36C26125Q0123_1.docx

36C26125Q0123

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

UEI:

EFT:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C261-24-AP-5298

662-25-1-784-0002 36C26125Q0123 11-20-2024 Alex Hernandez 916-759-6461 11-25-2024 08:00

PST

00261 Department of Veterans Affairs Network Contracting Office 21 VA Southern Nevada Healthcare System 6900 N. Pecos Road, Building 6 North Las Vegas

NV

89086 X 513210 $47 Million N/A X See Delivery Schedule

00261 Department of Veterans Affairs Network Contracting Office 21 Southern Nevada Healthcare System 6900 N. Pecos Road, Building 6 North Las Vegas

NV

89086

Financial Services Center P.O. Box 149971 Austin

TX

78714-9971 See CONTINUATION Page This is a sole source RFQ to Sikrit LLC Multi Factor Authentication Subscription ***See Schedule*** Quote shall be submitted to the following VA POC's:

Alex Hernandez at Alex.Hernandez@va.gov See CONTINUATION Page X Alex Hernandez Contracting Officer Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

Vendor Electronic Invoice Submission Methods

Facsimile, e-mail, and scanned documents are not acceptable forms of submission for payment requests. Electronic form means an automated system transmitting information electronically according to the accepted electronic data transmission methods below:

1.VA’s Electronic Invoice Presentment and Payment System – The FSC uses a third-party contractor, Tungsten, to transition vendors from paper to electronic invoice submission. Please go to this website: http://www.tungsten-network.com/US/en/veterans-affairs/ to begin submitting electronic invoices, free of charge.

2.A system that conforms to the X12 electronic data interchange (EDI) formats established by the Accredited Standards Center (ASC) chartered by the American National Standards Institute (ANSI).

The X12 EDI Web site (http://www.x12.org).

Vendor e-Invoice Set-Up Information:

Please contact Tungsten at the phone number or email address listed below to begin submitting your electronic invoices to the VA Financial Services Center for payment processing, free of charge. If you have question about the e-invoicing program or Tungsten, please contact the FSC at the phone number or email address listed below:

•Tungsten e-Invoice Setup Information: 1-877-489-6135

•Tungsten e-Invoice email: VA.Registration@Tungsten-Network.com

•FSC e-Invoice Contact Information: 1-877-353-9791

•FSC e-invoice email: vafsccshd@va.gov

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C261 Alex Hernandez

Network Contracting Office 21 VA Southern Nevada Healthcare System 6900 N. Pecos Road, Building 6 North Las Vegas NV 89086

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

Statement of Work

The contractor shall provide all labor and personnel necessary to develop software customization and data query support as defined in this Statement of Work (SOW).

1. WORK TO BE PERFORMED:

· Development of a custom application for The National Cardiac Device Surveillance Program (NCDSP) to replace the current COTS application for Patient Data Management.

· Develop Multi-factor authentication for access to the application in compliance with VA Cyber Security Standards.

· Integrate application with the other components of the Cardiac Device Monitoring system (CDMS) to seamlessly work with the NCDSP user interface and ISI importer to Vista Imaging.

· Application must have up to 5 different user roles with increase levels of access permissions as determined NCDSP leadership.

· Application must have internal audit record keeping to record actions taken by members using the application and have a way to sort those records by individual users.

· Application must be completed within two years of the contract being awarded.

· Application must have ability to import transmissions from the 4 major vendor sites, (Carelink, Merlin, Boston Scientific, and Biotronik)

· Year one license agreement included for the tech support of the application.

· Application must have Lead and device encyclopedia functions

· Adding and subtracting leads and devices from the encyclopedia

· Each device will have a listing of key data fields including type, make, model, recalls, MRI compatibility, CRT, number of chambers.

· Devices can be made available or not for registration

· Ability to add alias device names as needed to facilitate remote data download from the company web sites

· Functions to add and manage recalls

· Add recalls by model or by model and serial number

· Future registrations that fall in the recall group are marked as affected

· Ability to take devices off recall after they have been added if the issue is resolved in some way

· Data connections to the Manufacturer remote monitoring sites

· Integrations with all 4 current remote monitoring sites and the ability to add new companies as they become needed

· Integrations will be customized for each company to optimize the importation of the data that each company exports

· The database will have fields that as much as possible import similar data from each company into common fields

· Maximum available PDF data will be imported and stored

· As needed based on difference in device function and data provided specific data fields will need to be created for each company to allow full importation of programming data, battery data, lead data, detections, electrograms, and all other monitoring data.

· Functions to troubleshoot failed data transfers of companies as a whole or individual patient transmissions

· There will be a log of failed data transmissions

· There will be a function to determine and mitigate the most common causes of data transfer failure.

· Mechanism to add, manage and subtract locations of care.

· Application must also have a workload database which has the following functions:

· A platform to do Reader Quality Reviews.

· The ability to pull up transmissions by reader, date range, device type and finding

· Function to score each read as correct, error or minor error

· Section for the reviewer to comment on each remote reviewed

· The date of the review, reviewer, adjudication and comments for each reviewed transmission is stored in SQL

· A platform to review the results of Quality Reviews.

· The ability to display for each reader and the program overall for a specific time frame the number and % of transmissions adjudicated as correct, error and minor error.

