36C26124Q0217.docx

36C26124Q0217

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

UEI:

EFT:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

640-24-1-4399-0001 36C26124Q0217 12-06-2023 Jill Williams 702-001-5380 12-20-2023 10:00

PST

00261 Department of Veterans Affairs Network Contracting Office 21 VA Southern Nevada Healthcare System 6900 N. Pecos Road, Building 6 North Las Vegas

NV

89086 X X 541611 $24.5 Million N/A X See Delivery Schedule

00261 Department of Veterans Affairs Network Contracting Office 21 Southern Nevada Healthcare System 6900 N. Pecos Road, Building 6 North Las Vegas

NV

89086

Financial Services Center P.O. Box 149971 Austin

TX

78714-9971 See CONTINUATION Page Small business Set-aside Mock Survey and Consult IAW SOW Please send Quotes to Jill Williams at: jill.williams@va.gov Due Date and Time: NLT 10:00 AM PDT, 20 Dec 2023 See CONTINUATION Page X Rico Johnson Contracting Officer Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C261

Network Contracting Office 21 VA Southern Nevada Healthcare System 6900 N. Pecos Road, Building 6 North Las Vegas NV 89086

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

36C26124Q0217

Page 1 of Page 1 of Statement of Work (SOW) VISN 21 Accreditation Readiness - Joint Commission Survey and Long-Term Care

I. GENERAL

The following terms discuss the requirements of Contractor delivery of Mock Survey Services. A Mock TJC survey and/or Long-Term Care review shall be conducted at each VISN 21 facility to assist in the continuous process improvement and readiness efforts. The Mock Survey process shall be conducted in accordance with the most current version of “The Joint Commission, Survey Activity Guide for Health Care Organizations All Accreditation Programs.” These surveys shall focus on frequently cited standards, problematic standards, the high-risk areas of, but not limited to, sterile compounding, sterile processing, suicide, hemodialysis, environment of care, life safety and any topics pertinent and chosen by the facility. The survey process shall identify important organizational, and systems issues related to safety, quality of care, treatment and services and interfaces between such processes.

Each at each facility, except PIHCS, the review will be a three-day review consisting of four consultants. At Pacific Island VA Health Care System, the review will be a two-day review consisting of three consultants.

Central California VA Health Care System

X

Northern California VA Health Care System

X

Palo Alto Health VA Health Care System

X

San Francisco Health VA Health Care System

X

Southern Nevada VA Health Care System

X

Sierra Nevada VA Health Care System

X

The combination and expertise of the team will be at the discretion of the facility. Each facility can choose the desired combination of team members to consist of Nurse, physician, and LS/EOC. Each consultant shall have a minimum of three years of surveying experience. Each of the consultants shall have experience, education, and knowledge of infection control processes.

Consultants shall use the most recently published TJC Standards and other appropriate standards for Hospital, Ambulatory Care, Behavioral Health, Home Care, Laboratory, and Long-Term Care.

Each facility shall supply the surveyor with accurate information describing the scope of services provided. The facility shall provide access to those staff members who shall normally be involved in the survey process to allow adequate assessment of standards compliance.

II. OBJECTIVES

a. TJC Standards Compliance including Environment of Care and Life Safety standards.

b. Enhance Continuous Readiness (CR) state.

c. Support concepts of continuous process improvement and High Reliability

d. Enhance staff accreditation survey process knowledge.

e. Increase patient safety.

III. SCOPE

The purpose of this procurement action is to acquire Continuous Readiness services also known as standards compliance. The Department of Veterans Affairs (VA) health care facilities have been accredited by TJC for over 35 years. The accreditation process is a complex system of related and interdependent activities which enable the VA to maintain a constant state of regulatory readiness and maintain a safe health care environment. These services shall support VISN 21 (See Attachment A) facilities to enable a CR program to achieve and continue compliance with TJC standards including but not limited to compliance with TJC Program, Environment of Care, Life Safety, and/or Emergency Management standards.

IV. PERFORMANCE PERIOD

Period of Performance is 1 Base Year plus 2 Option Years. Base will have the Mock Survey completed at all stations, first option will VISN wide virtual education, second option will be an in-person presentation given by two consultants at each station.

