P09 - PWS - Updated 2 Aug 2022.docx

PERFORMANCE WORK STATEMENT

AMBULANCE SERVICE

VETERANS AFFAIRS PALO ALTO HEALTH CARE SYSTEM

1. GENERAL SPECIFICATIONS

A. Purpose: The contractor will provide twenty-four (24) hour ambulance services as needed for beneficiaries of the Department of Veterans Affairs (DVA). These services are to assure appropriate transportation for authorized beneficiaries between designated sites within the service area of the VA Palo Alto Health Care System (VAPAHCS). The contractor will provide Basic Life Support (BLS), Advanced Life Support (ALS), and Critical Care Transport (CCT) ambulance services to all of the defined areas and such service will include all labor, materials, equipment and supplies that might be required. The services will be classified as Standard or Urgent.

Service Area: The contractor shall provide services to the service area of the VAPAHCS listed in the Schedule to which award is given. The requirement spans the following California counties: Monterey, Alameda, San Mateo, San Joaquin, Santa Cruz, Santa Clara, San Benito, Stanislaus (Modesto) and Tuolumne (Sonora). The principle campuses of the VAPAHCS in this contract are in Palo Alto, Menlo Park, and Livermore. If awarded a contract for this Region, the contractor must be able to provide service within this general service area.

B. Definition of Services Performed: The contractor will provide ambulance service at all of the established levels of patient acuity - BLS, ALS, and ALS/Critical Care. The definitions of these acuity levels will be established within the specificity of industry standards. In general, the definitions are:

1. BLS: Basic Life Support, which includes service, provided by licensed/certified Emergency Medical Technicians (EMTs). ALL of the attendants on the vehicle will be a fully certified EMT as defined by California State laws/regulations, county regulations, and local ordinances.

2. ALS: Advanced Life Support which includes the BLS level but one of the attendants will be a licensed/certified paramedic.

3. Critical Care: Advanced Life Support, this usually will include the presence of a nurse or physician plus the EMTs or paramedics. For patient transport involving PCI (Percutaneous Coronary Intervention) with Intra-aortic Balloon Pump Transport, an oversize “big box” ambulance will be required, response time from call to pick up: 15 minutes. The oversize ambulance must be capable of accommodating the following VA staff: MD, Nurse, Respiratory Therapist and Cardio Pulmonary Resuscitation (CPR) Performer.

4. Standard: An ambulance is dispatched within two hours upon call by the DVA. Dispatch times may vary upon agreement between the contractor and the DVA for long-distance transports greater than 100 miles. Long distance trips require 24 hours’ notice to perform.

5. Urgent Care (STAT) (“Urgent”): An ambulance is dispatched within one hour upon call by the DVA. This is an additional service to 1-3. Urgent is defined as needing medical care that if delayed could cause harm to the patient.

This requirement applies only if the contractor is currently offering these services in their service areas.

6. Definition of “Trips”:

a. From pickup location to delivery location (also a “one way trip”)

b. From pickup to delivery and return to pickup location (also a “round trip”).

C. Vehicle Standards:

1. The contractor will provide services utilizing ambulances that are licensed and meet the minimum vehicle requirements mandated by the State of California, the California Highway Patrol Ambulance Service criteria, and any mandated local codes or industry standards.

2. The VA reserves the right to inspect the contractor’s equipment and vehicles or require documentation of compliance with contract specifications and State laws, rules, regulations, and guidelines governing medical transport vehicles (ambulances). VA inspections of contractor facilities shall in no way constitute a warranty by the VA that the contractor’s vehicles and equipment are properly maintained. The VA reserves the right to restrict the Contractor’s use of equipment and vehicles which are in need of repair, unclean, unsafe, damaged on the interior or exterior body, and are not in compliance with contract requirements. The restriction of such equipment and vehicles shall not relieve the contractor from performing in accordance with the strict intent and meaning of the contract without additional cost to the Government.