· A utility in which individual readers can review their overall result for a specific time frame the number and % of transmissions adjudicated as correct, error and minor error.

· For a specific time frame each of the transmissions that have been reviewed and what the result of the review was

· The reader will be able to pull up their original reading, the result of the review and the PDF for each transmission reviewed

· The reader will be able to correct their review of a transmission in the database and if needed notify the clinic of the change in review

· The ability to export PDF reports of the Quality reviews for the program as a whole and for individual readers for specific time periods.

· A platform to send emails to individual clinics with customized patient lists for each clinics with updates on Recalls, patients with frequent transmissions, patients seen in clinic who are not registered, patients at ERI > 3 months without a generator change, list of patients that failed get connected, patients who have not transmitted in 2 years, and the ability to add new email types as needed.

· Create encounter lists each month for workload tracking

· Productivity tracking

· Mechanism to track the time readers are working in the system and their productivity in terms of number of transmissions read and points per hour when working on reading transmissions.

· Mechanism to see hours worked and productivity for all or individual readers for specific time frames

· Ability to create report for readers on hours worked and productivity

· Ability for readers to see their own hours work and productivity for specific time frames

· Module for overall workload tracking

· Graphs and reports for total encounters received and reviewed for specific time frames

· Number of devices followed over time by device type

· The software supports:

Patient registration and data management

· Organize transmission data from CIED remote monitoring

· Secure login, storage and handling of patient information

· Compliance with relevant healthcare regulations and standards

· Key Features and Functionalities

· Patient and CIED Registration

· New Patient Entry: Simple interface to register new patients.

· New information regarding CIEDs: automatically retrieved from the FDA's Global Unique Device Identification Database (GUDID) and integrated into the library, guaranteeing precise and current device identification.

· Implanted CIEDs in Patients: an easy-to-use interface for data input or effortlessly acquired using a barcode scanner.

· Data Fields: Comprehensive fields to capture all necessary patient information, including demographics and CIED-specific details.

· Patient Data Management

· Search and Retrieval: Efficient search functionality to quickly retrieve patient records.

· Edit and Update: Capability to update patient information as needed.

· Data Export: Export patient data in Excel format for reporting and analysis purposes.

· CIED-Specific Features Device Tracking

· Comprehensive monitoring of CIED implants, encompassing model, serial number, implantation, and explantation dates.

· Advisory Monitoring: Utilizing a robust system to identify and meticulously monitor patients with advisory Cardiac Implantable Electronic Devices (CIEDs), ensuring prompt interventions and thorough management.

· Remote Transmissions Automated Report Generation:

· Automatically generate comprehensive reports for transmissions containing normal data, equipped with seamless export functionality to CPRS for efficient integration into patient records.

· User-Friendly Interface: Intuitive interface facilitating effortless report generation, ensuring ease of use for healthcare providers.

· Custom Query and Export Features: Empower users to query and export transmissions with specific issues or abnormalities, enabling targeted analysis and intervention.

· Security and Compliance Secure Authentication:

· Implementation of robust two-factor authentication protocols to ensure secure user logins and data access.

· Regulatory Compliance: Adherence to HIPAA and other relevant healthcare regulations.

· Audit Trails: Logging of user logins, data access and changes for audit purposes.

· Technical Support Helpdesk: Accessible technical support via phone, email, or Teams during weekday hours from 8 AM to 5 PM.

· Maintenance: Regular software updates and maintenance to ensure optimal performance.

· Troubleshooting: Rapid response to any technical issues or bugs.

· Data Ownership and Privacy Data Ownership: Healthcare provider retains ownership of all patient data.

· Privacy Protection**: Strict adherence to data privacy laws and regulations.

Application must be built with the ability to meet compliance with the following Authorization to Operate (ATO) controls as determined by the VA office of OI&T.

VA Information and Technology Security requirements.

Contractor must agree with the following security clauses stated in VA handbook 6500

839.201 Contract clause for Information and Information Technology Security:

a. Due to the threat of data breach, compromise or loss of information that resides on either VA-owned or contractor-owned systems, and to comply with Federal laws and regulations, VA has developed an Information and Information Technology Security clause to be used when VA sensitive information is accessed, used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media).

b. In solicitations and contracts where VA Sensitive Information or Information Technology will be accessed or utilized, the CO shall insert the clause found at 852.273-75, Security Requirements for Unclassified Information Technology Resources.

2. 852.273-75 - SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION

TECHNOLOGY RESOURCES (INTERIM- OCTOBER 2008)

As prescribed in 839.201, insert the following clause:

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

Upon the award of the contract, A Contractor Security Control Assessment (CSCA) will be completed within 30 day and sent to the ISSO for upload in the Smart Database.

In compliance with VA Handbook 6500 Appendix A, Contractor must agree to the following requirements:

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language. a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), VA HANDBOOK 6500.6 April 22, 2024 APPENDIX C C-2 and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain

VA HANDBOOK 6500.6 April 22, 2024 APPENDIX C C-3 medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA.The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS. This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

VA Handbook 6500.6 April 22, 2024 APPENDIX C C-4

a. A contractor/subcontractor shall request logical…