V. LOCATIONS

See Attachment A

VI. DEFINITIONS

• AQL: Acceptable Quality Level

• Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

• Contracting Officer: A person with authority to enter, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

• Contracting Officer's Representative (COR): An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

• Defective Service: A service output that does not meet the standard of performance associated with the Performance Work Statement.

• Deliverable: Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

• Physical Security: Actions that prevent the loss or damage of Government property.

• Quality Assurance: The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

• Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

• Quality Control: All necessary measures taken by the Contractor to assure that the quality of a product or service shall meet contract requirements.

VII. ACRONYMS

• CO – Contracting Officer

• COR - Contracting Officer Representative

• FAR - Federal Acquisition Regulation

• HIPAA - Health Insurance Portability and Accountability Act of 1996

• LTCI – Long Term Care Institute

• POC - Point of Contact

• QA - Quality Assurance

• QAP - Quality Assurance Plan

• QASP - Quality Assurance Surveillance Plan

• QC - Quality Control

• QCP - Quality Control Program

• SOW – Statement of Work

• TJC - The Joint Commission

• VA - Department Of Veterans Affairs

• VHA - Veterans Health Administration

• VISN - Veteran Integrated Service Network

VIII. CONSULTANT QUALIFICATIONS

a. The Contractor and their Consultants shall possess knowledge of TJC standards and VHA regulations which apply to accreditation bodies.

b. Each Consultant team shall have four consultant surveyors for each Mock Survey.

c. Each Consultant shall have experience, education, and knowledge of infection control processes.

d. Each Consultant shall have a minimum of three years of surveying experience.

e. Consultants shall use the most recently published TJC standards and other appropriate standards for Hospital, Ambulatory Care, Behavioral Health, Home Care, Laboratory, and Long-Term Care.

f. Each consulting team shall consist of comparable team credentials as a TJC team to include a combination at the discretion of the facility that can include physician consultant(s), a nurse consultant(s) and/or an administrative/life safety consultant(s).

g. The consultants shall possess the appropriate qualifications of surveyor and consultant experience to include RN, MD, or Admin/life Safety Specialist with previous experience serving as TJC surveyors/consultants and credentials for conducting the surveys. They shall have surveyor/consultant experience and be knowledgeable of the unique challenges faced by VA Medical Centers. Consultant expertise in LTCI, Hospital, Behavioral Health, Home Care, Life Safety and Ambulatory Care is required. Previous VA experience is preferred. The expectation is that the same contractor shall survey all VISN facilities. No substitution in surveyors will be permitted without first consulting with the VA contracting officer. If contractor performance is less than satisfactory, the VA reserves the right to request a substitute contractor at no additional cost to the VA.

IX. SPECIFIC MANDATORY TASKS AND ASSOCIATED DELIVERABLES

a. Surveys shall be conducted in accordance with the most current version of “The Joint Commission, Survey Activity Guide for Health Care Organizations All Accreditation Programs.”

b. Each Mock Survey shall consist of a multi-day survey as specified by each ordering facility.

c. Each facility can choose the desired combination of team members to consist of nurse, physician, and LS.

d. Dates of the surveys shall be as directed by each facility.

e. The facility surveys shall be coordinated with the designated point of contact at each site.

f. The survey schedule for each facility and changes shall be provided to the COR in advance.

g. Each facility shall supply the surveyor with accurate information describing the scope of services provided by the facility.

h. The surveyor shall inform facility’s designated point of contact of the activity they will be conducting each day.

i. The facility shall provide access to those staff members who shall normally be involved in the survey process to allow adequate assessment of standards compliance.

j. Each survey shall include an opening conference, patient tracer and/or system tracer activities, leadership conference, and exit briefing.

k. For multi-day surveys, 30 minutes shall be scheduled towards the end of each day (except the last) for surveyors to conduct either Special Issue Resolution or engage in surveyor planning or team meeting activity.

l. For multi-day surveys, the surveyor will schedule a daily kick-off meeting with organization participants which shall be scheduled for a 30-minute period, where the surveyor shall summarize the events of the previous day and communicate observations according to the standards or areas that may or may not lead to findings.

m. After each facility survey is completed, the surveyor shall schedule an exit conference with the Facility Director and other leadership staff to discuss findings and trends.

n. Each survey shall include a survey report preparation session lasting 60-120 minutes in a conference room supplied by the facility, which will include a conference table, power outlets, telephone, and internet access.

o. Each survey shall include an Exit Brief lasting 15-30 minutes to discuss the survey findings report.

p. The Government will provide Joint Commission Standards policies and results of previous survey reports.

q. The Contractor shall submit a written report by TJC standard and/or LTCI within fifteen (15) working days after each site visit. The report shall cite the specific standard of noncompliance, a narrative assessment of noncompliance and specific recommendations for compliance. Any findings that may result in a finding of noncompliance must be clearly identified in the report, along with a recommendation on how best to resolve it. Findings of noncompliance and partial compliance shall be identified in the report. The report shall be submitted in an electronic format in Microsoft Word simultaneously to the Medical Center Director, and the surveyed VISN 21 Quality Management Officer, team.

r. The contractor shall provide an aggregated VISN wide summation presentation. The contractor shall provide a VISN wide written report for VISN Leadership at the time of the VISN summation presentation. The summary report shall include facility findings, recommendations by facility, general strengths and weaknesses by facility, trends across the VISN and general and site-specific recommendations.

s. The Contractor shall conduct survey business at each facility between the hours of 7:00AM and 5:00PM Monday thru Friday, except federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government-directed facility closings.

All employees of the Contractor shall not be considered VA employees. Survey Team members working on VA property shall be subject to the same rules and regulations as all contracted employees.

The Contractor must maintain an adequate workforce for the uninterrupted performance of all tasks defined within this SOW when the Government facility is not closed for the above reasons. Prior to reporting to work, the Survey Team Lead shall contact the facility’s designated point of contact to arrange an escort to the on-site badging department. VA Staff will issue a temporary ID badge to the contracted Survey Team, who will properly display the badge while working onsite. Upon completion of the assignment, the designated Survey Team employees will return the badges. The VA reserves the right to refuse any Survey Team member access to the VA property for any or no reason.

The Contractor shall not release, publish, or disclose sensitive information to unauthorized personnel, and shall protect such information in accordance with provisions of 18 U.S.C. 641 (Criminal Code; Public Money, Property or Records) and any other pertinent laws and regulations governing the confidentiality of sensitive information.

X. CONFLICT OF INTEREST

A conflict of interest is defined as the existence of financial or other relationship between the Contractor, (including any of the employees, agents, subcontractors, or representatives) and a party involved under this contract. The Contractor shall promptly notify the presiding official whenever there is a potential or actual conflict of interest between the Contractor and such party. If a potential or actual conflict of interest is reported by the Contractor, the CO reserves the right to have the have the Contractor supply another qualified candidate from their agency to serve as a backup or fill-in replacement surveyor and the Contractor shall bear the full cost of replacing the contracted representative.

XI. QUALITY ASSURANCE SURVEILLANCE PLAN

Determining Performance Government shall use the monitoring methods cited below to determine whether the performance standards/service levels/AQLs have been met. If the contractor has not met the minimum requirements, it may be asked to develop a corrective action plan to show how and by what date it intends to bring performance up to the required levels.

Reporting At the end of the survey the Designated Point of Contact will prepare a written report for the VISN COR and CO summarizing the overall results of the quality assurance surveillance of the contractor’s performance. This written report, which includes the contractor’s final exit brief and will become part of the QA documentation. This will enable the VA to demonstrate whether the contractor is meeting the stated objectives and/or performance standards including cost/technical/scheduling objectives.

Reviews and Resolution The VISN COR may require the contractor’s project manager, or a designated alternate, to meet with the VISN COR and Designated Point of Contact to discuss performance evaluation for the Contractor, due to the length of each survey. The Contractor performance evaluation will then be provided to the Contracting Officer for inclusion in the CO file.

Contract Oversight The VISN COR (subject to CO approval), will be responsible for verifying contract compliance. The VISN COR will designate appropriate VA personnel to assist in monitoring services rendered through one or a combination of the following mechanisms:

Facilities Designated Point of Contacts will monitor Contractor Performance to ensure that services ordered have been rendered in a timely manner. Any incidents of Contractor noncompliance as evidenced by the monitoring procedures will be forwarded to the VISN COR and administering CO for performance evaluation consideration.

b. Facility Designated Point of Contacts shall provide a written statement at the completion of each survey to the VISN COR to include a summary of contractor actions and a statement that all requirements of the contract have been fulfilled as agreed. This summary evaluation will be submitted within 10 days of the completion of a facility survey.

c. Documentation of services performed will be reviewed prior to certifying payment. VISN COR contract monitoring, and recordkeeping procedures will be sufficient to ensure proper payment and allow audit verification that services were provided.

XII. PERFORMANCE STANDARDS

The chart below outlines performance objective, standards, quality levels, and surveillance methods that serve as a basic rubric for Contractor Performance evaluation under this contract. Confirmation of these delinquent performances will be made known to the Contractor immediately upon discovery.

Visual inspection of Surveyor conducting survey with intended service, department, or organization

XIII. SECURITY REQUIREMENTS

a. The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract. The position sensitivity for this effort has been designated as LOW.

b. A National Business Associate Agreement (BAA) is required for this contract when awarded.

Attachment A VA Sierra Pacific Network Facility Locations

Pacific Island VA Health Care System

Spark M. Matsunaga Department of Veterans Medical Center* 459 Patterson Road Honolulu, HI 96819-1522 800-214-1306 *Community Living Center at this location Leeward Oahu VA Clinic 91-2135 Fort Weaver Road, Suite 501 Ewa Beach, HI 96706-1929 800-214-1306

Faleomavaega Eni Fa’aua’a Hunkin VA Clinic Fiatele Teo Army Reserve Building Pago Pago, AS 96799 800-214-1306 Lihue VA Clinic 4485 Pahe'e Street, Suite 150 Lihue, HI 96766-2018 800-214-1306

Guam VA Clinic 498 Chalan Palasyo Agana Heights, GU 96910-6427 800-214-1306 Maui VA Clinic 203 Ho'ohana Street, Suite 303 Kahului, HI 96732-2476 800-214-1306

Hilo VA Clinic 45 Mohouli Street Hilo, HI 96720-7210 800-214-1306 Molokai VA Clinic 604 Mauna Loa Highway Kaunakakai, HI 96748 800-214-1306

Kailua-Kona VA Clinic 75-377 Hualalai Road Kailua-Kona, HI 96740-9724 800-214-1306 Saipan VA Clinic Marina Heights Business Park - Garapan, Medical Associates of the Pacific, MH-II Building Suite 100 and 206 Saipan, MP 96950-9998 800-214-1306

Lanai VA Clinic 628-B Seventh Street Lanai City, HI 96763 800-214-1306 Winward VA Clinic 46-001 Kamehameha Highway, Castle Professional Center, Suite 301 Kaneohe, HI 96744-3711 800-214-1306

Central California VA Health Care System

Fresno VA Medical Center* 2615 East Clinton Avenue Fresno, CA 93703-2223 559-228-5336 *Community Living Center at this location Oakhurst VA Clinic 40597 Westlake Drive Oakhurst, CA 93644-9024 559-683-5300

Merced VA Clinic 340 East Yosemite Avenue, Suite D Merced, CA 95340-9167 209-381-0105 Tulare VA Clinic 1050 North Cherry Street Tulare, CA 93274-2251

Northern California VA Health Care System

Sacramento VA Medical Center 10535 Hospital Way Mather, CA 95655-4200 916-843-7000 Modesto VA Clinic 1225 Oakdale Road Modesto, CA 95355-3357 209-557-6200

Martinez VA Medical Center* 150 Muir Road Martinez, CA 94553-4668 925-372-2000 *Community Living Center at this location Redding VA Clinic 3455 Knighton Road Redding, CA 96002-9498 530-226-7555

Chico VA Clinic 1601 Concord Avenue Chico, CA 95928-9486 530-879-5000 Sierra Foothills VA Clinic 11985 Heritage Oaks Place, Suite 100 Auburn, CA 95603-2413 530-889-0872

Cypress Avenue VA Clinic 760 Cypress Avenue, Suite 100 Redding, CA 96001-2732 530-244-8800 Sonora VA Clinic 13663 Mono Way Sonora, CA 95370-2811 209-588-2600

Fairfield VA Clinic 103 Bodin Circle, Building 778 Travis AFB, CA 94535-1801 707-437-1800 Stockton VA Clinic 7777 South Freedom Road French Camp, CA 95231-9694 209-946-3400

Mare Island VA Clinic 201 Walnut Avenue, Building 201 Mare Island, CA 94592-1107 707-562-8200 Yreka VA Clinic 101 East Oberlin Road Yreka, CA 96097-9645 530-841-8500

McClellan VA Clinic 5342 Dudley Boulevard, Building 88 McClellan Park, CA 95652-1012 916-561-7400 Yuba City VA Clinic 425 Plumas Boulevard Yuba City, CA 95991-5074 530-751-4500

Palo Alto Health VA Health Care System

Palo Alto VA Medical Center* 3801 Miranda Avenue Palo Alto, CA 94304-1207 650-493-5000 *Community Living Center at this location Fremont VA Clinic 39199 Liberty Street, Building B Fremont, CA 94538-1501 510-791-4000

Palo Alto VA Medical Center – Menlo Park* 795 Willow Road Menlo Park, CA 94025-2539 650-614-9997 *Community Living Center at this location Major General William H. Gourley VA-DoD Outpatient Clinic 201 9th Street Marina, CA 93933-6039 831-884-1000

Palo Alto VA Medical Center – Livermore* 4951 Arroyo Road Livermore, CA 94550-9650 925-373-4700 *Community Living Center at this location San Jose VA Clinic 5855 Silver Creek Valley Place San Jose, CA 95138-1059 408-574-9100

Capitola VA Clinic 1350 41st Avenue, Suite 102 Capitola, CA 95010-3906 831-464-5519 Mobile Clinics Palo Alto 1 VA Mobile Clinic Palo Alto 2 VA Mobile Clinic 650-493-5000 ext. 65505

San Francisco Health VA Health Care System

San Francisco VA Medical Center* 4150 Clement Street San Francisco, CA 94121-1545 415-221-4810 *Community Living Center at this location San Bruno VA Clinic 1001 Sneath Lane, Suite 300 San Bruno, CA 94066-2349 650-615-6000

Clearlake VA Clinic 15145 Lakeshore Drive Clearlake, CA 95422-8106 707-995-7200 San Francisco VA Clinic 401 3rd Street, Community Resource & Referral Center (CRRC) San Francisco, CA 94107-1214 415-281-5100

Eureka VA Clinic 930 West Harris Street Eureka, CA 95503-3927 707-269-7500 Santa Rosa VA Clinic 2285 Challenger Way Santa Rosa, CA 95407-5418 707-569-2300

North Santa Rosa VA Clinic 3841 Brickway Boulevard Santa Rosa, CA 95403-8226 707-569-2300 Twenty First Street VA Clinic 525 21st Street Oakland, CA 94612-1605 510-587-3400

Oakland VA Clinic 2221 Martin Luther King Jr. Way Oakland, CA 94612-1318 510-267-7800 Ukiah VA Clinic 630 Kings Court Ukiah, CA 95482-5003 707-468-7700

Southern Nevada VA Health Care System

North Las Vegas VA Medical Center 6900 North Pecos Road North Las Vegas, NV 89086-4400 702-791-9000 Pahrump VA Clinic 220 South Lola Lane Pahrump, NV 89048-0835 775-727-7535

Master Chief Petty Officer Jesse Dean VA Clinic 3650 South Pointe Circle, Building D, Suite 200 Laughlin, NV 89029-0423 702-298-1100 Southeast Las Vegas VA Clinic 1020 South Boulder Highway Henderson, NV 89015-8533 702-791-9030

Northeast Las Vegas VA Clinic 4461 East Charleston Boulevard, Community Resource & Referral Center (CRRC) Las Vegas, NV 89104-5537 702-791-9050 Southwest Las Vegas VA Clinic 7235 South Buffalo Drive Las Vegas, NV 89113-4040 702-791-9040

Northwest Las Vegas VA Clinic 3968 North Rancho Drive Las Vegas, NV 89130-3412 702-791-9020 West Cheyenne VA Clinic 3525 West Cheyenne Avenue North Las Vegas, NV 89032-8212 702-791-9170

Sierra Nevada VA Health Care System

Ioannis A. Lougaris Veterans’ Administration Medical Clinic* 975 Kirman Avenue Reno, NV 89502-0993 775-786-7200 *Community Living Center at this location Lohontan Valley VA Clinic 1020 New River Parkway, Suite 304 Fallon, NV 89406-7811 775-428-6161

Capitol Hill VA Clinic 350 Capitol Hill Avenue Reno, NV 89502-2923 775-324-6600 North Reno VA Clinic 1140 Selmi Drive Reno, NV 89512-4780 775-786-7200

Carson Valley VA Clinic 1330 Waterloo Lane, Suite 101 Gardnerville, NV 89410-5587 775-782-5265 Reno East VA Clinic 1201 Corporate Boulevard, Suite 100 Reno, NV 89502-7162 775-786-7200

Diamond View VA Clinic 110 Bella Way Susanville, CA 96130-9102 530-251-4550 Virginia Street VA Clinic 3674 South Virginia Street, Unit E4 Reno, NV 89502-6017 775-623-9575

Kietzke VA Clinic 2295 Kietzke Lane Reno, NV 89502-3604 775-328-1773 Winnemucca VA Clinic 3298 Traders Way Winnemucca, NV 89445-3654 775-623-9575

PRIVACY – CLAUSE WITH SENSITIVE DATA

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEM

a. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

b. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

c. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

d. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

Contractor Personnel Security Requirements:

All contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access. If the investigation is not completed prior to the start date of the contract the contractor will be responsible for the actions of those individuals that provide or perform work for the VA.

1. Position Sensitivity – The position sensitivity has been designated as (low) risk.

2. Background Investigation – The level of background investigation commensurate with the required level of access is National Agency Check (NACI) with written inquiries.

3. Contractor Responsibilities a. The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM), the contractor shall reimburse the VA within 30 days.

The web site which provides information on the cost of the security investigation is: www.opm.gov\extra\investigate – Select Federal Investigations Notices (FIN 01-01)

b. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak, and understand the English language.

c. The contractor will provide to the Contracting Officer prior to award the following: (1) List of names of contract personnel. (2) Social security numbers of contractor personnel. (3) Home address of contractor personnel or the contractor address.

The Contracting Officer will submit the above information to the Office of Security and Law Enforcement, Washington, D.C. The Office of Security and Law Enforcement will provide the necessary investigative forms (these forms are indicated in paragraph 3.d. below) to the contractor’s personnel, coordinate the background investigations with OPM and notify the Contracting Officer and contractor of the results of the investigation.

d. The contractor shall submit or have their employees submit the following required forms to the VA Office of Security and Law Enforcement within 30 days of receipt:

(i) Standard From 85P, Questionnaire for Public Trust Positions

(ii) Standard Form 85P-S, Supplemental Questionnaire for Selected Positions

(iii) FD 258, U.S. Department of Justice Fingerprint Applicant Chart

(iv) VA Form 0710, Authority for Release of Information Form

(v) Optional Form 306, Declaration for Federal Employment

(vi) Optional Form 612, Optional Application for Federal Employment

e. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract.

f. Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor while performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.1, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

SECURITY INCIDENT INVESTIGATION:

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH:

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. However, it is the policy of the VA to forego collection of liquidated damages in the event the contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data.

Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access).

(2) Description of the event, including:

(a) date of occurrence.

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code.

(3) Number of individuals affected or potentially affected.

(4) Names of individuals or groups affected or potentially affected.

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text.

(6) Amount of time the data has been out of VA control.

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons).

(8) Known misuses of data containing sensitive personal information, if any.

(9) Assessment of the potential harm to the affected individuals.

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate.

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis; the contractor shall be responsible for paying to the VA liquidated damages in the amount of $42.00 for affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification.

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports.

(3) Data breach analysis.

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution.

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible.

and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

SECURITY CONTROLS COMPLIANCE TESTING:

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

TRAINING:

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete VA Privacy and Information Security Awareness and Rules of Behavior Training and Privacy and HIPAA Training and HIPAA Training before being granted access to VA information and its systems.

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Rules of Behavior before being granted access to VA information and its systems.

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete…