Draft PWS Mortuary Services for Unclaimed or Indigent Veterans -Security Clause Added - Revised 10-28-2026.docx

Performance Work Statement Mortuary Services for Unclaimed Remains for VA Palo Alto Healthcare System (VAPAHCS)

The Contractor shall provide the facilities, professional services, management, labor, tools, supplies, equipment, storage, and transportation necessary to provide Mortuary services to support handling of unclaimed or indigent remains of deceased Veterans inpatient at VAPAHCS or under VA-authorized care facility. The offeror shall comply with the Department of Veterans Affairs (VA) requirements and specifications and federal, state, and local health laws, statutes and regulations in the performing the following tasks as identified herein.

The Period of Performance is Base Year plus four (4) option years.

Base Year shall begin on December 31, 2026, to December 30, 2027 Option Year 1 – December 31, 2027, to December 30, 2028 Option Year 2 – December 31, 2028, to December 30, 2029 Option Year 3 – December 31, 2029, to December 30, 2030 Option Year 4 – December 31, 2030, to December 30, 2031

1.0 GENERAL INFORMATION. The VAPAHCS requires mortuary services for deceased unclaimed or indigent Veterans inpatient under VA or VA authorized care. The Contractor shall provide the facilities, professional funeral services, resources, storage, and transportation necessary to support the handling of unclaimed or indigent remains of deceased Veterans from the VAPAHCS or a VA authorized care facility and to deliver the deceased to VA National or VA grant-funded State Veterans Cemetery. The offeror shall comply with the VA requirements and specifications and federal, state, and local health laws, statutes and regulations in the performing the following tasks as identified in this Performance Work Statement (PWS). VAPAHCS is located at 3801 Miranda Ave., Palo Alto, CA 94304.

1.1 Period of Performance: Base Year plus four (4) option years. Base Year shall begin on December 31, 2026.

1.2 The Contractor shall not discriminate in the handling of remains due to race, creed, sex, or national origin of the deceased.

2.0 DESCRIPTION OF THE WORK TO BE PERFORMED.

2.1 The Contractor shall be responsible for providing professional services of the highest quality to assure viewing of the remains under optimal conditions.

2.2 The Contractor shall practice hygienic measures that will assure complete and satisfactory disinfection and sanitation of the funeral establishment.

2.3 The Contractor shall have a sufficient number of State licensed embalmers to process (embalm) or reprocess any remains on a timely basis. Interns or apprentices may be used to assist the licensed embalmer in accordance with (IAW) applicable state regulations.

2.4 Transport Vehicles, supplies, equipment and technical procedures shall conform to standards and professional techniques acceptable to the California Funeral Service Industry and the National or VA grant-funded State Veterans Cemetery at Seaside California or Gustine, California.

2.5 The Contractor or Sub-Contractor shall be within a 25-mile radius from the VAPAHCS .

2.6 Contractor’s Facility shall meet Federal, State, Local and National Environment Policy Act (NEPA) Fire and Life Safety Codes. The Contractor’s facility shall comply with current VA standards for handicapped accessibility. Any change of the Contractor’s facility location during the contract term shall be approved in advance by the Contracting Officer (CO).

3.0 VAPAHCS RESPONSIBILITIES.

3.1 In accordance with the Veteran’s expressed funeral arrangement preferences, VAPAHCS will advise the Contractor of the Veteran’s preference for cremation or burial.

3.2 The VAPAHCS Director or designated representative (DR) is responsible for inspecting the unclaimed remains prior to release in accordance with Veterans Health Administration (VHA) Directive 1601B.04. (See Attachment A)

3.3 The CO will delegate a Contracting Officer Representative (COR) to be responsible for the inspection of the mortuary services and the merchandise furnished for unclaimed remains under separate contractual agreements.

3.4 Notification to pick up unclaimed remains. The VAPAHCS COR or designated representative will notify the Contractor of unclaimed remains. The Contractor shall respond for removal of unclaimed Veteran’s remains within one (1) business day. The Contractor shall complete the burial process within 10 days of notification by VAPAHCS.

3.5 Inspection of the body. Whether the body is cremated or to be buried, the casket or urn and remains shall be inspected by the COR or designated representative prior to transporting to final destination.

4.0 GENERAL TASKS BY THE CONTRACTOR.

4.1 Cremation (Inurnment) Services. When requested by the COR or DR, this service shall include making the necessary arrangements with the crematorium and furnishing a suitable urn for the cremated remains.

4.1.1 Suitable Urn shall be durable and sealed, not leaking. Material, such as plastic, metal, wood, ceramic/stone, or other durable materials are acceptable.

4.2 Preparation of Remains (Body) Services for Interment. The COR or DR will advise the Contractor of the Veteran’s preference for cremation or body burial.

4.2.1 Remains shall be prepared, dressed, and cosmetically beautified as prescribed in the specifications.

4.2.2 Each remain, viewable or non-viewable, shall be embalmed that provides the optimum result.

4.3 Pre-embalming Services.

4.3.1 Remains shall be bathed unless it is impossible due to the condition of the remains. The hair shall be washed and groomed. For example: Fingernails shall be cleaned and trimmed; the mouth shall be securely closed to form a natural expression and ensure eyelids are prepared to prevent wrinkling and a sunken appearance of the eyes. The use of cosmetics shall be applied only to produce natural color and texture.

4.3.2 Any lacerations, abrasions, incisions, excisions and burn wounds shall be sutured and/or sealed to prevent leakage. Swollen or distorted features shall be reduced to the normal contours enjoyed during life. Postmortem stains shall be chemically bleached by applying packs and/or needle injection. On viewable areas, further treatment shall consist of the use of masking cosmetics to render stains non-detectable.

4.3.3 Body orifices shall be treated with a disinfectant, non-astringent chemical (generic categories such as Phenyl phenols and Iodophors) and packed with cotton. Bedsores, ulcerated, burned, and necrotic tissue shall be treated either by hypodermic injection, or pack application of deodorizing or preserving chemical.

4.3.4 Maggots and other insect larvae shall be destroyed and their breeding sites in or on the remains thoroughly treated with an insecticide chemical.

4.3.5 The Contractor shall ensure that the body and/or cremated remains are effectively disinfected, uniformly preserved, and offensive odors eliminated before the remains are casketed.

4.4 Preparation of Remains – (Body is intact).

4.4.1 Each remain, viewable and non-viewable, requires variation in the embalming treatment to accomplish the optimum results. A recommended procedure to achieve these goals is the injection of the solution at a moderate rate. The addition of a humectant to the solutions is also helpful in reducing over-dehydration effects.

4.5 Processing Non-viewable Remains.

4.5.1 For all remains, multi-site injection and drainage technique shall be attempted.

4.5.2 For autopsied cases, incisions shall be tightly sutured and treated to prevent leakage.

4.5.3 Restorative work such as derma surgery, if required, shall be used to present a normal lifelike appearance.

4.5.4 Body areas shall be treated by means of a trocar, using undiluted cavity chemicals having a 30 index (%) or greater. In addition, packs, special gels and or dry sanitizers shall be used to assure preservation, prevent leakage, and eliminate all offensive odors (if required.)

4.5.5 Cranial, thoracic, and abdominal cavities, when present, shall be relieved of gasses and distention. The cavities shall then be treated by injecting a minimum of 32 ounces of a concentrated cavity chemical, having a 30-index (%) or greater.

4.5.6 When material injection and/or cavity treatment is impossible, all matriculated and disarticulated anatomical portions shall be thoroughly disinfected and preserved via accessory chemical embalming techniques.

4.5.7 Non-injectable intact remains and/or disarticulated anatomical portions shall be immersed or hypo-injected with trocar and/or syringe and needle, using full strength cavity chemicals 30-index (%) or greater. Surface application of liquid, gel, or dry sanitizers and preservatives is also required to supplement primary needle and/or hypo injection techniques.

4.6 Processing Viewable Remains.

4.6.1 A thorough pre-embalming case analysis shall be made in order to determine the best embalming techniques to be used to obtain optimum results.

4.6.2 The technique of arterial injection and venous drainage is of utmost importance as well as the need for adding humectant (moisture retention chemicals) to the arterial solution injected.

4.6.3 The mineral chemical injection solution shall contain a 2% to 3% concentration, by volume, of aldehyde or aldehyde derivative preservative agent(s), with equal parts of a humectant chemical also being added to the injection solution.

4.6.4 The thoracic, abdominal, and pelvic cavities shall be thoroughly aspirated and injected with full-strength cavity chemicals having a 30 index (%) or greater, using a minimum of 16 ounces for each cavity.

4.6.5 Needle injections, packs, or other special treatments shall be accomplished, as required, to assure the preservation and disinfection of all body tissues, including those associated with body cavities (organs).

4.6.6 A lanolin-based (or comparable) massage cream shall be applied on the face and hands.

4.6.7 For autopsied remains. Incisions shall be tightly sutured and treated to prevent leakage.

4.6.8 Autopsied Remains. If a partial or complete autopsy is performed, a 6-point injection with multisite drainage shall be accomplished, using arterial chemical solutions as specified for processing viewable remains.

4.7 Other Preparations of the Body Remains

4.7.1 The following services shall be provided includes dressing, make-up, casketing, hair care, post-autopsy care, refrigeration and reconstruction/restorative arts.

4.7.2 Treatment of Scalp. If the scalp was shaved because of medical treatment or surgery, processing or reprocessing shall be accomplished as specified for viewable remains, after which the cranium shall be wrapped with gauze or equivalent in a neat and professional manner.

4.7.3 Mutilated Hands. If the hands are mutilated and restoration is not possible, the hands shall be treated in a manner which shall render the tissue firm, dry, and thoroughly preserved. The hands shall be covered by either wrapping with gauze or equivalent in a neat and professional manner, or by placing surgical gloves on the hands.

4.7.4 Dressing Remains. The VA or the deceased veteran’s family (indigent burials) will provide the appropriate clothing to be used in the burial. Appropriate under garments shall be provided by the VA.

4.7.5 COR or Designated Representative will advise on any known religious preferences for the proper dressing and handling of the body.

4.8 Casket. Remains shall be placed in the casket or urn in a manner that will create an appearance of rest and composure and ensure maintenance of position during transit.

4.8.1 Casket Type and Material. At a minimum, the casket should be standard size (generally 82 X 28 inches or larger), constructed of 20 gauge or thicker metal with fixed rails or swing arm handles, and not leaking. Cardboard, or pressed paper, or similar materials are not acceptable.

4.8.2 The casket shall be of sufficient size and strength to prevent the appearance of crowding or cramping and support the weight of the decedent’s remains.

4.9 United States (US) Flag. The US flag will be furnished by the VA to be draped over the casket at the time of funeral service.

5.0 TRANSPORT AND STORAGE OF THE DECEASED VETERAN.

5.1 Transport Vehicles. The Contractor shall have the necessary vehicles to transport the body from the VAPAHCS or place of VA contracted care facility to the funeral home and then from funeral home to the National or VA grant-funded State Veterans Cemetery for interment or inurnment.

5.1.1 Loading the Casketed or the Cremated Remains. The remains shall be carefully and professionally placed in the type of vehicle normally used for funeral services.

5.2 Transportation of Remains. The Contractor shall coordinate and transport the body or unclaimed remains in a funeral coach, ambulance, and hearse or service car to the Contractor’s facility; and when ready for burial, the Contractor shall transport it to the National or VA grant-funded State Veterans Cemetery for burial.

5.3 Storage of Deceased Veteran. The Contractor shall have adequate storage space to hold and store (refrigeration) the remains until burial arrangements are confirmed.

5.4 PLACE OF BURIAL OR COLUMBARIUM.

5.4.1 Mortuary services ordered by the VA will specify the interment to be VA National or VA grant-funded State Cemetery. The burial plot, the marker and services for opening and closing the grave, and placing the marker, will be furnished by the VA.

6.0 PERMITS/LICENSES TO OPERATE. The Contractor shall possess the current transit permit at the time of award of Contract. Permits covering burial, cremation or removal of the body, if required, are to be secured and paid for by the Contractor.

6.1 In accordance with the California Board of Funeral Directors and Embalmers, the Contractor shall provide proof of license for the establishment and funeral home director(s), prior to commencing any work under this contract.

6.2 The Contractor’s employees shall have the appropriate and current license(s) prior to commencing work under this contract. Copies of registrations and licenses shall be furnished upon COR’s request. The Contractor shall be responsible for maintaining Workers Compensation and Professional Liability Insurance, as well as remaining current on Federal, State and Medicare payments.

7.0 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP).

7.1 The QASP will be used by the Government to monitor and evaluate the Contractor’s performance using mostly customer feedback and surveillance. The Government will use random, scheduled and unscheduled inspections of the various reports transcribed to determine the validity of the customers’ complaints. Performance will be recorded by the COR or designated representative and when an observation indicates defective performance, the COR will request the Contractor or designated representative to initial the observation.

7.2 The COR will conduct on-site inspections of the facilities to ensure services are performed according to the terms and conditions of the contract.

8.0 CONTRACTOR’S QUALITY CONTROL PROGRAM (QCP).

8.1 The Contractor shall implement and maintain a complete quality control program (QCP) so that all requirements are provided for as specified in all sections of this contract. The Contractor’s QCP shall include but not be limited to the following:

8.1.1 A statement describing how the Contractor will meet the basic requirements of this contract (including staffing levels, time of response) shall be provided to the Contracting Officer’s Representative (COR) fifteen (15) days after effective date of contract award and whenever there are major turnover of personnel. A major turnover is two or more employees.

8.1.2 A method for identifying deficiencies in the quality of services performed before the performance deficiency becomes unacceptable. The QCP shall contain processes for corrective actions without dependence upon Government direction and shall maintain records of all Contractor QC inspections and corrective actions.

8.1.3 A method of recording or logging the activities of the Contractor, which would demonstrate the Contractor's ability to maintain the minimum requirements of this contract.

8.2 The COR or designated representative will monitor the Contractor's performance using the Contractor’s QCP and the Government’s QASP.

8.3 The Contractor shall provide at least semi-annual quality control or assurance report to the COR. The report shall include the results of the reviews, identification of problems and a correction plan.

9.0 MISCELLANEOUS ITEMS.

9.1 Coordination with the National or VA grant-funded Veterans State Cemetery and the COR shall occur frequently to ensure the deceased Veteran is buried properly and timely. The Contractor shall keep the COR or DR informed as to the timeline of events.

9.2 COR responsibilities. The COR or DR will coordinate with the Contractor to ensure the proper documents and items are provided such as the DD 214 and/or other documents to verify Veteran’s Eligibility to be buried at the National or VA grant-funded Veterans State Cemetery.

10.0 HOURS OF OPERATION. The VA will conduct business with the Contractor during its normal operational hours (i.e. Monday through Friday, 8:00 a.m. to 4:30 p.m.), excluding Federal Holidays.

11.0 SECURITY REQUIREMENTS.

11.1 The Contractor shall sign and follow confidentiality statements as required.

12.0 VA SENSITIVE INFORMATION.

12.1 The Contractor is expected to perform functions that will require access to VA sensitive information. In the course of providing services, it will be necessary for the Contractor to view and receive protected health information (PHI), and personnel identifiable information (PII).

12.2 Contracts, in which VA sensitive information are accessed by a Contractor require the following requirements per 38 U.S.C 5723 and 5725. A CSCA will be required as the vendor will not login to any VA network

12.2.1 A prohibition on unauthorized disclosure: “Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA.” See VA Handbook 65006, Appendix C, paragraph 3.a.

12.2.2 A requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor /subcontractor has access, the contractor/subcontractor shall immediately and simultaneously notify the COR, the designated ISO (Information Security Officer), and Privacy Officer for the contract. The term ‘security incident’ means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph G.a. (Attachment C)

12.2.3 A requirement to pay liquidated damages in the event of a data: “In the event of a data breach or privacy incident involving any SPI the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.” See VA Handbook 6500.6, Appendix C, paragraphs 7.a. and 7.d. (Attachment C)

12.2.4 A requirement for annual security/privacy awareness training: before being granted access to VA information, all contractor employees and subcontractor employees requiring such access shall complete on an annual basis either (i) the VA security/privacy awareness training (contains VA’s security/privacy requirements) within 1 week of the initiation of the contract, or (ii) security awareness training provided or arranged by the contractor that conforms to VA’s security)privacy requirements as delineated in the hard copy of the VA security awareness training provided to the contractor. If the contractor provides their own training that conforms to VA’s requirements, they will provide the COR or DR, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in VA’s contract have received their annual security/privacy training that meets VA’S requirements and the total number of employees trained. See VA Handbook 6500.6, Appendix C, paragraph 9. (Attachment C)

12.2.5 A requirement to sign VA’s Rules of Behavior: before being granted access to VA information, all contractor employees and subcontractor employees requiring such access shall sign on an annual basis an acknowledgment that they have read, understand, and agree to abide by VA’s Contractor Rules of Behavior which is attached to this contract. Refer to VA Handbook 6500.6, paragraph 5, Appendix D (Attachment D) but note:

If the vendor anticipates that the services under the contract will be performed by 10 or more individuals, the Contractor Rules of Behavior may be signed by the vendor’s designated representative. The contract must reflect by signing the Rules of Behavior on behalf of the vendor that the designated representative agrees to ensure that all such individuals review and understand the Rules of Behavior when accessing VA’s information.

13.0 COMMONLY USED ACRONYMS.

13.1 CO – Contracting Officer

13.2 COR – Contracting Officer Representative

13.3 VAPAHCS – VA Palo Alto Healthcare System

13.4 PWS-Performance Work Statement

13.5 DR – Designated Representative (usually representing the COR)

13.6 Tungsten Network – 3rd party global provider of electronic invoicing for the VA

13.7 DFAS Austin –Defense Finance and Accounting System in Austin, Texas

13.8 FSC – Financial Service Center (VA)

14.0 REFERENCES.

14.1 VHA Directive 1601B.04, Decedent Affairs dated 12/01/2017

14.2 Title 38 United States Code (U.S.C.) 101

14.3 Title 38 U.S.C. 2301 et seq.

14.4 Title 38 CFR 17.170

14.5 Public Law No: 117-328, Division J Title II section 213 of the Consolidated Appropriations Act, 2023

14.6 Locations of VA National and VA grant-funded State Veterans Cemeteries. Find a Cemetery - National Cemetery Administration (va.gov)

15.0 FUNERAL FACILITIES INSPECTION CHECKLIST (See Attachment E)

SUGGESTED ATTACHMENTS TO SOLICITATION:

Attachment A-VHA 1601B.04 Directive Decedent Affairs dated 12/01/2017, 8 pages.

Attachment B-Past Performance Survey Template, 4 pages.

Attachment C-VA Privacy Language Appendix C dated 03/12/2010, 12 pages.

Attachment D-Contractor Rules of Behavior Appendix D, VA 6500.6, dated 03/12/2010, 5 pages.

Attachment E-Facilities Inspection Checklist, 1 page.

Attachment F-Wage Determination for Santa Clara County

16.0. GENERAL.

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

17.0. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

18.0. VA INFORMATION CUSTODIAL LANGUAGE.

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors’/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

d. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

e. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

19.0. SECURITY INCIDENT INVESTIGATION.

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

20.0. LIQUIDATED DAMAGES FOR DATA BREACH.

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

21.0. TRAINING.

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

22. The C&A requirements do not apply, and a Security Accreditation Package is not required