer’s Representative

15.3 FTP – File Transfer Protocol

15.4 HIM – Health Information Management

15.5 IDCU – Integrated Data Communications Utility

15.6 PST – Pacific Standard Time

15.7 QASP – Quality Assurance Surveillance Plan

15.8 QC – Quality Control.

15.9 RAS – Remote Access Server

15.10 VHA – Veterans Health Affairs

15.11 VistA – Veteran’s Health Information Systems and Technology Architecture

16.0 Other Security Considerations (Installation Security Officer)

16.1 General

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

16.2 Access to VA Information and VA Information Systems

16.2.1 A contractor/sub-contractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

16.2.2 All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

16.2.3 Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

16.2.4 Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

16.2.5 The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

16.3 VA Information Custodial Language

16.3.1 Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data- General, FAR 52.227-14(d) (1).

16.3.2 VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

16.3.3 Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

16.3.4 The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

16.3.5 The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

16.3.6 If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

16.3.7 If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

16.3.8 The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

16.3.9 The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

16.3.10 Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

16.3.11 Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

16.3.12 For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

16.4 Information System Design and Development (if applicable)

16.4.1 Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

16.4.2 The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

16.4.3 The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default “program files” directory and silently install and uninstall.

16.4.4 Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

16.4.5 The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

16.4.6 The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

16.4.7 The contractor/sub-contractor agrees to: