PERFORMANCE WORK STATEMENT.pdf

B.3 PERFORMANCE WORK STATEMENT

NORTHERN CALIFORNIA VA HEALTH CARE SYSTEM

HEALTH CARE FOR HOMELESS VETERANS (HCHV)

CONTRACTED EMERGENCY RESIDENTIAL SERVICES (CERS)

EMERGENCY HOUSING

A. BACKGROUND

Ending homelessness among Veterans was established as a national priority by the Department of

Veterans Affairs in November 2009 at the National Summit on Ending Veterans Homelessness. In June

2010, the U.S. Interagency Council on Homelessness (USICH) released Opening Doors: Federal

Strategic Plan to Prevent and End Homelessness, which is fully aligned with this goal. Eliminating

Veteran Homelessness remains one of three Agency Priority Goals for in VA’s Strategic Plan.

The Health Care for Homeless Veterans (HCHV) program is an essential and critical part of VHA, providing a gateway to VA and community-based supportive services for eligible Veterans who are homeless. HCHV programs provide outreach services; care, treatment, and rehabilitative services, including case management services; and therapeutic transitional housing assistance under 38 U.S.C.

2032 in conjunction with Work Therapy under 38 U.S.C. 1718. The program uses Contracted Residential

Services in community locations to engage homeless Veterans who have been underserved. Many of these Veterans would benefit from a shelter program but will not avail themselves of these services without the encouragement of outreach workers.

B. PROGRAM DESCRIPTION

The HCHV CERS Program exists to provide a means of removing homeless Veterans from the street or habitation unfit for humans and placing them in community-based, residential environments with sufficient supportive services to meet their basic needs and ultimately, facilitate the improvement of their overall health status and housing situation.

This program will provide case management services to homeless Veterans and be located in Sacramento

County California (See PWS Addendum 1 Zip Codes) and will be for between 20 and 40 beds for men and women (starting with 25 beds). The program should have a minimum establishment of one-year in the required zip codes. Period of performance begins April 1st, 2023.

B.1. HCHV CERS Program characteristics:

B.1.1. Targets and prioritizes homeless Veterans who are eligible for VA health care, and are transitioning from chronic literal street homelessness, Veterans being discharged from institutions, and Veterans who recently became homeless and require safe and stable living arrangements while they seek permanent housing

B.1.2. Seeks to reduce barriers to immediate placement

B.1.3. Does not require any length of sobriety or abstinence from alcohol or other drugs as a condition of admission

B.1.4. Provides safe, secure, and wheelchair accessible housing as well as supportive services.

B.1.5. Lengths of Stay typically range from 30 to 90 days with the option to extend based on clinical need.

B.1.6. Veterans are expected to meaningfully engage their case managers and available

Programming

B.1.7. Emphasis is placed on achieving placement in permanent housing or longer term residential programs that offer path to increased housing stabilization at the time of program exit, and reducing negative exits due to rule violations or other avoidable circumstances.

B.2. House Rules and Expectations

B.2.1. Rules focus on staff and resident safety:

• No buying or selling of alcohol or drugs in the facility

• No use of illicit drugs in the facility

• No sexual activity between residents

• No violence or threats of violence

• Honor nightly curfew

B.2.2. When possible, infractions are to be used to engage residents, not simply as grounds for service termination. Negative discharges will be monitored as a measure of program quality.

B.2.3. Veterans are expected to engage programming and maintain communication with case managers at all times around matters relating to admission, stay, and treatment

B.3. Admission Practices

B.3.1. Staff will assist residents with admission forms and eligibility determination with VA

B.3.2. Facility works to reduce barriers to admission:

• Accepts referrals throughout day if possible

• Flexibility with admission processes

B.4. Admission Criteria

B.4.1. Homeless Veteran

B.4.2. Eligible for VA Health Care

B.5. Overview of Types of Services Available to Residents

B.5.1. Safe, Secure housing (includes shared laundry and restroom facilities)

B.5.2. Three daily nutritious meals

B.5.3. Case Management and Care Coordination Services

B.5.4. Vocational Services

B.5.5. Benefits Services

B.5.6. Enhancement of Independent Living Skills

B.5.7. Permanent/ Transitional housing search support

C. PERFORMANCE WORK STATEMENT

C.1. OBJECTIVE

The Contractor shall provide emergency housing and supportive services for homeless Veterans in accordance with the HCHV CERS model requirements. Services are expected to consist of supportive, secure housing for homeless Veterans. The program places an expectation on the Veteran to engage in supportive case management services, and also on the contractor to provide expertise and guidance for improving housing stability to ensure a transition from homelessness to permanent, stable housing.

Contractors must comply with all HCHV CERS requirements as identified below.

C.2. HCHV CERS PROVIDER QUALIFICATIONS & CAPABILITY REQUIREMENTS

C.2. HCHV CERS PROVIDER QUALIFICATIONS & CAPABILITY REQUIREMENTS

C.2.1. Shall perform outreach or otherwise identifying and referring homeless Veterans with a desire to work on obtaining permanent housing, working increasing income, and stabilizing medical and mental health;

C.2.2. Shall provide secure, separate housing and bathroom accommodations for males and females; common use of kitchen facilities and dining rooms is acceptable;

C.2.3. Shall provide services twenty-four (24) hrs. a day for Veteran placements lasting up to ninety (90) days per Veteran. Extensions beyond initial ninety (90) days should be authorized in writing by VA Liaison; extensions beyond six (6) months must be prior-approved by the Social Work Service Contract Coordinator/ COR;

C.2.4. Shall provide three daily nutritious meals and reasonable accommodation for special dietary needs;

C.2.5. Shall offer a means for clients to wash their own clothes or otherwise tend to laundry;

C.2.6. Shall provide secure, appropriate storage for both Veteran belongings and medication;

C.2.7. Shall provide quality case management and treatment services that utilize a Recovery

Model approach that includes elements of motivational interviewing, harm reduction, and critical time intervention ;

C.2.8. Shall maintain a minimum of one staff member on site at all times to ensure appropriate response to matters involving Veteran safety;

C.2.9. Shall provide a working phone line and ensuring reasonably prompt communication with the VA is possible at all times;

C.3 DIRECT VETERAN CLINICAL SERVICES: 60% of time involves direct service to Veterans

C.3.1. Occupancy: The contractor will be responsible for ensuring that a minimally acceptable level of 80% occupancy (Preferred 90-100% occupancy) of HCHV CERS funded beds is maintained at all times through independent outreach efforts as well as by collaboration with

VA.

C.3.2 Care Planning: Contractor will engage the veteran in a collaborative assessment of needs, including barriers to stable housing, and create an initial plan of care to address those concerns within 14 days of admission. This plan is to be updated as needed throughout the Veterans episode of care.

C.3.3. Case Management: Contractor will provide individual case management meetings at least three (3) times per month (preferably once per week) that focus, at a minimum, on: housing search and stabilization, increasing income, any necessary coordination of ongoing participation in care provided by VA/community medical and/or mental health care providers, and ongoing discharge planning.

C.3.4. Exits to Independent Housing: The contractor is expected to promote a focus on achieving stable, independent housing for all Veterans referred for care; exits to permanent, independent housing will be monitored as an indicator of overall program quality utilizing data provided by the VHA Support Service Center’s Homeless Service Scorecard – the target rate for exits to this type of housing will be 55% or higher (Accepted 50% or higher).

C.3.5. Negative Exits: The contractor is expected to facilitate Veteran completion of the HCHV

CERS Program to the maximum extent possible, while still maintaining program integrity and safety; “Negative Exits,” which shall be defined as discharges involving Veterans being asked to leave the program due to rule violation or otherwise leaving the program without consulting program staff in any way, shall be monitored on a continuous basis utilizing data provided by the VHA Support Service Center’s Homeless Service Scorecard – the target rate for these types of exits will be 20% or less (Accepted 25% or less).

C.3.6. Environmental Checklist: The contractor will allow VA liaison to conduct unannounced site visits at a minimum of 4 times in a fiscal year, which includes, but is not limited to: inspecting the program facility, ensuring that there are no health code or safety violations, inspecting the medication storage area/room, and ensuring that Veterans are provided with 3 meals a day plus snacks, have adequate bedding, and storage for their belongings.

C.4. ADMINISTRATIVE SERVICES: 40% of time does not involve direct service to Veterans

C.4.1. Determination of Eligibility: The contractor is responsible for determining Veteran eligibility for placement into HCHV CERS Bed. A Veteran must be homeless and eligible for VA health care in order to be considered for admission to any CERS Program. Failure to establish eligibility prior to admission may result in denial of payment for services provided to ineligible Veterans.

C.4.2. Release of Information: The contractor shall ensure that a signed VA Release of Information

(ROI) is obtained for any Veteran being admitted to an HCHV CERS Bed and placed into individual case record.

C.4.3. Individual Case Records: The contractor will maintain an individual case record for each referred Veteran. Case records must be maintained in security and confidence as required by the Confidentiality of Alcohol and Drug Abuse Patient Records (42 CFR part II) and the

Confidentiality of Certain Medical Records (38 USC 7332), and in accordance with the Health

Insurance Portability and Accountability Act (HIPAA: Pub. Law. 104–191). Records should contain at a minimum: Reason for referral; pertinent demographic information; copies of any medical prescriptions/orders issued by physicians; case management/treatment notes; any critical incident reports; and a final summary that include reason(s) for leaving, the Veteran’s known future plans, and follow-up locator information, if available.

C.4.4. Homeless Management Information System (HMIS) Data Reporting: Veterans served through VA’s HCHV CERS program must have client level data entered into the local

Community Continuum of Care’s (CoC) HMIS. Data entered must include, at a minimum, the

Universal Data Elements from the 2010 HMIS Data Standards.

C.4.5. Daily Census Sign-In Sheet: The contractor is responsible for collecting Veteran participant signatures on a daily census sign-in sheet to verify attendance in the program. This information is to be provided to the VA Liaison on a daily basis in order to ensure effective monitoring of bed utilization.

C.4.6. Incident Reporting: The contractor shall notify the VA immediately when any adverse critical incident involving a Veteran admitted to the program occurs. Critical Incidents shall include:

• Falls

• Elderly/Dependent Adult Abuse or Neglect

• Sexual Assault

• Fire (Veteran Involved)

• Medical or Mental Health Emergency (911 Calls)

• Hospitalization

• Suicidal ideation or attempt

• Homicidal ideation

• Assault (of other residents or Staff)

• Death

• Infectious Control Concerns (Bed Bugs, TB, etc.)

• Observation/ Possession of Weapons

During normal business hours, the identified VA Liaison, HCHV Coordinator or COR should be contacted immediately by phone to report such an incident; if the incident occurs after hours, the local VA Facility Administrator on Duty (AOD) should be notified, also by telephone. A written report to the VA Liaison and/or COR should follow within 24 business hours. The report should list known precipitating factors or triggers. Contractor shall maintain a copy of all critical incident reports in the involved Veteran’s individual case record.

C.4.7. Extension Requests: The contractor is responsible for ensuring that all requests for extension of services beyond the initially authorized service period of 90 days are reviewed and approved in writing by the VA Liaison (or Social Work Service Contract Coordinator/ COR for requests exceeding six (6) months).

C.4.8. Satisfaction Surveys: When requested, the contractor will be responsible for administering, collecting, and delivering to VA Liaison a survey of the Veterans experience in the program.

C.4.9. Discharge Reporting: The contractor is responsible for notifying the identified VA Liaison

(or designee) within 24 business hrs. that a discharge has occurred, and for providing a written report of discharge that contains the specific data required by the Northeast Program

Evaluation Center (NEPEC) for documentation of discharge in the Homeless Operations and

Management Evaluation System (HOMES) within 48 business hrs.

D. DELIVERABLES

D.1. QUALITY CONTROL BUSINESS PLAN: The contractor shall submit a Quality Control

Business Plan that supports the program objectives and associated tasks. The CO shall review and comment as necessary to ensure that contract goals are met.

D.2. STAFFING AND SERVICE PLAN: The contractor shall provide a detailed staffing and service plan. Plan should demonstrate that sufficient professional personnel are employed to carry out the policies, responsibilities, and services required under this contract. The Contractor must identify each person functioning as “Key Personnel” under this contract, and provide the

VA with a description of the services to be provided by each person. The Contractor shall assign to this contract personnel that by education and/or training (and, when required, certification or licensure) are qualified to provide the services required by this PWS. Contractor may be required to supply a resume(s) summarizing relevant skills and experience of any/all key personnel upon request. Minimum Key Personnel requirements are as follows:

D.2.1. One administrative staff member, or designee of equivalent professional capability (with the authority to make decisions regarding the facility and residents, or with contact information for an offsite administrator in case of emergency), on duty on the premises or providing awake supervision of residents and staff 24 hours a day, 7 days a week.

D.2.2. Sufficient case management/counseling personnel to provide direct services to Veteran residents. Case managers should have some training and experience working with homeless individuals; experience working with individuals dealing with chronic medical, mental health and substance abuse problems is highly desirable. Staff working with

Veterans should be able to assess, anticipate, and effectively refer Veterans experiencing crises for additional support as appropriate.

D.2.4. At least one staff or security member with CPR certification on site and available in an emergency during each shift, 24 hours per day.

The contractor shall provide resumes for any proposed substitutions of key personnel, at least 15 days proposed date of substitution. substitution is to occur. The Contracting Officer shall notify the contractor within fifteen (15) calendar days after receipt of all required information if the VA is able to accept the proposed substitute key personnel. Temporary substitutions of key personnel shall be permitted in accordance with the contractor’s contingency plan. The contractor’s contingency plan to be utilized if personnel leave contractor’s employment or are unable to continue performance in accordance with the terms and conditions of the resulting contract should be submitted to CO as a part of proposal package. The CO is the ultimate authority on acceptable length for temporary substitution of key personnel.

The VA reserves the right to refuse or revoke acceptance of any key personnel if personal or professional conduct, or lack of required skills or experience jeopardizes patient care or interferes with the regular and ordinary operation of the facility and the HCHV CERS Program.

D.3. DOCUMENTATION OF SUPPORTIVE SERVICES: The Contractor shall provide written documentation constituted by the individual Veteran case record that verifies the provision of all supportive services required under this contract for each Veteran participant.

D.4. CARE PLAN: The written plan of care shall be completed and entered into the individual

Veteran case record no later than day 14 days after being admitted to the program.

D.5. CRITICAL INCIDENT REPORTS: Written critical incident reports must be submitted to the

VA Liaison within 24 business hours (VA Liaison/AOD to be notified immediately or as soon as possible when incidents occur).

D.6. EXTENSION REQUESTS: Written requests for extension are due prior to the 90th day when it is anticipated the Veteran will require additional time beyond the initially authorized service period, and prior to the expiration of the initial and any and all subsequent future extension authorizations.

D.7. DISCHARGE REPORTS: The HOMES Exit form shall be completed and submitted to the VA

Liaison within 48 business hours (VA Liaison to be notified within 24 hours of discharge).

D.8. SATISFACTION SURVEYS: When Veteran Resident surveys are being provided by VA to the program to give to Veterans, completed surveys are to be returned to the VA Liaison at the end of each month.

D.9. DAILY CENSUS SIGN-IN SHEET: The daily census sign-in sheet should be provided to the

VA Liaison daily; weekend or holiday sign-in sheets are to be provided to the VA Liaison the on the next business day.

D.10. INVOICES: The monthly invoice is computed at the daily rate multiplied by the total number of beds occupied by Veterans at midnight each night of the given month. Invoices should first be submitted to the VA Liaison for approval and signature by the 5th of the month immediately following the billing period in question. Once approved, invoices are to be submitted through the Tungsten Network (Electronic Invoicing System) by the 10th of the month immediately following the billing period in question.; all electronic invoices submitted should be accompanied by invoice bearing VA Liaison signature for reference of certifying official. (For additional information, Reference: VAAR 852.273-72 Electronic Submission of Payments pg.

23. and FAR 52.232-33 Payments by Electronic Funds Transfer—System for Award

Management pg.27.) .

D.11. QUARTERLY PERFORMANCE REPORT: The contractor shall provide the COR with a written report detailing program data and activities on a quarterly basis. The report should contain, at minimum, the following information:

• Total Number of Veterans Served

• Occupancy rate

• Percent of Veterans discharged to independent housing

• Percent of negative discharges (i.e. discharges due to rule violation, failure to comply with program requirements, or unexpected discharges without prior consultation with staff).

• Other information the contractor feels pertinent, such as: quality improvement projects, changes in staffing or business practices, systems or resource concerns, etc.

DELIVERABLE TIME TABLE

Deliverables Due Dates

D.1. QUALITY CONTROL BUSINESS PLAN Due upon solicitation close date

D.2. STAFFING AND SERVICE PLAN Due upon solicitation close date

D.3. DOCUMENTATION OF SUPPORTIVE

SERVICES:

Completed Veteran case record due upon case close out; due to VA upon request only.

D.4. CARE PLAN Due in Veteran case record by day 14; due to VA upon request

D.5. CRITICAL INCIDENT REPORTS Due within 24 business hours of a critical adverse event involving a Veteran

D.6. EXTENSION REQUESTS Due prior to the expiration of any authorized period of service

D.7. DISCHARGE REPORTS Due within 48 business hours of Veteran discharge

D.8. SATISFACTION SURVEYS Due at the end of each monthly service period

D.9. DAILY CENSUS SIGN-IN SHEET

Due daily

D.10. INVOICES Due to VA Liaison by the 5th of the month immediately following the billing period in question; due in Tungsten Network

(electronic billing system) by the 10th of the month immediately following the billing period in question.

Figure D.11.1

E. REFERRALS

E.1. The VA is capable in determining eligibility of Veterans prior to admission to contractor bed for services. The contractor is expected to work with identified VA Liaison or other designees to confirm eligibility; it is understood that payment for Veterans admitted without an initial determination of eligibility may not be authorized if the Veteran is found to be ineligible.

E.1.2. A list of authorized VA ordering personnel, including primary identified VA Liaison, shall be made available to the contractor upon award of the contract. VA employees may be added or deleted from this list during the term of the contract at the discretion of VA. The contractor shall not deviate from the list of individuals authorized to approve admissions without an updated list.

E.1.3. Referral constitutes authorization of an initial service period of up to 90 days (unless otherwise specified).

F. ABSENCES AND CANCELLATION

F.1. The Contractor shall notify VAMC of any absences from the facility. Absences of the patient from the facility in excess of forty-eight (48) hours will not be reimbursable except those with the prior approval of the VAMC coordinator. Should a patient referred to a residential treatment facility absent himself/herself in an unauthorized manner, payment for services for that Veteran to the contract facility would be continued for a maximum period of two days provided there is an active outreach attempt on the part of the contractor facility staff to return the Veteran to the residential treatment program and a strong likelihood that the patient will return. Management of

Negative Exits will be an element of quality assurance review of this program.

F.1.1. The VA will pay per diem up to a maximum of 48 consecutive hours for the unscheduled absence or 96 hours for scheduled absence of a Veteran under the following conditions:

1) Scheduled Absences: To receive payment, the absence must:

a) Be pre-planned, consistent with and support the Veteran’s individual service plan, (e.g., family reunification, short term medical, substance use disorder, (SUD), or psychiatric treatment).

b) Have the reason be documented in the individual Veteran’s case file, treatment record, or service plan.

c) Not result in the bed being filled by the provider

d) Not be for a break or vacation from treatment.

e) Not be used for extended educational or employment circumstances.

f) Not be used to create more than 4 consecutive days of absence.

2) Unscheduled Absences: To receive payment for an unscheduled absence:

a) The provider must have evidence of active outreach to locate and reengage the Veteran and document the steps taken in the Veterans individual case file, treatment record, or service plan.

b) The provider may not fill the bed.

c) The Veteran must be discharged from the HCHV/CERS program if not located within

48 hours.

4) Ineligible Veteran: When a Veteran is admitted into an HCHV/CERS program and found to be ineligible for HCHV/CERS, VA will pay for a maximum of 4 days from the day of admission to allow the provider and HCHV/CERS liaison time to locate and arrange alternate placement.

F.2. The contractor may consider providing an authorized absence (or “pass”) for purposes that are expected to further the recovery goals of a Veteran (e.g., job-related absences, family visits, housing searches, medical, etc.). All requests for passes must be documented in writing in the

Veterans individual case record. Authorized absences shall not exceed 48 hours in any given month for any single Veteran, unless otherwise approved by contractor and VA Liaison.

F.3. VA reserves the right to remove any or all Veterans from the facility at any time without additional cost, when it is determined to be in the best interest of the Veteran or VA.

G. CONDUCT

G.1. The contractor shall comply with the principles listed in 38 CFR 17.707(b) to provide housing and supportive services in a manner that is free from religious discrimination.

G.2. Local law enforcement and/or fire departments should be contacted for assistance and intervention as appropriate and indicated by any given circumstances.

G.3. The contractor shall also notify the VA Liaison, AOD, or COR immediately of any high risk situations involving veterans with suicidal and/or homicidal threats or ideation, episodes of physical or sexual violence, sexual activities, safety concerns, or activities involving illegal substances so that appropriate response may be coordinated.

G.4. In the event of a medical or psychiatric emergency, it is agreed that every effort will be made to facilitate Veteran access to local VA Medical Center for care. If a VA Medical Center is not available in the vicinity or is otherwise inconveniently located, the Contractor will advise the VA

Liaison or AOD of the facility to which the Veteran has been admitted. The Contractor will also be expected to assist Veteran’s requiring non-urgent services with accessing appropriate care from a VA or community facility, as appropriate.

H. COMPLAINTS

The identified VA Liaison and the Contracting Officer’s Representative (COR) will monitor the services being provided in all HCHV CERS Facilities. The contractor is expected to cooperate with VA Staff and

COR by providing information and answering questions in a timely manner when requested. Contractor shall refer complaints received directly from Veterans to the identified VA Liaison or COR within 48 hours of complaint. All complaints received by the VA Liaison or COR will be immediately forwarded to the contractor and shall be investigated promptly. After investigation and clarification of disposition, the contractor shall respond to the VA Liaison or COR within five (5) working days or less with proposed resolution or plan for corrective action. The CO shall be notified in instances where the proposed course of action or response does not appear sufficient to resolve any given complaint.

I. TRAVEL

The contractor is expected to assist Veterans with arranging local transportation to scheduled meetings and appointments. The contractor is expected to help Veterans understand and learn how to utilize public transportation; this includes providing access to information and clarifying instructions necessary to effectively utilize public transit systems. If contractor and VA staff both determine that public transportation is not available, adequate, or appropriate for any Veteran, the contractor will be expected to assist the Veteran with identifying potential alternative modes of transport, however, under no circumstances is the contractor expected to provide transportation to a Veteran directly.

J. FACILITIES

J.1. General requirements: It is the responsibility of the Contractor to properly maintain its facilities and the VA shall have no responsibility for paying or reimbursing the Contractor for such expenses.

The contract facility must:

J.1.1 Have a current occupancy permit issued by the local and state governments in the jurisdiction where the facility is located.

J.1.2. Be in compliance with existing standards of State safety codes and local, and/or State health and sanitation codes.

J.1.3. Meet the requirements of the Americans with Disabilities Act (ADA) (Public Law 100-336, 42 USC 12101-12213) pertaining to handicapped accessibility in effect on the date of contract award.

J.1.4. Where applicable, be licensed under State or local authority.

J.1.5. Where applicable, be accredited by the State.

J.1.6. Be equipped with operational air conditioning /heating systems

J.1.7. Be kept clean free of dirt, grime, mold, or other hazardous substances and damaged noticeably detract from the overall appearance.

J.1.8. Be equipped with first aid equipment and an evacuation plan in case of emergency.

J.1.9. Have windows and doors that can be opened and closed in accordance with manufacturer standards.

J.1.10. Have an aggressive on-going plan to address bed bug infestation. This policy must be a part of your written response to this solicitation. On-going bed bug infestation will be grounds for immediate discharge of Veterans from the facility

J.2. Fire Safety Requirements:

J.2.1. The building must meet the requirements of the applicable residential occupancy chapters of the current version of NFPA 101, National Fire Protection Association's Life Safety Code. Any equivalencies or variances must be approved by VANCHCS Director

J.2.2. Fire exit drills must be held at least quarterly. Residents must be instructed in evacuation procedures when the primary and/or secondary exits are blocked. A written fire plan for evacuation in the event of fire shall be developed and reviewed annually. The plan shall outline the duties, responsibilities and actions to be taken by the staff and residents in the event of a fire emergency. This plan shall be implemented during fire exit drills.

A written policy regarding tobacco smoking in the facility shall be established and enforced.

J.2.4. Portable fire extinguishers shall be installed at the facility. Use NFPA 101, Portable Fire

Extinguishers, as guidance in selection and location requirements of extinguishers. Requirements for fire protection equipment and systems shall be in accordance with NFPA 101. All fire protection systems and equipment, such as the fire alarm system, smoke detectors, and portable extinguishers, shall be inspected, tested and maintained in accordance with the applicable NFPA fire codes and the results documented.

