36C26224Q0354.docx

36C26224Q0354

GENERAL INFORMATION

Network Contracting Office 22 4811 Airport Plaza Drive Suite 600 Long Beach CA 90815

POINT OF CONTACT*

Hestia Sim Hestia.Sim@va.gov

PLACE OF PERFORMANCE

VA Long Beach Healthcare System

Radiology

5901 East 7th Street

Long Beach CA

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

This is a combined synopsis/solicitation is set aside for SDVOSB for commercial supplies prepared in accordance with the format in Subpart 12.6, as supplemented with the additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued. This is a request for quotes under solicitation number: 36C26224Q0354

The Department of Veterans Affairs Long Beach Healthcare System, Long Beach, CA 90822 has a lease requirement for GE brand Mobile PET/CT Trailer. The Contractor shall furnish all supplies/services at The VA Long Beach Healthcare System located in 5901 East 7th Street, Long Beach, CA 90822. Anticipated period of performance is 1/15/2024 through 9/30/2024. All transportation (shipping and pickup) cost shall be included in the rental cost.

This is a brand name requirement. See attached P03 BNJ for appropriate Brand Name Justification and its approval for more details.

No remanufactures or gray market items will be acceptable. Vendor shall be an Original Equipment Manufacturer (OEM), authorized dealer, authorized distributor or authorized reseller verified by an authorization letter or other documents from the OEM.

Refer to Section A.2 Statement of Work for more detailed requirements.

The solicitation will be in accordance with FAR Part 12, 13, and 19, Acquisition of Commercial Items, Simplified Acquisition Procedures, Small Business Programs, and Veteran Affairs Acquisition Regulations as supplemented with additional information in this notice. The North American Industrial Classification System (NAICS) code for this requirement is 621512, Size Standard $19M. The Contractor shall adhere to all federal and state laws and regulations in effect during the term of this contract. The Government intends to award a firm-fixed-price contract. The Contract begins on the date of award.

Key solicitation milestones are: Submit any questions regarding this procurement via email to Hestia.Sim@va.gov no later than 10am Pacific Local Time Wednesday, December 27, 2023. No questions will be answered after this date/time unless determined to be in the best interest of the Government as determined by the Contracting Officer. Telephonic questions will not be accepted or returned. RFI responses will be responded to as necessary in amendment format which will be posted to contract opportunities at http://SAM.gov.

Due to time constraints, responses to the solicitation shall be due on Thursday, January 4, 2024 at 10:00 Pacific Local Time. Offerors are advised that it is your responsibility to review and monitor the website frequently to ensure you have the most up to date information, including amendments. Correspondence or questions may be directed to Hestia Sim, Contracting Specialist at Hestia.Sim@va.gov with " 36C26224Q0354, PET/CT Trailer Lease VA Long Beach” in the subject line within 48 hours of release of this notice. Telephone inquiries will not be honored. Inquiries after the allotted period may not be responded to due to the time constraints of the procurement. All offerors must be registered in www.sam.gov to do business with the Government. Ensure your registration is correct, current and has not expired.

Combined Synopsis/Solicitation Notice Combined Synopsis/Solicitation Notice

Combined Synopsis/Solicitation Notice

Table of Contents

SECTION A - CONTINUATION OF COMBINED SYNOPSIS

A.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C262 Department of Veterans Affairs Network Contracting Office 22 4811 Airport Plaza Drive Suite 600 Long Beach CA 90815

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Submit invoices electronically through https://portal.tungsten-network.com ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

A.2 STATEMENT OF WORK

1. SERVICES: Contractor shall provide a wide bore GE Discovery MI Gen2 PET/CT system or equivalent GE brand name Mobile Self-contained trailer with pressure injector and dose calibrator from January 15, 2024, to September 30, 2024. The mobile/trailer PET/CT unit must come with a patient lift and stairs with double sided handrails for safety. Contract shall provide a minimum of 3 days of applications training, initial supplies necessary to perform PET/CT examinations, maintenance and repair of all Contractor furnished equipment. Mobile PET/CT trailer must have network and DICOM capability and provide an on-site assistance during lease startup and network configuration/connectivity in accordance with terms and conditions listed herein at Tibor Rubin VA Long Beach Medical Center, CA per VA Standards.

VA shall retain all device hard drives at the end of the performance period.

Contractor shall be responsible to maintain all Contractor equipment in good working order.

Site Prep: (Furnished by VA Long Beach Engineering)

· Install 8 ft x 75 ft chain link security fence with green screen; include access point that is lockable (Standard 5200 series lock) [Support poles mount in pavement; subsurface inspection required prior to install]

· Clear access route identified for gurney.

· Connection to existing shore power [Confirm connection plug and voltage/amperage requirement]

· Road signage as required if roadway impeded by trailer and fence.

· Any component required to make safe any feature of the trailer that impedes access, e.g. ramps for additional wiring, safety bollard to identify protruding parts, etc.

· All safety features to secure trailer to the site.

· Install 160 sq. ft of new concrete sidewalk.

· Relocate drain under existing sidewalk

· Removal of all items and repair to facility upon completion of lease.

· Connection of Utilities (Electric & IT Data) from exiting panels, placed at a location designated by the Program Office Manager.

2. CONTRACTOR’S FURNISHED EQUIPMENT: Equipment shall include, but not limited to, a Contractor furnished fully equipped GE Discovery MI Gen2 PET/CT Mobile Trailer or equivalent GE Mobile self-contained trailer with a Medrad Stellant CT Contrast injector and a dose calibrator. All equipment to be used shall be Food and Drug Administration (FDA) approved imaging equipment placed at a location designated by the Program Office Manager.

3. SYSTEM CAPABILITY REQUIREMENTS: The Contractor shall provide an on-site Mobile GE Discovery MI Gen2 PET/CT system or equivalent GE Mobile self-contained trailer that is a full body PET/CT scanner system with dose calibrator in accordance with the terms and conditions of this requirement. The unit shall have the ability to perform a wide range of exams as listed below:

The types of exams expected to be performed with the PET/CT system:

PET/CT FDG SBTT

PET/CT FDG WB

PET/CT PSMA PYLARIFY VERTEX TO MID THIGH

PET/CT DOTATATE NETSPOT VERTEX TO MID THIGH

PET/CT FDG BRAIN

PET/CT NAF BONE WB

CT ABDOMEN/PELVIS WITH & W/O IVCM

CT ABDOMEN WITH PO WITH & W/O IVCM

CT ABDOMEN/PELVIS WITH PO WITH & W/O IVCM

CT HEAD WITH & W/O IVCM

CT THORAX WITH & W/O IVCM

CT PELVIS WITH & W/O IVCM

a.) Protocol Storage capabilities b.) Diagnostic and Non-Diagnostic protocol

4. MOBILE UNIT CAPABILITIES:

Contractor shall provide an on-site Mobile GE Discovery MI Gen2 PET/CT system or equivalent GE Mobile self-contained trailer that meets the following:

a. Hardware and software necessary to permit interpretation of PET/CT Images at the site where images are obtained.

b. Dose calibrator

c. Ability to create, store and export Digital Imaging and Communications in Medicine (DICOM), Joint Photographic Experts Group (JPEG) and Moving Picture Experts Group (MPEG) file formats.

d. The mobile unit shall be equipped with Compact Disk-Recordable CD-R/DVD-R burning capabilities as a backup to network transfer if available.

e. The mobile unit shall be equipped with a phantom for daily quality assurance (QA) checks.

f. The mobile unit shall be equipped with an Intravenous (IV) contrast injector (Medrad Stellant CT contrast injector).

g. The mobile unit shall be equipped with a programmable injector with pressure monitor having the following capabilities (Medrad Stellant Double Syringe Injector):

1. Scan delay

2. Multiphase option

3. Protocol storing

4. Pause hold functionality

h. Minimum security requirements:

1. Up-to-date Microsoft (MS) patches and anti-virus software at the vendor mobile unit.

2. Up-to-date MS patches and anti-virus software at the vendor workstation.

3. Any workstation configuration must be compatible with VA supplied anti-virus (currently McAfee Enterprise).

4. Medical Device Isolation Architecture (MDIA) security to be provided by VA.

5. No patient identifiers such as name and Social Security Number shall reside on the mobile unit and images shall have an identifier which does not disclose Personally Identifiable Information (PII).

5. MOBILE UNIT ACCESSORIES: Accessory equipment that shall be provided by the Contractor:

a. Handicap accessibility (wheelchair or elevator lift) – Trailer shall be complied with Americans with Disabilities Act (ADA) requirements for access.

6. MOBILE UNIT EQUIPMENT SPECIFICATIONS: The following minimum performance characteristics of the equipment are required:

a. The PET/CT shall provide images with consistently high technical quality to be approved by VA employed experts. Poor image quality will be considered non-performance under this contract and must be remedied within 30 days of notification or incurred default.

b. The PET/CT should be capable of acquiring and post-processing of 3-dimensional and/or time of flight data.

c. The PET/CT Unit shall have a minimum of a 64 -slice detector and be capable of acquiring the transmission images within one breath hold.

d. The PET/CT shall be capable of acquiring data for anatomic localization and attenuation correction.

e. The PET/CT system shall have attenuation correction algorithm(s) that are designed to use non-contrast enhanced CT data.

f. The PET/CT system shall have attenuation correction algorithm(s) that are designed to use CT data with intravenous contrast enhancement.

g. The PET/CT system shall have attenuation correction algorithm(s) that are designed to use CT data with oral contrast enhancement with positive contrast (iodinated contrast).

h. The PET/CT system shall have attenuation correction algorithm(s) that are designed to use CT data with oral contrast enhancement with negative contrast (water).

i. The Mobile PET/CT unit shall have a patient injection/incubation room.

j. The Mobile PET/CT unit shall maintain a temperature to assure proper operation of the scanner without frequent calibration and provide for patient comfort.

k. The PET/CT unit shall meet all federal, state and local fire and safety requirements.

l. The mobile unit shall provide a patient injection room, and patient restroom if possible.

m. Telecommunications: The mobile unit shall be equipped with outlet jack’s connections capable of transmitting data and voice through Government provided category five (5) cable and dual pair phone cable. The Government will provide the connection required for the transmission of images, data and voice.

n. The Government is responsible for making the connections between the hospital and the Mobile PET/CT for the purposes of transmitting data. A Configuration Form will be completed and sent to Contractor prior to delivery.

o. The mobile unit shall support DICOM Modality Work list (DMWL), for future use.

p. The mobile unit shall be able to export DICOM images to at least one destination.

q. System shall meet minimal standards for the type of equipment being provided as defined herein.

r. System scan protocols shall be verified and validated by VA reading radiologists.

s. Tibor VA Medical Center shall provide the following utilities/services up to the docking pad (if necessary) for operation of the PET/CT mobile unit.

0. Docking Pad, located on South Side of B 161 at Tibor Rubin VA Long Beach Medical Center, CA

0. Electricity (150-amp panel breaker, 3 phases, 480v), (200-amp receptacle, 5 wire, Russelstoll #DF 2504 Frabo) *

0. Data Port **

0. Housekeeping ***

0. Restroom Facilities

*In accordance to the Original Equipment Manufacturers (OEM) electrical specifications.

**Three (3) data lines. Data Port requirements are for the support of Data/Image transfer support (See Para. 11 of the Statement of Work).

***The Tibor Rubin VA Long Beach Medical Center, CA enter shall be responsible for areas within the hospital facility prior to entrance of the Mobile Trailer. The Tibor Rubin VA Long Beach Medical Center, CA Center shall be responsible for all housekeeping duties and responsibilities within the Mobile Unit and within the general vicinity around the outside of the Mobile Unit.

7. EQUIPMENT MAINTENANCE: Equipment provided shall always be in good working condition in order to provide high quality scans required under this requirement and any resulting contract. Contractor shall be completely responsible for the preventive maintenance, emergency and general repairs, safety, cleaning, and upkeep of all equipment furnished by the Contractor. Preventative maintenance/repairs on the Mobile PET/CT unit and all associated equipment shall be performed in accordance with the Conformance Standards and manufacturer’s recommendations. All maintenance and service of PET/CT trailer and equipment to include all preventive maintenance, service calls, transportation, parts, and labor at no additional cost to the VA.

a. Telephone Technical Support: Contractor shall provide telephone assistance 24/7, all days of the year.

b. Contractor shall provide the names of technical/service support representative (if known) and their 24/7 phone numbers to the program office manager.

c. Response Time: Contractor shall acknowledge request by telephone within 30 minutes and be on site within four (4) hours of telephone acknowledgement of service request.

d. All OEM Preventive Maintenance, licensures, inspection, adjustments, and calibration shall be current at all times with no lapses or pending discrepancies.

The Tibor Rubin VA Long Beach Medical Center, CA will not be held responsible for any loss or damage to the Contractor’s property, which may be vandalized or damaged, including the mobile trailer while on site. Contractor shall maintain property insurance on all equipment throughout the duration of the contract and the successful Contractor shall provide proof of insurance as required herein.

8. SITE PREPARATION: The Tibor Rubin VA Long Beach Medical Center, will provide a docking site for the contractors PET/CT Scan mobile unit. The Contractor or designee shall perform a site visit at the Tibor Rubin VA Long Beach Medical Center location after notification of contract award and prior to commencement of work to coordinate with the Program Office Manager and Engineering in order to confirm site conditions and connectivity for trailer/mobile unit docking.

9. CONTRACTOR’S QUALIFICATIONS: The contractor must be regularly established in the business called for, financially responsible and have the necessary equipment and personnel to furnish service in the volume required for all items under this requirement.

Contractor’s assigned personnel must be computer literate in the type of software and/or hardware associate with their duties.

10. CONTRACTOR’S STAFF

PET/CT Mobile Unit Driver shall be licensed as applicable to operate and drive the mobile vehicle in which the unit is housed.

DAILY ACCESS TO FACILITIES: The contractor shall be responsible for contacting the VA Police at the site of service at the time of arrival, in which the contractor will need access to both the building and data port connections. Contractor shall also comply with all COVID-19 screening requirements currently in effect at the Tibor Rubin VA Long Beach Medical Center during the term of the contract. The location and contact numbers will be provided by the Program Office Manager to the contractor at the post award orientation meeting.

11. CONTRACTOR’S RESPONSIBILITIES:

a. Contractor shall be responsible for the timely delivery/set-up of the PET/CT trailer such that the Contractor may facilitate the following start up functions:

1. Prior to the commencement of services, the Contractor shall ensure that the mobile trailer is properly positioned and docked. Contractor shall also ensure that the normal temperature within the mobile trailer is set and maintained prior to services.

2. Prior to the commencement of the contract services the Contractor shall ensure that the mobile trailer is level and set for the safety of all Tibor Rubin VA Long Beach Medical Center patients and the appropriate utilities connected for proper warm up of all on board systems.

3. Contractor shall allow enough time for contacting the VA Police when gaining access to Tibor Rubin VA Long Beach Medical Center.

4. Communications systems shall be operational before commencement of services.

b. DATA/IMAGE TRANSFER SUPPORT: Contractor will have a field service engineer (“FE”) available on the day of delivery to assist Tibor Rubin VA Long Beach Medical Center O&IT personnel to verify that images are able to be sent from the mobile PET/CT to remote locations (i.e. ePACS, Eclipse network) The FE will input data based on the instructions of the hospital. Once this is accomplished, the service responsibility for network related issues lies solely with the Tibor Rubin VA Long Beach Medical Center.

The Contractor may be provided an IP address for Source Data, Default Gateway, and Subnet Mask from the VI OI&T personnel. If applicable, the Contractor shall be responsible for implementation of data transfer to the VA network with the assistance of VA OI&T personnel. The mobile truck’s IP address (es) cannot be part of the VA network. The IP range for the workstation / equipment must be in a range supplied by the Government. It should allow for the IP address to be changed locally. The VA will create an Access Control List (ACL) to address security controls. The Contractor shall ensure all IT devices located in the PET/CT mobile unit be cleansed of all Virus and Malware prior to connecting to the VA network.

c. CONTRACTOR FURNISHED FACILITIES, SERVICES, SUPPLIES AND EQUIPMENT:

1. The Contractor’s Vehicle shall be parked at the designated docking pad ramp location. Contractor shall be responsible for leveling of the vehicle at location designated by the Tibor Rubin VA Long Beach Medical Center.

2. Contractor shall provide a minimum of 3 days of applications training to include PET/CT protocol set-up, necessary hardware/software training (Quality Assurance, hard and soft shutdown, safety, etc.), scanning and the use of its accessories.

3. Contractor will provide an orientation to the operation of the components of the mobile specialty vehicle including safety features, operation of the wheelchair lift, location of emergency off switch and any other features required for employee safety.

4. Contractor shall be held responsible for any damages, which may be done to the Tibor Rubin VA Long Beach Medical Center property during delivery, hookup and/or removal of equipment at the site. Any damages caused by the Contractor shall be repaired at the Contractor’s expense to the satisfaction of the Tibor Rubin VA Long Beach Medical Center.

5. Proper installation/staging of the Contractor’s furnished equipment including the mobile trailer must be completed in accordance with industry standards, all OSHA regulations, and applicable manufacturer’s recommendations. Contractor shall provide certified Electrician if any connectivity issues arise. The above must be completed prior to commencement of services. Dates and time for completion of the above shall be mutually agreed upon between the Tibor Rubin VA Long Beach Medical Center and the Contractor.

d. NON-CONFORMING PRODUCTS OR SERVICES:

Nonconforming products or services will be rejected. Unless otherwise agreed by the parties, deficiencies shall be corrected within seven (7) days of the rejection notice. If the deficiencies cannot be corrected within seven (7) days, the Contractor shall immediately notify the Program Office Manager and the Contracting Officer of the reason for the delay and provide a proposed corrective action plan within seven (7) working days.

e. EMERGENCY REPAIRS:

Emergency service: Contractor shall provide to the Tibor Rubin VA Long Beach Medical Center, all emergency service to include all required personnel, parts and labor, and preventive maintenance/repairs of PET/CT structure and equipment to maintain a safe environment as recommended by the original equipment manufacturer (OEM) recommendations/specifications in accordance with the agreed upon schedule with the Program Office Manager. Contractor’s service contract hours of coverage is 8 AM until 9 PM seven days a week, excluding observed holidays. Service travel and labor outside of these hours is always available but will be billable by Contractor.

Response Time: In the event of an equipment failure during normal working hours while in the performance of the Contractor’s services, the Contractor shall notify the Program Office Manager or designee immediately after discovery of equipment failure while on site. All reasonable efforts should be made to keep equipment down time to a minimum of 24 hours or less. If repair services are required to be performed on site after the normal working hours, the Contractor must notify the Program Office Manager and the VA Police that services will be performed on-site. All emergency repairs are the responsibility of the contractor and only qualified service engineers shall perform emergency repairs.

f. DOCUMENTATION/REPORTS:

1. The Contractor shall provide equipment and maintenance reports to the Program Office Manager if requested during the duration of the contact. The Contractor shall also provide system pre-check and associated documentation at the time the unit is set up at the site where services are to be performed. This is to ensure safety of equipment utilized by the Tibor Rubin VA Long Beach Medical Center beneficiaries.

2. The Contractor shall permit onsite inspection by personnel selected by the Tibor Rubin VA Long Beach Medical Center without prior notice to ensure the Contractor’s equipment is operated in accordance with appropriate safety guidelines and/or regulations as applicable.

3. The following documentation shall be maintained by the Contractor and be available for inspection by a duly authorized VA representative:

Certificate of Insurance includes, but not limited to, Professional Liability, Worker’s Compensation, liability and property insurance of Contractor’s furnished equipment which shall be submitted to the Contracting Officer within ten (10) calendar days of receipt of notification of award. It is agreed upon and understood that the Tibor Rubin VA Long Beach Medical Center shall not be held responsible for any damage or vandalism, which may be caused to the Contractor’s equipment while on Tibor Rubin VA Long Beach Medical Center premises. Required state licenses, not to include Certificate of Need, if applicable to the end user.

g. EQUIPMENT REQUIREMENTS:

1. The Contractor agrees to ensure compliance/acceptance testing of the PET/CT equipment is performed on at least an annual basis or if major components of the machine is serviced or replaced.

2. The Contractor is responsible for ensuring the compliance testing of the PET/CT machine shall be performed by a qualified medical physicist in the last 13 months. A copy of this report must be forwarded to the Program Office Manager for documentation, along with any documents showing resolution of any discrepancies noted in the report. A qualified medical physicist as defined is an individual who is certified by the American Board of Radiology, American Board of Health Physics, or American Board of Medical Physics in the appropriate disciplines of radiologic physics and maintain state certification as a Health Physicist.

3. PET/CT Trailer shall maintain proper temperature to ensure maximum operation, calibration, and care of equipment to ensure patient comfort.

4. HVAC System to maintain PET/CT Trailer environmental Systems.

h. REMOVAL OF CONTRACTOR’S EQUIPMENT: Contractor shall be responsible for the timely removal including but not limited to pick-up and transport of the PET/CT trailer from the Tibor Rubin VA Long Beach Medical Center premises as agreed upon with the Program Office Manager not to exceed a 24-hour period after completion of the last procedure is performed and shall also be responsible for the following exit functions:

1. At the termination of the contract, Contractor shall surrender the hard drive of the workstation removing for destruction. The Tibor Rubin VA Long Beach Medical Center will reimburse Contractor for all reasonable costs incurred in replacing the hard drive.

2. VA information retained by the PET/CT scanner itself and other Contractor equipment shall be returned to the VA at the end of the contract and when no longer required for regulatory purposes. The security of information retained by the PET/CT scanner and other Contractor equipment both during the contract period and post contract period shall be the responsibility of the vendor.