3. The Ambulance will comply with GSA Specifications KKK-A-1822.

D. Definition of Authorized Beneficiary:

1. The contractor will transport only one (1) patient per trip unless specifically authorized by a physician or other designated VA staff member. Authorization to use an ambulance for patient transportation MUST come by order of a VA physician. The process of issuing an authorization will come from a designated VA staff member (by direction of a VA physician) and the authorization MUST be obtained prior to the commencement of transportation.

The VA is solely responsible for the authorization of Veteran Beneficiaries. It is not the responsibility of the contractor to check eligibility of the Veteran.

2. When multiple patients are transported: More than one (1) patient may be transported only in those cases where a VA physician or other designated staff member approves. In these cases, reimbursement will be made at the rate NOT to exceed the cost of a single patient. If the transportation is beyond defined city limits, the longest distance over which one of the patients is transported may be claimed. (In the case of transportation beyond city limits, the contractor will ensure that the trips are scheduled so that the total distance traveled will result in the most economical charge to the VA.)

3. Staff members designated to authorize ambulance transportation at VA expense will be detailed by name for the VAPAHCS. These names will be provided at the initiation of the contract and the contractor MUST assure that authorizations are accepted only from the staff so designated.

E. Performance Criteria:

1. The contractor shall provide ambulance services that meet the following requirements:

a. Response times will be based upon whether the transportation requested is Standard or Urgent. Unless otherwise agreed upon, a Standard Response time is under two hours. An Urgent/Stat response time is under one hour.

b. Response time calculation: Response time will be calculated from the receipt of the telephonic request for service. At the time of the request, contractor shall acknowledge their ability to provide the service within the requested response time. If the contractor cannot provide the services for any reason, they must notify the VA staff person requesting the service of their inability to provide the service. The contractor is free to subcontract service in order to satisfy the service request. (All companies utilized as subcontractors are subject to approval by the VA and the contractor must provide a list of such subcontractors to the VA.) In the case when a subcontractor is utilized, they must meet all response times and all other requirements of this contract.

c. Waiting time: The contractor is expected to allow for waits of up to 15 minutes at either or both the trip origin and destination. If a wait is expected to exceed the 15-minute interval, the contractor is allowed to bill the VA a wait charge for each additional increment of 15 minutes. Before the contractor waits beyond the initial 15 minutes, the VA staff must be contacted to determine if the additional wait will be authorized. The VA may not authorize unauthorized waiting time charges.

d. Trip documentation: The contractor shall document each transport with an appropriate document that specifies the date, patient name, time of pick-up, destination, time of drop-off, and any notes about issues particular to the specific transport, including recording oxygen, cardiac monitoring, and other services provided. The contractor shall leave a copy of this form with the authorized VA staff (or a copy will be mailed to the specified VA location). These forms will serve as documentation of the transport and will be a source document for reconciliation of the contractor’s filed claims for VA payment.

e. Ordering procedures: Authorized VA staff will telephonically notify the contractor of a request for service. The VA staff is responsible for reviewing and determining that a patient is an authorized beneficiary for transportation. The contractor must not transport any patient without first having VA authorization. (The contractor may propose the use of alternative ordering procedures/systems such as electronic notification. The VA may accept such procedures after consideration and the specific processes will be so documented if accepted.) Authorized VA staff may place orders at any time during the day or night. The contractor must be prepared to accept orders and to provide service 24 hours a day, 7 days per week. When placing orders, VA staff must specify any special services needed, such as oxygen, cardiac monitoring, etc. Additionally, if the request is to transport a patient needing restraint (Mental Health or medical) the specific needs must be specified.

f. Origin and Destination: Patients may be transported to or from any designated location within the defined service area. Most transports will be between VA facilities or between a VA facility and a community health resource. The VA staff will specify the points of origin and the destination of every trip.

g. Emergency diverts: The contractor may determine that a patient requires an emergency divert from a planned transport due to a medical emergency with the patient being transported. Such diversions are allowed as necessary, however, the contractor must notify the VA as soon as possible.

2. Routine Scheduling by the VA:

a. The VA will schedule routine trips when possible by 6:00p.m, the evening before services are required. The VA will provide a list of VA Beneficiaries, which includes but is not limited to pick-up times.

b. The Contractor will send the schedule with any revisions to the VA by 8:00 pm.

F. Contractor Personnel Qualifications:

1. All Contractor personnel performing contract services shall meet the qualifications as specified in this contract, as well as any qualifications by Federal, State, County, and local government entities from the place in which they operate. Contractor personnel shall meet these qualifications at all times while performing contract services.

2. The contractor shall not employ any persons for work on this contract if such employee is considered by the VA Contracting Officer (CO) to be a potential threat to the health, safety, security, or operations of the VA, its facilities or its staff.

a. Contractor’s employees shall understand, speak, read, and write the English language at a level, which promotes effective communication.

b. All contractor employees must have current and valid licenses/certifications before they can begin work on this contract. A copy of all certifications and/or other credentials shall be provided to the VA upon request by the CO or Contracting Officer Representative (COR).

c. No employee of the contractor can be a Federal employee nor can they have any conflict of interest either real or perceived.

d. Identification badges: All contractor employees shall wear appropriate identification that can clearly identify them by name, title, and by job performed.

e. Training: All contractor personnel will have ongoing documented training to maintain their appropriate levels of competency. Records and certifications shall be maintained by the contractor and available for VA inspection upon request. All attendants on the ambulances must have current CPR certification and basic first aid training along with their required certifications. Contractor employees must be trained on the appropriate handling of Mental Health patients and those patients that are developmentally disabled.

f. Organization Chart: Contractor shall provide a copy of their organization chart upon award of the contract. The chart will include names, addresses, and telephone numbers of the project manager and other key staff. When organization changes occur, the VA shall be provided a revised copy within ten (10) days of the official date of change.

3. During the period of performance, if the Contractor proposes to add-on or replace personnel to perform contract services, the Contractor shall submit the required evidence of training, certifications, licensing, and any other qualifications to the Contracting Officer.

4. Emergency Medical Technician (EMT) and Paramedic Qualifications: EMT’s and Paramedic’s providing service under this contract shall have the following qualifications, in addition to those required by Federal, State and Local Government:

a. Have completed training in accordance with the standards published by the Department of Health and Human Services with a minimum curriculum of 150 hours or equivalent including in-hospital training period. Such training program must be also acceptable under the regulating requirements for local EMS systems supported by DHHS under PL 93-154, Federal Register 39.24304 (1974).

b. Shall submit evidence of equivalent training program successfully completed to the Contracting Officer. This will be required in accordance with evaluation factors cited in FAR 52.212-2.

c. All EMT and Paramedics shall conduct themselves in a professional manner at all times. Failure to do so could result in the Government requesting an individual be relieved of duties for the Government.

d. Shall be certified, licensed or otherwise officially recognized by the local, state or regional government entity in which service is rendered. In no instance shall this be less frequent than every two (2) years. Such refresher training shall be equivalent to that developed by the Department of Transportation, National Highway Safety Administration.

5. Registered Nurse (RN): Personnel assigned by the Contractor to performed services by this contract shall be Licensed Registered Nurses in a State, Territory, or Commonwealth of the United States or District of Columbia. The qualifications of such personnel shall also be subject to review by the VA Chief of Staff and approval by the VA Facility Director or his/her designee.

6. Ambulance Driver: All drivers shall have a valid operator’s license to perform the services they perform, be capable of administering oxygen and have successfully completed the Standard and Advance First Aid Course of the American Red Cross or equivalent and be capable of providing necessary medical assistance to the attending medical care specialist.

G. Patient’s Rights:

1. The Contractor shall be courteous to VA beneficiaries and shall not smoke while transporting patients. Patients may bring a reasonable amount of equipment, such as wheelchairs and a personal suitcase.

2. The Contractor shall immediately notify the VA of any incidents involving injury to VA patients during transport. The Contractor shall promptly complete and submit to the COR an Incident Report-Contract Ambulance Contractor with all information deemed to be necessary for any full review.

3. The Contractor shall notify the COR, in writing within 24 hours of any complaint made by the patients or staff with regards to the ambulance service. The COR will report to the Contracting Officer. The Contracting Officer may request an investigation by the Contractor and a Plan of Correction. Repeated problems may warrant a Cure Notice issued by the Contracting Officer and/or Termination for Cause.

H. Infection control requirements.

1. Health tests. Contractor attests that assigned personnel have fulfilled all testing and screening requirements as described below prior to first duty shift. Evaluations and tests shall be current within the past year, except as noted. At the VA’s request, Contractor shall provide proof that all requirements are current and fully met as described within 2 days of request.

2. Tuberculosis Screening and Testing.

a. For those with previous documented positive Purified Protein Derivative (PPD) test results: All Contractor personnel shall provide a note from their physician, dated within the past three months stating they are free of any signs and symptoms of tuberculosis. This evaluation will be renewed annually.

b. For those with previously negative PPD skin test results: All Contractor personnel shall provide proof of a negative reaction to PPD testing, performed in accordance with the latest CDC standards and CDHC/California Tuberculosis Controllers Association guidelines, within the past 6 months. This test shall be renewed annually.

c. For PPD skin converters (a change from a previously negative skin test to positive; defined as an increase in duration of 10mm or more with 2 years): An evaluation from their physician within 30 days of the positive test stating they are free from signs/symptoms of TB and indicating whether prophylactic treatment is indicated. If treatment is indicated, a note from the physician stating it was satisfactorily completed.

d. Rubella Testing. All Contractor personnel shall provide proof of immunization for measles, mumps, rubella or a rubella titer of 1.8 or greater. If the titer is less than 1.8, a rubella immunization shall be administered with a follow-up documentation provided to the COR.

e. Varicella (Chicken Pox) Testing. Provide a history of varicella or, if unknown, results.

I. Authorized VA Personnel: Prior to performance, the Contracting Officer shall provide the Contractor with a list of names or position titles and phone numbers of authorized Government personnel who may request services and receive calls from Contractor regarding contract performance. This list will be updated and submitted to the Contractor as changes occur. The Contractor shall ensure that requests for services are received from authorized medical center personnel. Services rendered in response to requests from other than authorized personnel shall be at the risk of the Contractor and any cost related thereto shall be borne by the Contractor.

J. Reimbursement for Mileage outside Contract Mileage Threshold Areas of Coverage (Outside General Service Area):

(a) Mileage Reimbursement – Reimbursement for mileage outside the contract Mileage Thresholds of coverage shall be at the mileage rate stated in the price schedule and shall be based upon the miles from the pick-up point and the specified destination. Any mileage from the place of business and/or location of vehicle and the pick-up point or from the delivery destination back to the place of business and/or location of next trip are not considered as a separate item of this reimbursement. However this would be expected to be incorporated into the mileage rate as part of the administrative costs (or costs of doing business). All mileage shall be calculated using current BING Maps Standard Mileage Guide (shortest distance). Allowable charges for mileage outside the contract Mileage Threshold areas of coverage shall not exceed 5% of the current BING Maps Standard Mileage Guide.

(b) Should the VA make a determination that a previously scheduled trip may be cancelled and a vehicle has already been dispatched to the designated pick-up point, the VA may notify the Contractor to cancel the order. For orders that are cancelled while the contractor is already in route to the designated pick-up, the contractor shall be entitled to receive 50% of the base rate for the trip, as provided in Schedule of Supplies or Services and Prices/Costs. This charge shall not include any mileage charge.

(c) Should the Contractor arrive at the destination before VA cancels the order, or if the Contractor is unable to perform a scheduled pick-up for reasons beyond the Contractor's control, e.g., incorrect address, or patient absence, or patient refusal, then the Contractor shall receive 100% of base rate for a one-way trip as provided in Part I – Section B (Prices), and applicable mileage if outside contract Mileage Threshold areas of coverage.

K. Escort: The VA reserves the right to have an escort, such as a relative, or care provider of beneficiary or VA staff accompany beneficiary when the VA determines that such an escort is in the best interest of the beneficiary. The VA will also be the sole judge in determining when an escort is required. There shall be no additional charge to the VA when escorts are authorized to travel with beneficiary. Contractor shall only be required to transport escort with patient and shall not be required to return the escort back to point of origin.

L. Substitution of Beneficiary: The VA reserves the right to substitute the beneficiary requiring services at any time during the performance of this contract, to prevent delays, cancellations, or dry runs. There shall be no additional charge to the VA when such changes occur.

M. Dry Runs:

1. Dry Runs will be invoiced at 50% of the rate of the trip. Dry Run is defined as cancellation of an ambulance run after the ambulance is already in route to a destination.

2. SPECIAL REQUIREMENTS

A. Ambulance Medical Equipment: Each ambulance shall have patient compartment facilities, oxygen, and suction systems and environmental climatic supplies as required by the Federal Specification for Ambulances, KKK-A-1822.

B. Invoicing Process: The information in this section modifies invoicing procedures in 52.212-4 to meet Medicare requirements. The contractor shall submit invoices on a monthly basis. Invoices can be prepared following the standard industry practice of utilizing either a HCFA 1500 or UB-92 form. Timely submission of invoices is essential for timely processing by the VA. The invoices must be complete and accurate or they will be returned unpaid for correction. The source documents, described above, will be used to authorize payment. Invoices will be submitted to the respective VA facilities as well as the VA Payment Center in Austin, Texas (VA-FSC):

Invoices must be submitted electronically to VA-FSC in the following way:

Through third-party contractor, Tungsten. Please go to this website: http://www.tungsten-network.com/US/en/veterans-affairs/ to set up an account begin submitting electronic invoices free of charge. VA’s Tungsten buyer number is AAA544240062.

Department of VA/FSC P.O. Box 149971 Austin, TX 78714-8971 Phone: (877) 353-9791

The following is billing address for the VAPAHCS:

C. Licenses and other Certifications: The Contractor SHALL have all necessary license(s) and certifications for the service area.

D. Place of Performance: A MAP AND OTHER INFORMATION OF VISN 21 FACILITIES MAY BE FOUND AT:

http://www.visn21.va.gov/map.asp

1. The contractor (or subcontractor) shall have an ambulance(s) located within the metropolitan limits of the VAPAHCS facility listed below: (twenty-four hours a day, seven days a week). The contractor may propose another location if the response time can be met. This requires approval of the Contracting Officer. The location below is also considered to be place of performance.

VA Palo Alto Main Division 3801 Miranda Avenue Palo Alto, CA 94304

2. The contractor (or subcontractor) shall have an ambulance located within the city limits of the facilities listed below (twenty-four hours a day, seven days a week). The contractor may propose another location if the response time can be met.

This requires approval of the Contracting Officer. The locations below are also considered to be places of performance.

VA Monterey Clinic 201 Ninth Street Marina, CA 93933 VA Capitola Clinic 1350 N. 41st Street, Suite 102 Capitola, CA VA San Jose Clinic 5855 Silver Creek Valley Place San Jose, CA 95138

VA Menlo Park Division 795 Willow Road Menlo Park, CA 94025

VA Livermore Division 4951 Arroyo Road Livermore, CA 94550

VA Fremont Clinic 39199 Liberty Street Building B Fremont, CA 94538

VA Modesto Clinic 1225 Oakdale Road Modesto, CA 95355

VA Stockton Clinic 500 W. Hospital Road French Camp, CA 95231

VA Sonora Clinic 13663 Mono Way Sonora, CA. 95370

E. Records - The contractor shall be responsible for creating, maintaining, and disposing of only those government required records which are specifically cited in this PWS. Staff information may be requested by COR from time to time.

F. Patient Information - Patient information, no matter how developed shall be treated as privileged information under the privacy act and applicable release of information guidelines. Lists and/or names of patients shall not be disclosed to or revealed in any way for any use outside the VAPAHCS without prior written permission by the Chief of Medical Staff.

G. Release of Medical Information - The paramedics shall only release medical information obtained during the course of this contract to other VA or medical treatment facility staff involved in the care and treatment of that individual patient.

H. Patient Sensitivity - Contract paramedics shall respect and maintain the basic rights of patients, demonstrating concern for personal dignity and human relationships. Paramedics receiving complaints validated by the COR and Chief of the Medical Staff shall be subject to counseling and, depending on the nature and severity of the complaint, separation from performing services under this contract.

3. Quality Control (QC)

The contractor shall develop, submit for contracting office acceptance, and maintain a quality control program to ensure the requirements of this contract are performed in accordance with established standards. The contractor shall develop and implement procedures to identify, prevent and ensure non-recurrence of defective services. As a minimum the contractor shall develop quality control procedures (QCP) addressing the areas identified in the service summary. The contractor shall make appropriate modifications (at no additional costs to the government) and obtain acceptance of the plan by the CO. The VA shall reserve the right to determine contractor QCPs unacceptable at any time during contract performance. If a QCP is found to be unacceptable, the contractor shall be notified and the CO will take action to enforce the inspection of services clause requiring an inspection system acceptable to the government

4. Quality Assurance

a. According to the contract’s inspection clause, the government will evaluate the contractor’s performance under this contract. The COR is a representative of the CO and will participate in the administration of this contract. Any matter concerning a change to the scope, prices, terms, or conditions of this contract shall be referred to the CO. All services to be performed by the contractor during the period of this contract will be subject to review by the CO or COR.

b. Contractor Response Time: The contractor shall provide written response addressing the root cause, corrective action and preventive action(s). The contractor will be given up to 48 hours to answer a submitted Corrective Action Report (CAR) and Customer Complaint.

5. Service Summary

Ambulance Response: Response time to Urgent calls within 1 hour response time.

Response time to Standard calls within 2 hour response time.

1(B)(4)(5) 1(E)(1) 95% Compliance

Documentation: Preparation of all required run sheets including, but not limited to timeliness, legibility, accuracy, content and signature.

1(E)(1)(D) 100% Compliance

6. Orientation Period

a. Contractor(s) Phase In: To ensure a smooth changeover from a current contract to a new contractor, a sixty (60) calendar day phase in period is required. The current contractor(s) shall be cooperative to ensure a smooth changeover is accomplished during the phase-in and phase-out periods. During the sixty (60) calendar day phase-in period, the new contractor(s) shall hire a workforce to assure satisfactory performance beginning on the contract start date. The contractor(s), after coordination with the COR, shall allow the successor to conduct on-site interviews with employees. The contractor(s) shall obtain security clearance(s) for Personal Identification Verification (PIV) or contractor(s) badge(s) for the newly hired employee(s). The contractor(s) shall ensure that all training requirements for the newly hired employee(s) are completed before contract start date.

b. Contractor(s) Phase-out Requirements: During the phase-out period, the incumbent contractor(s) shall be fully responsible for all work performed under this Performance Work Statement (PWS). The incumbent contractor(s) shall cooperate fully to permit an orderly changeover of workload. The incumbent contractor shall allow the new contractor and government personnel access on a non-interference basis, to observe the day-to-day operations and to become familiar with the work requirements and procedures.

c. During the orientation period, the contractor(s) shall complete the following:

d. Ambulance service provider must have a license to provide ambulance services from the California State Department of Health, EMS Division and the applicable County(ies) and zones in which award was made.

e. Access government facilities in order to familiarize supervisors, key personnel, and staff with equipment, reporting, work schedules and procedures. However, such access will not interfere with the production efforts of current work force. To preclude such interference, arrangements for access to government facilities will be made with the CO or COR.

f. Provide EMT-Paramedic, State of California license, etc. within 5 business days before period of performance begins.

Appendix B

1. GENERAL (Appendix B)

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/sub-contractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

6. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

7. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/ subcontractor processes or maintains under this contract. However, it is the policy of the VA to forgo collection of liquidated damages in the event the contractor provides payment of actual damages in the amount determined to be adequate by the agency.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code; (3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

9. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

The C&A requirements do not apply, and a Security Accreditation Package is not required.