36C26220Q0482-002.doc

New Mexico VA Health Care System

Pathology & Laboratory Medicine Service

Statement of Work for Chemistry/Immunoassay Analyzers & Testing

Blood Gas Analyzer: STATEMENT OF WORK

Transaction # 501-20-2-107-0069

SCOPE:

VISN 22 Medical Centers –

· New Mexico VA Healthcare System

· VA Greater Los Angeles Healthcare System

New Mexico VA Health Care System (NMVAHCS) and VA Greater Los Angeles Healthcare Systems (VAGLAHS) require a cost-per-test blood gas system that performs a comprehensive panel of pH, blood gas, oximetry, electrolyte and metabolite testing. VA New Mexico requires two (2) Radiometer ABL827 analyzers, or equivalent, and VA Greater Los Angeles requires three (3) Radiometer ABL90 analyzers, or equivalent, on a Cost-Per-Test basis. The intent of the Pathology & Laboratory Medicine Service (P&LMS) is to provide continuous, accurate results in the management of respiratory and metabolic disorders. The lactate result may be used as part of an initial evaluation of someone who is suspected of having sepsis. In a person being treated for an acute condition, such as sepsis, shock or heart attack or a chronic condition, such as severe congestive heart failure, lactate levels may be ordered at intervals to help monitor hypoxia and response to treatment.

PERIOD OF PERFORMANCE:

The period of performance will start shortly after award for a One (1) Year Base Period with the Government having the option to exercise (4) four (1) one-year renewal periods for a total order period of five (5) years.

COST-PER-TEST DEFINITION:

The contractors are required to furnish the laboratory analyzer, all supplies and consumables necessary to operate the contractor’s equipment (including quality control material and delivery costs), training for personnel, warranty and equipment maintenance (emergency repair and preventive service) necessary to fulfill the test requirements. All of the related products and services are paid for on a per billable test basis.

BRAND NAME PRODUCT:

CURRENT TESTING QUANTITIES AND THROUGHPUT:

Current approximate annual testing volumes for New Mexico VA Healthcare System:

4,898 Lactic acid tests

731 Ionized calcium tests

1733 Arterial blood gases/co-oximetry

*NMVAHCS would like the option to add an IDMS creatinine to support the needs of our emergency room (estimated yearly volume unavailable at this time)

Current approximate annual testing volumes for VA Greater Los Angeles Healthcare System:

11,485 Lactic Acid

9,632 Ionized Calcium

7624 Arterial Blood Gasses/Co-oximetry

SALIENT CHARACTERISTICS:

At a minimum, the vendor must be able to supply a product to meet the following requirements:

1) The Blood Gas platform must be the most current FDA approved system available.

2) The analyzers/equipment must be able to support the following testing throughputs (collectively per site):

· VA New Mexico – 22 tests / day

· VA Greater Los Angeles – 87 tests / day

These figures take into consideration the estimated annual testing volumes, 10% margin added for unanticipated variance of usage, and divided by 365 days.

3) The testing parameters that must be met are pH (arterial and venous blood and pleural fluid), pCO2, pO2, ionized calcium, lactate, IDMS Creatinine, and oximetry (sO2, O2 Hgb, CO Hgb, and MetHgb).

4) The analyzer/equipment, reagents, controls, calibration materials, disposables, and any consumable parts necessary for analyzing/testing must be approved by the Food and Drug Administration (FDA).

5) All analyzers must have primary whole blood tube/syringe sampling capability.

6) The analyzers must have an on-board Quality Control Program or supporting software that provides the ability to monitor QC.

7) System shall have a design that removes or mitigates the possibility of reagent or sample carryover. Carryover studies shall be performed, as applicable, as part of the initial evaluation of the instrument. Vendor shall provide interpretation of raw data for each instrument installed.

8) System shall have positive sample identification via barcode to reduce possible sources of error/delay.

9) Analyzer reports shall have at a minimum two patient identifiers (i.e. Patient Name, Specimen ID).

10) Equipment shall be able to store and retransmit records (24 hours of maximal instrument throughput) in case of interface downtime.

11) Interfacing requirements to be provided by the vendor:

· Instrument LIS physical connection and translation (drivers). Must be compatible with Data Innovations system.

· Any additional hardware and software needed to interface the analyzer and technical assistance with interfacing the analyzer

GENERAL / OTHER REQUIREMENTS:

GENERAL REQUIREMENTS

1) There should be a redundancy in instrumentation so as that there is always an analyzer available (24/7) for patient testing due to the critical nature of the need for rapid patient results.

2) The vendor shall provide/install any routine and special items required to operate/maintain the equipment/analyzer in optimal condition such as but not limited to: printers, UPS, and surge suppressors. Also, to include any engineering controls necessary to maintain proper drainage, operating temperature (minimizing impact of heat and humidity), and minimizing noise levels. Any items excluded by the vendor shall be delineated in their technical proposal. The cost of the excluded items shall be incorporated in the price proposal.

3) Vendor shall list the reagents and calibrators that require any additional preparation prior to use such as warming/mixing/reconstitution.

DELIVERY, INSTALLATION AND VALIDATION

1) The initial cost of equipment delivery and installation shall be quoted as a one-time payment and excluded from the cost-per-test price.

2) The cost of delivery for all reagents, supplies and consumables shall be included in the overall cost-per-test price.

3) Vendor shall move instruments, free of charge, to final testing location upon completion of validation process.

4) Vendor shall provide the facility with all cross-over supplies and reagents needed at installation and during training of staff. Test counts for billing will begin after review/approval of all correlation/linearity studies performed at installation.

5) At installation/set-up, a technical support specialist shall assist with all validation studies including: installation/set-up, correlation studies (evaluation/comparison data sufficient to satisfy CAP standards) normal range studies, staff training, in-services to laboratory personnel and clinicians, and assist with any methodology problems and questions. This service shall be available during regular office hours on a 5 days/week basis.

6) Throughout the life of the agreement, the vendor shall provide assistance to the user for all maintenance and troubleshooting issues and additional testing as needed.

TRAINING

1) The vendor shall provide comprehensive primary user training for a minimum of two users per instrument and training available to remaining users with competency assessment performed and documented.

2) Vendor shall provide all necessary procedure manuals, troubleshooting manuals and operator manuals (also available in editable electronic format). Procedures shall be in the Clinical and Laboratory Standards Institute (CLSI) format.

SERVICE AND MAINTENANCE

1) Instrument support service shall provide assistance with troubleshooting and repair of the analyzers. On-site service shall be available Monday through Friday during regular business hours (8am-5pm). The support service shall follow-up all down time calls within 1 hour. If both analyzers become inoperable service support and on-site service will be available 24/7.

2) The vendor shall provide a service report within 72 hours of all preventative maintenance and service repair performed by the vendor.

3) The vendor shall provide a service hotline with technical support.

4) The vendor shall provide a preventative maintenance schedule to include timely scheduled vendor preventative maintenance visits as required.

5) Vendor shall provide standard and routine software and hardware upgrades to the equipment hardware and operating systems, without additional charge to the Government (e.g. upgrades that correct or improve either the mechanical operations or software of the system and would keep the instrument performing optimally).

6) Vendor shall define daily, weekly, monthly, and as needed maintenance and the time required to perform each maintenance task. Vendor shall indicate which tasks are user level and which are service level.

7) For reagents with hazardous constituents, vendor shall provide a mechanism for the Laboratory to meet local discharge requirements. The vendor shall supply information regarding any hazardous chemicals.

OTHER

1) Request for instrumentation upgrades or replacement due to workload increase, excessive instrumentation failures/malfunctions, breakdowns, or service calls shall be evaluated as needed/annually by the laboratory with communication to the vendor for modification of the contract. A high incidence of such problems with any equipment/analyzer supplied may indicate probable non-compliance with the terms of this contract and will entitle the facility/clinic to its replacement with another analyzer(s) that can produce the required criteria satisfactorily to the user.

2) The vendor shall remove all equipment within 90 days after notification of the expiration of the terms of this agreement but not until the completion of new vendor's equipment installation inclusive of completed cross over studies and onsite user training. Vendor shall be responsible for removing the hard drive and turning it over to the VA for destruction prior to removal of any analyzer.

3) The vendor shall reimburse the facility for any costs/supplies related to tests sent to a referral laboratory when testing is not available through no fault of the facility due to reagent problems, other product issues, instrumentation failure, or other factors. The assessed damages shall be applied to the invoice in the form of a credit or deduction.

4) In the event any consumable, reagent, or other necessary item are found to be defective and unsuitable for use with the vendor's equipment, or the contractor has failed to comply with the requirements for routine supply delivery, the contractor shall deliver the consumable supplies within a period of 24 hours after receipt of the verbal order for priority delivery from the facility. If either circumstance has occurred, the vendor shall deliver to the facility, in the most expeditious manner possible, without additional cost to the facility, the necessary consumables in sufficient quantity so testing is not delayed.

5) This contract should assist the NMVAHCS and VAGLAHS to pursue the goal of being good stewards in our community by eliminating, minimizing or mitigating adverse environmental impacts.

The following chemicals have been targeted by the EPA specifically for reductions and feasible elimination. Please list any reagents (and in what concentration) that contain the following chemicals:

Benzene

Carbon tetrachloride

Chloroform

Dischloromethane

Methyl ethyl ketone

Toluene

Methyl isobutyl ketone

Xylenes

Tetrachloro-ethylene

Cadmium

1,1,1-Trichloro-ethane

Chromium

Trichloro-ethylene

Cyanid

Lead

Mercury

Nickel

INFORMATION SECURITY REQUIREMENTS

The C&A requirements do not apply and a Security Accreditation Package is not required.

The Contractor is subject to the provisions of the Health Insurance Portability and Accountability Act (HIPAA), the Privacy Act of 1974, as well as all applicable VA laws and regulations. The Contractor shall keep confident the contents of all medical documents entrusted to its care.

The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

The Contractor shall immediately notify the VA Healthcare Systems (VAHCS) Contracting Officer and the VAHCS Information Security Officer of any actual or suspected loss, release or compromise of any VHACS document or electronic information under its control.

Any breach must be reported within one hour which is in accordance with the following:

VA 6500 Handbook page 56:

(b) Procedure: Users will immediately report any incident of theft, loss, or compromise of VA sensitive information or information systems to the ISO and/or PO and supervisor.

VA 6500 Handbook page 65:

(4) (r) VA employees, contractors, subcontractors, and volunteers must immediately report to his or her VA supervisor and the local ISO any incident of theft, loss, or compromise of any VA sensitive information, VA equipment or device, or any non-VA equipment or device used to transport, access, or store VA information. The ISO will promptly report the incident (within one hour) to the VA-NSOC in accordance with the OI&T Incident Management procedures.

All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA

Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per 6500.1 requirements. This must be completed within 30 days of termination of the contract.

Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

(1) Vendor must accept the system without the drive;

(2) VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

(3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

(4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

(a) The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact; and

(b) Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be preapproved and described in the purchase order or contract.

(c) A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed. The ISO needs to maintain the documentation.

Figure 1 BAA RADIOMETER

CONTRACTOR TRAINING

If contractor employees and subcontractor employees require access to VA information and VA information systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training.

(4) Successfully complete any additional cyber security or privacy training, as required for

VA personnel with equivalent information system access.

National Rules of Behav.

Contractor Rules of Behav

Mandatory TMS Train

RECORDS MANAGEMENT

The contractor shall be responsible for creating, maintaining and disposing of only those Government required records. If requested by the NMVAHCS COR, the contractor shall provide the original record, or a reproducible copy of any such record, within two (2) business days of receipt of the request.

a) Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and

Part 1228.

b) Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

c) Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

d) Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

e) Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

f) The Government Agency owns the rights to all data/records produced as part of this contract.

g) The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

h) Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

i) No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

j) Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI) N/A

Other Pertinent Information or Special Considerations None

Place of Performance

1. New Mexico VA Healthcare Systems (NMVAHCS)

Pathology and Laboratory Medicine Service (113)

1501 San Pedro SE

Albuquerque, NM 87108

2. VA Greater Los Angeles Healthcare Systems (VAGLAHS)

Pathology and Laboratory Medicine Service

11301 Wilshire Blvd

Los Angeles, CA 90073

Contracting Officer’s Representative (COR)

Name: Ronalynn Engstrom

New Mexico VA Healthcare System

Path and Lab Medicine Service (113)

1501 San Pedro Se

Albuquerque, New Mexico, 87108

(505)256-2881

_1650438850.doc

_1650440367.pdf

BUSINESS ASSOCIATE AGREEMENT BETWEEN THE DEPARTMENT OF

VETERANS AFFAIRS VETERANS HEALTH ADMINISTRATION AND

<COMPANY/ORGANIZATION>

Revised October 2015 1

Purpose. The purpose of this Business Associate Agreement (Agreement) is to establish requirements for the Department of Veterans Affairs (VA), Veterans Health Administration (VHA) and <Company/Organization> in accordance with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), and the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (“HIPAA Rules”), 45 C.F.R.