3. All connections from the trailer to the Tibor Rubin VA Long Beach Medical Center property are properly disconnected.

4. Unit and all necessary accessories, devices and the like are removed from the Tibor Rubin VA Long Beach Medical Center premises.

12. GOVERNMENT FURNISHED FACILITIES, SERVICES, SUPPLIES AND EQUIPMENT:

a. The VA facility shall provide all patient services.

b. The Tibor Rubin VA Long Beach Medical Center will provide the following services, supplies and facilities:

All medical supplies (including disposable syringes), facilities, personnel and physicians required to provide patients with such emergency medical care as may be required, including oxygen, aspirator and defibrillator when deemed necessary. These emergency supplies will be supplied by the VAMC Logistics office.

13. PERIOD OF PERFORMANCE: Services shall commence on, January 15, 2024, or sooner, and conclude on September 30, 2024, with weekly options thereafter or early termination at the discretion of the Tibor Rubin VA Long Beach Medical Center.

14. PLACE OF INSPECTION AND ACCEPTANCE:

Delivery location of PET/CT Mobile Trailer site shall be coordinated with the Program Office Manager.

15. SCOPE OF INSPECTION:

a. Compliance with Statement of Work will be inspected for content, completeness, and accuracy and conformance to contract requirements by the Program Office Manager or his/her designee. Inspection will include validation of information or software using automated tools and/or testing of the deliverables, as specified in the contract order. The scope and nature of this testing must be negotiated prior to the contract award and will be sufficiently comprehensive to ensure the completeness, quality, and adequacy of all deliverables.

b. Reports, documents, and narrative type deliverables shall only be accepted when all discrepancies, errors or other deficiencies identified in writing by the government have been corrected.

c. Maintenance logs shall be available upon request.

d. Payment Reconciliation will be accomplished by the Government monthly. The Program Office Manager or Designated Ordering Office or Officer will validate invoices by reconciliation with required activity reports and schedule PET/CT Scan services ordered. If issues occur the Program Office Manager or Designated Ordering Officer will contact the contractor for clarification and/or correction.

16. VA HANDBOOK 6500.6- Appendix A Security Clause

852.273-75 - SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION

TECHNOLOGY RESOURCES (INTERIM- OCTOBER 2008)

As prescribed in 839.201, insert the following clause:

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

(END OF CLAUSE)

17. VA HANDBOOK 6500.6-Appendix A VA Information and Information System Security/Privacy

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be in the U.S.

to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures follow VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor during performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor / subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be enough grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, any associated Business Associate Agreement (BAA) must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor / subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT – N/A

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE – N/A

6. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

7. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data considering the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

e. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $______ per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at Least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

8. SECURITY CONTROLS COMPLIANCE TESTING – N/A

9. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior Training, or provide evidence of completion/certification, and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training, or provide evidence of completion/certification, and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

a. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within one (1) week of the initiation of the contract and annually thereafter, as required.

b. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

18. Appendix D - CONTRACTOR RULES OF BEHAVIOR

This User Agreement contains rights and authorizations regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the Department of Veterans Affairs (VA). This User Agreement covers my access to all VA data whether electronic or hard copy ("Data"), VA information systems and resources ("Systems"), and VA sites ("Sites"). This User Agreement incorporates Rules of Behavior for using VA, and other information systems and resources under the contract.

1. GENERAL TERMS AND CONDITIONS FOR ALL ACTIONS AND ACTIVITIES UNDER THE CONTRACT:

a. I understand and agree that I have no reasonable expectation of privacy in accessing or using any VA, or other Federal Government information systems.

b. I consent to reviews and actions by the Office of Information & Technology (01&T) staff designated and authorized by the VA Chief Information Officer (CIO) and to the VA OIG regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA. These actions may include monitoring, recording, copying, inspecting, restricting access, blocking, tracking, and disclosing to all authorized 01&T, VA, and law enforcement personnel as directed by the VA CIO without my prior consent or notification.

c. I consent to reviews and actions by authorized VA systems administrators and Information Security Officers solely for protection of the VA infrastructure, including, but not limited to monitoring, recording , auditing, inspecting, investigating, restricting access, blocking, tracking , disclosing to authorized personnel, or any other authorized actions by all authorized OI&T, VA, and law enforcement personnel.

d. I understand and accept that unauthorized attempts or acts to access, upload, change, or delete information on Federal Government systems; modify Federal…