J.3 Inspection: Prior to the award of any contract and annually thereafter during any subsequent contracted performance periods, a multidisciplinary VA team consisting of a social worker, dietitian or nutrition and food service professional, nursing staff, VA Police, and a Safety and

Occupational Health Specialist, as well as any other subject matter experts determined necessary by the medical center director, COR, HCHV Coordinator, or VA Liaison, shall conduct a survey of the contractor’s facilities to be used to provide Veterans food, shelter, and clinical services to assure the facility provides acceptable level quality care in a safe environment. Additional inspections may also be carried out, announced or unannounced at any other time as deemed necessary by VA, with a minimum of 4 times a year. (See PWS Addendum 2 Copy of Blank

Inspection Form)

The contractor will be advised of the findings of the inspection team. If deficiencies are noted during any inspection, the contractor will be given a reasonable amount of time (typically 30 days) to take corrective action and to notify the Contracting Officer that the corrections have been made. A contract will not be awarded until noted deficiencies have been eliminated. Failure by the Contractor to take corrective action within the reasonable time provided will be reported to the VA Contracting Officer. If corrections are not made to the satisfaction of the VA, the

Contracting Officer will be notified, and shall be the final arbiter on the necessary resulting consequences and action.

The inspection of the Contractor facilities will include inspection for conformity to the current

Life Safety Code as described in paragraph 5, and will also include the following:

J.3.1. General observation of residents to determine if they maintain an acceptable level of personal hygiene and grooming.

J.3.2.Assessment of whether the facility meets applicable fire, safety and sanitation standards.

J.3.3. Determining whether the facility is in attractive surroundings conducive to social interaction and the fullest development of the resident's rehabilitative potential.

J.3.4. Observation of facility operations to see if appropriate organized activity programs are available during waking hours (including evenings) and degree to which a high level of activity is observed in the facility, such as individual professional counseling, physical activities, assistance with health and personal hygiene.

J.3.5. Seeking evidence of facility-community interaction, demonstrated by the nature of scheduled activities or by information about resident flow out of the facility, e.g., community activities, volunteers, local consumer services, etc. This should include not less than one homeless Veteran or formally homeless Veteran on the board of directors or the equivalent policy making entity. It should also include attempts to involve homeless Veterans through employment, volunteer services, or otherwise in construction, rehabilitation, maintaining, and operation of the program.

J.3.6. Observation of staff behavior and interaction with residents to determine if they convey an attitude of genuine concern and caring.

J.3.7. Inspecting the types of meals and other nutrition provided to residents to see if appetizing, nutritionally adequate meals are provided in a setting, which encourages social interaction and if nutritious snacks between meals and bedtime are available for those requiring or desiring additional food, when it is not medically contraindicated.

J.3.8. Making a spot check of Veterans’ records to ensure accuracy with respect to Veterans’ length of stay and services provided to the Veterans.

All Department of Veterans Affairs inspection findings for residential facilities furnishing treatment and rehabilitative services to eligible Veterans shall, to the extent necessary, be made available to all government agencies charged with the responsibility of licensing or otherwise regulating or inspecting such institutions.

K. CERTIFICATION & ACCREDITATION REQUIREMENTS

Acquisition a service that involves the storage, generating, transmitting, or exchanging of VAI does not require system interconnection.

*Doesn’t include Section 4: Info System Design and Development or Section 5: INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

NOTE: If a contractor’s system does not require C&A or a MOU/ISA but does need oversight then a CSCA would be appropriate. The CSCA was written specifically for VHA transcription services but there may be other times when this would also be applicable.

If yes, include the VAAR Clause currently in eCMS and the appropriate language from Appendix C as determined by the ISO and PO as follows:

Section 1: General Section 2: Access to VA Information and Info Systems Section 3: Custodial Language *Section 4: (If Applicable) Info System Design and Development *Section 5: Info System Hosting Section 6: Security Incident Investigation Section 7: Data Breach (indicate $37.50 per affected individual).

Section 8: Security Controls Compliance Testing Section 9: Training

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and

VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and

Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order

12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of

Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security

Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records

Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information

Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records

Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA

Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable

Federal and VA information confidentiality and security laws, regulations and policies. If

Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if

NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

f. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate

Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

g. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

h. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

i. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with

VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

j. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or

Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

k. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

4. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach.

Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the

Security Incident Investigation section above. Upon such notification, VA must secure from a non-

Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy

Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

6. SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day’s notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector

General. The government may conduct a security control assessment on shorter notice (to…