Parts 160 and 164, for the Use and Disclosure of Protected Health Information (PHI) under the terms and conditions specified below.

Scope. Under this Agreement and other applicable contracts or agreements, <Company/Organization> will provide automated clinical laboratory diagnostic services to, for, or on behalf of VHA.

In order for <Company/Organization> to provide such services, VHA will disclose PHI to <Company/Organization>, and <Company/Organization> will use or disclose PHI in accordance with this Agreement.

Definitions. Unless otherwise provided, the following terms used in this Agreement have the same meaning as defined by the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (PHI), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

“Business Associate” shall have the same meaning as described at 45

C.F.R. § 160.103. For the purposes of this Agreement, Business Associate shall refer to <Company/Organization>, including its employees, officers, or any other agents that create, receive, maintain, or transmit PHI as described below.

“Covered Entity” shall have the same meaning as the term is defined at 45

C.F.R. § 160.103. For the purposes of this Agreement, Covered Entity shall refer to

VHA.

“Protected Health Information” or “PHI” shall have the same meaning as described at 45 C.F.R. § 160.103. “Protected Health Information” and “PHI” as used in this Agreement include “Electronic Protected Health Information” and “EPHI.” For the purposes of this Agreement and unless otherwise provided, the term shall also refer to PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity or receives from Covered Entity or another Business Associate.

“Subcontractor” shall have the same meaning as the term is defined at 45

C.F.R. § 160.103. For the purposes of this Agreement, Subcontractor shall refer to a contractor of any person or entity, other than Covered Entity, that creates, receives, maintains, or transmits PHI under the terms of this Agreement.

Revised October 2015 2

Terms and Conditions. Covered Entity and Business Associate agree as follows:

1. Ownership of PHI. PHI is and remains the property of Covered Entity as long as Business Associate creates, receives, maintains, or transmits PHI, regardless of whether a compliant Business Associate agreement is in place.

2. Use and Disclosure of PHI by Business Associate. Unless otherwise provided, Business Associate:

A. May not use or disclose PHI other than as permitted or required by this Agreement, or in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity, except that it may use or disclose PHI:

(1) As required by law or to carry out its legal responsibilities;

(2) For the proper management and administration of Business Associate; or

(3) To provide Data Aggregation services relating to the health care operations of Covered Entity.

B. Must use or disclose PHI in a manner that complies with Covered Entity’s minimum necessary policies and procedures.

C. May de-identify PHI created or received by Business Associate under this Agreement at the request of the Covered Entity, provided that the de-identification conforms to the requirements of the HIPAA Privacy Rule.

3. Obligations of Business Associate. In connection with any Use or Disclosure of

PHI, Business Associate must:

A. Consult with Covered Entity before using or disclosing PHI whenever Business Associate is uncertain whether the Use or Disclosure is authorized under this Agreement.

B. Implement appropriate administrative, physical, and technical safeguards and controls to protect PHI and document applicable policies and procedures to prevent any Use or Disclosure of PHI other than as provided by this Agreement.

C. Provide satisfactory assurances that PHI created or received by Business Associate under this Agreement is protected to the greatest extent feasible.

D. Notify Covered Entity within twenty-four (24) hours of Business Associate’s discovery of any potential access, acquisition, use, disclosure, modification, or destruction of either secured or unsecured PHI in violation of this Agreement, including any Breach of PHI.

(1) Any incident as described above will be treated as discovered as of the first day on which such event is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate.

Revised October 2015 3

(2) Notification shall be sent to the Director, Health Information Governance and to the VHA Health Information Access Office, Business Associate Program Manager by email at VHABAAIssues@va.gov.

(3) Business Associate shall not notify individuals or the Department of Health and Human Services directly unless Business Associate is not acting as an agent of Covered Entity but in its capacity as a Covered Entity itself.

E. Provide a written report to Covered Entity of any potential access, acquisition, use, disclosure, modification, or destruction of either secured or unsecured PHI in violation of this Agreement, including any Breach of PHI, within ten (10) business days of the initial notification.

(1) The written report of an incident as described above will document the following:

(a) The identity of each Individual whose PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, disclosed, modified, or destroyed;

(b) A description of what occurred, including the date of the incident and the date of the discovery of the incident (if known);

(c) A description of the types of secured or unsecured PHI that was involved;

(d) A description of what is being done to investigate the incident, to mitigate further harm to Individuals, and to protect against future incidents;

and

(e) Any other information as required by 45 C.F.R. §§ 164.404(c) and 164.410.

mailto:VHABAAIssues@va.gov

Revised October 2015 4

(2) The written report shall be addressed to:

Director, Health Information Governance Department of Veterans Affairs – Veterans Health Administration Office of Informatics and Analytics (10P) 810 Vermont Avenue NW Washington, DC 20420 and submitted by email at VHABAAIssues@va.gov.

F. To the greatest extent feasible, mitigate any harm due to a Use or Disclosure of PHI by Business Associate in violation of this Agreement that is known or, by exercising reasonable diligence, should have been known to Business Associate.

G. Use only contractors and Subcontractors that are physically located within a jurisdiction subject to the laws of the United States, and ensure that no contractor or Subcontractor maintains, processes, uses, or discloses PHI in any way that will remove the information from such jurisdiction. Any modification to this provision must be approved by Covered Entity in advance and in writing.

H. Enter into Business Associate Agreements with contractors and Subcontractors as appropriate under the HIPAA Rules and this Agreement.

Business Associate:

(1) Must ensure that the terms of any Agreement between Business Associate and a contractor or Subcontractor are at least as restrictive as Business Associate Agreement between Business Associate and Covered Entity.

(2) Must ensure that contractors and Subcontractors agree to the same restrictions and conditions that apply to Business Associate and obtain satisfactory written assurances from them that they agree to those restrictions and conditions.

(3) May not amend any terms of such Agreement without Covered Entity’s prior written approval.

I. Within five (5) business days of a written request from Covered Entity:

(1) Make available information for Covered Entity to respond to an Individual’s request for access to PHI about him/her.

(2) Make available information for Covered Entity to respond to an Individual’s request for amendment of PHI about him/her and, as determined by and under the direction of Covered Entity, incorporate any amendment to the PHI.

mailto:VHABAAIssues@va.gov

Revised October 2015 5

(3) Make available PHI for Covered Entity to respond to an Individual’s request for an accounting of Disclosures of PHI about him/her.

J. Business Associate may not take any action concerning an individual’s request for access, amendment, or accounting other than as instructed by Covered Entity.

K. To the extent Business Associate is required to carry out Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the provisions that apply to Covered Entity in the performance of such obligations.

L. Provide to the Secretary of Health and Human Services and to Covered Entity records related to Use or Disclosure of PHI, including its policies, procedures, and practices, for the purpose of determining Covered Entity’s, Business Associate’s, or a Subcontractor’s compliance with the HIPAA Rules.

M. Upon completion or termination of the applicable contract(s) or agreement(s), return or destroy, as determined by and under the direction of Covered Entity, all PHI and other VA data created or received by Business Associate during the performance of the contract(s) or agreement(s). No such information will be retained by Business Associate unless retention is required by law or specifically permitted by Covered Entity. If return or destruction is not feasible, Business Associate shall continue to protect the PHI in accordance with the Agreement and use or disclose the information only for the purpose of making the return or destruction feasible, or as required by law or specifically permitted by Covered Entity. Business Associate shall provide written assurance that either all PHI has been returned or destroyed, or any information retained will be safeguarded and used and disclosed only as permitted under this paragraph.

N. Be liable to Covered Entity for civil or criminal penalties imposed on Covered Entity, in accordance with 45 C.F.R. §§ 164.402 and 164.410, and with the HITECH Act, 42 U.S.C. §§ 17931(b), 17934(c), for any violation of the HIPAA Rules or this Agreement by Business Associate.

4. Obligations of Covered Entity. Covered Entity agrees that it:

A. Will not request Business Associate to make any Use or Disclosure of PHI in a manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if made by Covered Entity, except as permitted under Section 2 of this Agreement.

B. Will promptly notify Business Associate in writing of any restrictions on Covered Entity’s authority to use or disclose PHI that may limit Business Associate’s Use or Disclosure of PHI or otherwise affect its ability to fulfill its obligations under this Agreement.

Revised October 2015 6

C. Has obtained or will obtain from Individuals any authorization necessary for Business Associate to fulfill its obligations under this Agreement.

D. Will promptly notify Business Associate in writing of any change in Covered Entity’s Notice of Privacy Practices, or any modification or revocation of an Individual’s authorization to use or disclose PHI, if such change or revocation may limit Business Associate’s Use and Disclosure of PHI or otherwise affect its ability to perform its obligations under this Agreement.

5. Amendment. Business Associate and Covered Entity will take such action as is necessary to amend this Agreement for Covered Entity to comply with the requirements of the HIPAA Rules or other applicable law.

6. Termination.

A. Automatic Termination. This Agreement will automatically terminate upon completion of Business Associate’s duties under all underlying Agreements or by termination of such underlying Agreements.

B. Termination Upon Review. This Agreement may be terminated by Covered Entity, at its discretion, upon review as provided by Section 9 of this Agreement.

C. Termination for Cause. In the event of a material breach by Business Associate, Covered Entity:

(1) Will provide an opportunity for Business Associate to cure the breach or end the violation within the time specified by Covered Entity, and;

(2) May terminate this Agreement and underlying contract(s) if Business Associate does not cure the breach or end the violation within the time specified by Covered Entity.

D. Effect of Termination. Termination of this Agreement will result in cessation of activities by Business Associate involving PHI under this Agreement.

E. Survival. The obligations of Business Associate under this Section shall survive the termination of this Agreement as long as Business Associate creates, receives, maintains, or transmits PHI, regardless of whether a compliant Business Associate Agreement is in place.

7. No Third Party Beneficiaries. Nothing expressed or implied in this Agreement confers any rights, remedies, obligations, or liabilities whatsoever upon any person or entity other than Covered Entity and Business Associate, including their respective successors or assigns.

Revised October 2015 7

8. Other Applicable Law. This Agreement does not abrogate any responsibilities of the parties under any other applicable law.

9. Review Date. The provisions of this Agreement will be reviewed by Covered

Entity every two years from Effective Date to determine the applicability and accuracy of the Agreement based on the circumstances that exist at the time of review.

10. Effective Date. This Agreement shall be effective on the last signature date below.

Revised October 2015 8

Department of Veterans Affairs COMPANY/ORGANIZATION Veterans Health Administration

By: By:

Name: Name:

Title: Title:

Date: Date:

_1647343223.pdf

MARCH 12, 2010 VA HANDBOOK 6500.6

APPENDIX D

D-1

CONTRACTOR RULES OF BEHAVIOR

This User Agreement contains rights and authorizations regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the Department of Veterans Affairs (VA). This User Agreement covers my access to all VA data whether electronic or hard copy ("Data"), VA information systems and resources ("Systems"), and VA sites ("Sites"). This User Agreement incorporates Rules of Behavior for using VA, and other information systems and resources under the contract.

1. GENERAL TERMS AND CONDITIONS FOR ALL ACTIONS AND ACTIVITIES UNDER

THE CONTRACT:

a. I understand and agree that I have no reasonable expectation of privacy in accessing or using any VA, or other Federal Government information systems.

b. I consent to reviews and actions by the Office of Information & Technology (OI&T) staff designated and authorized by the VA Chief Information Officer (CIO) and to the VA OIG regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA. These actions may include monitoring, recording, copying, inspecting, restricting access, blocking, tracking, and disclosing to all authorized OI&T, VA, and law enforcement personnel as directed by the VA CIO without my prior consent or notification.

c. I consent to reviews and actions by authorized VA systems administrators and Information Security Officers solely for protection of the VA infrastructure, including, but not limited to monitoring, recording, auditing, inspecting, investigating, restricting access, blocking, tracking, disclosing to authorized personnel, or any other authorized actions by all authorized OI&T, VA, and law enforcement personnel.

d. I understand and accept that unauthorized attempts or acts to access, upload, change, or delete information on Federal Government systems; modify Federal government systems; deny access to Federal government systems; accrue resources for unauthorized use on Federal government systems; or otherwise misuse Federal government systems or resources are prohibited.

e. I understand that such unauthorized attempts or acts are subject to action that may result in criminal, civil, or administrative penalties. This includes penalties for violations of Federal laws including, but not limited to, 18 U.S.C. §1030 (fraud and related activity in connection with computers) and 18 U.S.C. §2701 (unlawful access to stored communications).

VA HANDBOOK 6500.6 MARCH 12, 2010

D-2

f. I agree that OI&T staff, in the course of obtaining access to information or systems on my behalf for performance under the contract, may provide information about me including, but not limited to, appropriate unique personal identifiers such as date of birth and social security number to other system administrators, Information Security Officers (ISOs), or other authorized staff without further notifying me or obtaining additional written or verbal permission from me.

g. I understand I must comply with VA’s security and data privacy directives and handbooks. I understand that copies of those directives and handbooks can be obtained from the Contracting Officer's Technical Representative (COTR). If the contractor believes the policies and guidance provided by the COTR is a material unilateral change to the contract, the contractor must elevate such concerns to the Contracting Officer for resolution.

h. I will report suspected or identified information security/privacy incidents to the COTR and to the local ISO or Privacy Officer as appropriate.

2. GENERAL RULES OF BEHAVIOR

a. Rules of Behavior are part of a comprehensive program to provide complete information security. These rules establish standards of behavior in recognition of the fact that knowledgeable users are the foundation of a successful security program. Users must understand that taking personal responsibility for the security of their computer and the information it contains is an essential part of their job.

b. The following rules apply to all VA contractors. I agree to:

(1) Follow established procedures for requesting, accessing, and closing user accounts and access. I will not request or obtain access beyond what is normally granted to users or by what is outlined in the contract.

(2) Use only systems, software, databases, and data which I am authorized to use, including any copyright restrictions.

(3) I will not use other equipment (OE) (non-contractor owned) for the storage, transfer, or processing of VA sensitive information without a VA CIO approved waiver, unless it has been reviewed and approved by local management and is included in the language of the contract. If authorized to use OE IT equipment, I must ensure that the system meets all applicable 6500 Handbook requirements for OE.

(4) Not use my position of trust and access rights to exploit system controls or access information for any reason other than in the performance of the contract.

(5) Not attempt to override or disable security, technical, or management controls unless expressly permitted to do so as an explicit requirement under the contract or at the direction of the COTR or ISO. If I am allowed or required to have a local administrator account on a government-owned computer, that local administrative account does not

D-3 confer me unrestricted access or use, nor the authority to bypass security or other controls except as expressly permitted by the VA CIO or CIO's designee.

(6) Contractors’ use of systems, information, or sites is strictly limited to fulfill the terms of the contract. I understand no personal use is authorized. I will only use other Federal government information systems as expressly authorized by the terms of those systems. I accept that the restrictions under ethics regulations and criminal law still apply.

(7) Grant access to systems and information only to those who have an official need to know.

(8) Protect passwords from access by other individuals.

(9) Create and change passwords in accordance with VA Handbook 6500 on systems and any devices protecting VA information as well as the rules of behavior and security settings for the particular system in question.

(10) Protect information and systems from unauthorized disclosure, use, modification, or destruction. I will only use encryption that is FIPS 140-2 validated to safeguard VA sensitive information, both safeguarding VA sensitive information in storage and in transit regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA.

(11) Follow VA Handbook 6500.1, Electronic Media Sanitization to protect VA information. I will contact the COTR for policies and guidance on complying with this requirement and will follow the COTR's orders.

(12) Ensure that the COTR has previously approved VA information for public dissemination, including e-mail communications outside of the VA as appropriate. I will not make any unauthorized disclosure of any VA sensitive information through the use of any means of communication including but not limited to e-mail, instant messaging, online chat, and web bulletin boards or logs.

(13) Not host, set up, administer, or run an Internet server related to my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA unless explicitly authorized under the contract or in writing by the COTR.

(14) Protect government property from theft, destruction, or misuse. I will follow VA directives and handbooks on handling Federal government IT equipment, information, and systems. I will not take VA sensitive information from the workplace without authorization from the COTR.

VA HANDBOOK 6500.6 MARCH 12, 2010

D-4

(15) Only use anti-virus software, antispyware, and firewall/intrusion detection software authorized by VA. I will contact the COTR for policies and guidance on complying with this requirement and will follow the COTR's orders regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with VA.

(16) Not disable or degrade the standard anti-virus software, antispyware, and/or firewall/intrusion detection software on the computer I use to access and use information assets or resources associated with my performance of services under the contract terms with VA. I will report anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages to the COTR.

(17) Understand that restoration of service of any VA system is a concern of all users of the system.

(18) Complete required information security and privacy training, and complete required training for the particular systems to which I require access.

3. ADDITIONAL CONDITIONS FOR USE OF NON- VA INFORMATION TECHNOLOGY

RESOURCES

a. When required to complete work under the contract, I will directly connect to the VA network whenever possible. If a direct connection to the VA network is not possible, then I will use VA approved remote access software and services.

b. Remote access to non-public VA information technology resources is prohibited from publicly-available IT computers, such as remotely connecting to the internal VA network from computers in a public library.

c. I will not have both a VA network line and any kind of non-VA network line including a wireless network card, modem with phone line, or other network device physically connected to my computer at the same time, unless the dual connection is explicitly authorized by the COTR.

d. I understand that I may not obviate or evade my responsibility to adhere to VA security requirements by subcontracting any work under any given contract or agreement with VA, and that any subcontractor(s) I engage shall likewise be bound by the same security requirements and penalties for violating the same.

4. STATEMENT ON LITIGATION

This User Agreement does not and should not be relied upon to create any other right or benefit, substantive or procedural, enforceable by law, by a party to litigation with the United States Government.

D-5

5. ACKNOWLEDGEMENT AND ACCEPTANCE

I acknowledge receipt of this User Agreement. I understand and accept all terms and conditions of this User Agreement, and I will comply with the terms and conditions of this agreement and any additional VA warning banners, directives, handbooks, notices, or directions regarding access to or use of information systems or information. The terms and conditions of this document do not supersede the terms and conditions of the signatory’s employer and VA.

Print or type your full name Signature

Last 4 digits of SSN Date

Office Phone Position Title

Contractor’s Company Name

Please complete and return the original signed document to the COTR within the timeframe stated in the terms of the contract.

_1647343224.pdf

September 18, 2007 VA Handbook 6500 Appendix G

Department of Veterans Affairs (VA) National Rules of Behavior

1. Background

a. Section 5723(b)(12) of title 38, United States Code, requires the Assistant Secretary for Information and Technology to establish “VA National Rules of Behavior for appropriate use and protection of the information which is used to support Department’s missions and functions.” The Office of Management and Budget (OMB) Circular A-130, Appendix III, paragraph 3(a(2)(a) requires that all Federal agencies promulgate rules of behavior that “clearly delineate responsibilities and expected behavior of all individuals with access” to the agencies’ information and information systems, as well as state clearly the “consequences of behavior not consistent” with the rules of behavior. The National Rules of Behavior that begin on page G-3, are required to be used throughout the VA.

b. Congress and OMB require the promulgation of national rules of behavior for two reasons. First, Congress and OMB recognize that knowledgeable users are the foundation of a successful security program. Users must understand that taking personal responsibility for the security of their computer and the VA data that it contains or that may be accessed through it, as well as the security and protection of VA information in any form (e.g. digital, paper), are essential aspects of their job. Second, individuals must be held accountable for their use of VA information and information systems.

c. VA must achieve the Gold Standard in data security which requires that VA information and information system users protect VA information and information systems, especially the personal data of veterans, their family members, and employees. Users must maintain a heightened and constant awareness of their responsibilities regarding the protection of VA information. The Golden Rule with respect to this aspect of an employee’s job is to treat the personal information of others the same as they would their own.

d. Since written guidance cannot cover every contingency, personnel are asked to go beyond the stated rules, using “due diligence” and highest ethical standards to guide their actions. Personnel must understand that these rules are based on Federal laws, regulations, and VA Directives.

2. Coverage

a. The attached VA National Rules of Behavior must be signed annually by all VA employees who are provided access to VA information or VA information systems. The term VA employees includes all individuals who are employees under title 5 or title 38, United States Code, as well as individuals whom the Department considers employees such as volunteers, without compensation employees, and students and other trainees. Directions for signing the rules of behavior by other individuals who have access to VA information or information systems, such as contractor employees, will be addressed in subsequent policy.

VA employees must initial and date each page of the copy of the VA National Rules of Behavior; they must also provide the information requested on the last page, sign and date it.

b. The VA National Rules of Behavior address notice and consent issues identified by the Department of Justice and other sources. It also serves to clarify the roles of management

Initials________ Date________ G-1

VA Handbook 6500 September 18, 2007 and system administrators, and serves to provide notice of what is considered acceptable use of all VA information and information systems, VA sensitive information, and behavior of VA users.

c. The VA National Rules of Behavior use the phrase “VA sensitive information”. This phrase is defined in VA Directive 6500, paragraph 5q. This definition covers all information as defined in 38 USC 5727(19), and in 38 USC 5727(23). The phrase “VA sensitive information” as used in the attached VA National Rules of Behavior means:

All Department data, on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes information whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary information, records about individuals requiring protection under various confidentiality provisions such as the Privacy Act and the HIPAA Privacy Rule, and information that can be withheld under the Freedom of Information Act.

Examples of VA sensitive information include the following: individually-identifiable medical, benefits, and personnel information, financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, investigatory, and law enforcement information,…