36C26322Q0881 0001.docx
DOCX document 60 KB Posted
- Attached to
- R614--Fargo VAMC Document Destruction Service
- Solicitation number
- 36C26322Q0881
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 36C26322Q0881.docx | DOCX document | |
| P07 DOL WD 2015-4969 Rev 20 Date 07-01-22.txt | TXT text file |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
5. PROJECT NUMBER (if applicable)
CODE
7.
ADMINISTERED BY
2. AMENDMENT/MODIFICATION NUMBER
CODE
6. ISSUED BY
8. NAME AND ADDRESS OF CONTRACTOR
4. REQUISITION/PURCHASE REQ. NUMBER
3. EFFECTIVE DATE
9A. AMENDMENT OF SOLICITATION NUMBER
9B. DATED
PAGE OF
PAGES
10A. MODIFICATION OF CONTRACT/ORDER NUMBER
10B. DATED
BPA NO.
1. CONTRACT ID CODE
FACILITY CODE
CODE
Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:
The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers
E. IMPORTANT:
is extended,
(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE
OF YOUR
ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.
12. ACCOUNTING AND APPROPRIATION DATA
(REV. 11/2016)
is required to sign this document and return ___________ copies to the issuing office.
is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.
15C. DATE SIGNED
B. THE ABOVE NUMBERE
D CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES
SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).
RESULT IN REJECTION OF YOUR
OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendmen t, and is received prior to the opening hour and date specified.
C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:
D. OTHER
Contractor
16C. DATE SIGNED
14. DESCRIPTION OF AMENDMENT/MODIFICATION
16B. UNITED
STATES OF AMERICA
Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.
15A. NAME AND TITLE OF SIGNER
16A. NAME AND TITLE OF
CONTRACTING OFFICER
15B. CONTRACTOR/OFFEROR
STANDARD FORM 30
PREVIOUS EDITION NOT USABLE
Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)
(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) (such as changes in paying office, appropriation date, etc.)
(If required)
(SEE ITEM 11)
(SEE ITEM 13)
(X)
CHECK
ONE
13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,
IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.
11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF
SOLICITATIONS
AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT
(Signature of person authorized to sign) (Signature of Contracting Officer) Department of Veterans Affairs Network 23 Contracting Office (NCO 23) 113 Comanche Rd.
Fort Meade SD 57741 Department of Veterans Affairs Network 23 Contracting Office (NCO 23) 113 Comanche Rd.
Fort Meade SD 57741 To all Offerors/Bidders
36C26322Q0881 10-11-2022
X X X
See CONTINUATION Page X The purpose of this amendment is to correct the Statement of Work that was posting in the original solicitation.
An earlier draft version of the SOW was inadvertently attached to the solicitation.
See final Statement of Work below.
Donald Gilbert Contracting Officer
NCO231SL3-4302
CONTINUATION PAGE
Fargo Document Destruction Service Contract Amendment 0001 Replace Statement of Work
2. Statement of Work
Confidential Document Destruction for the Fargo VA Health Care System
1.0—INTRODUCTION
The Fargo VA Health Care System (FARGO VAHCS) is comprised of one main campus, eight ancillary facilities in North Dakota (six) and Minnesota (two), and four leased spaces. Addresses are provided in section 4.5 of this document.
The objective of this Statement of Work (SOW) is to describe the Contractor’s technical support requirements for services to secure on-site and off-site document and media destruction and to collect, remove, and destroy confidential documents generated at FARGO VAHCS.
2.0—GENERAL REQUIREMENTS
This section outlines the general requirements under which the Contractor will be expected to perform. Any issues regarding the terms and conditions of this contract shall immediately be brought to the attention of the Contracting Officer Representative (COR) and Contracting Officer (CO).
2.1 Scope of Work
FARGO VAHCS employees are in the practice of putting all confidential materials (including white and mixed paper containing VA sensitive information, personally identifiable information (PII) and protected health information (PHI) in locked bins located throughout all the FARGO VAHCS campuses for destruction.
The contractor shall also provide secured lockable collection containers specific to each designated location for collection and storage of arm bands, CDs, DVDs, and electronic media containing sensitive information until such time that incineration/destruction takes place.
The contractor shall provide all labor, personnel, equipment (including locked bins), secured vehicles, supervision, and other related services necessary to transport this information from FARGO VAHCS campuses to the contractor facility or 3rd party facility and ensure the materials are appropriately destroyed, maintaining compliance with the most current VA Directive 6371, Destruction of Temporary Paper Records, throughout the entire process.
The contractor shall deliver and set up locked bins at FARGO VAHCS campuses within 30 business days after contract award and approval of Contracting Officer Representative (COR). Bins will provide protection of documents that have been deposited via a security slot that prevents access to the inside of the bin. The bins shall be placed at the designated locations directed by the COR (see paragraph 3.1.2.).
2.1.1 On a semiannual basis the contractor will provide a listing, in electronic format, with the following information for each bin:
· Location
· Building number
· Room number
· Bin Identification Number
· Bin size in gallons
2.2 Service Frequency and Hours of Operation
The standard hours of operation shall be defined as 8:00am through 4:30pm, local time, Monday through Friday, except federal holidays.
The contractor should adhere to the frequency schedule below regarding regular servicing. The servicing can occur on any set business day (Monday through Friday) between the hours of 8:00AM and 4:00PM. The contractor, COR and CO will negotiate the specific day of the week for reoccurring services once contract is awarded. This day should stay consistent, week to week and month to month, barring any unforeseen circumstances. If needed, it can be changed, upon agreement from the COR.
When a regular pick-up day occurs on one of the Federal holidays listed below, the pickup day shall automatically shift to the following business day. The eleven national holidays observed by the Federal Government are:
| New Year’s Day | (January 1) | ||
| Martin Luther King Jr Day | (third Monday in January) | ||
| Presidents Day | (third Monday in February) | ||
| Memorial Day | (last Monday in May) | ||
| Juneteenth Holiday | (June 19) | ||
| Independence Day | (July 4) | ||
| Labor Day | (First Monday in September) | ||
| Columbus Day | (second Monday in October) | ||
| Veterans Day | (November 11) | ||
| Thanksgiving Day | (fourth Thursday in November) | ||
| Christmas Day | (December 25) |
This list may also include any other day specifically declared by the President of the United States to be a national holiday.
2.2.1 Prior to any changes made to the pick-up schedule, the COR will notify the Contracting Officer (CO) in writing of the revised schedule. A revised pick-up schedule will be provided to the contractor in writing along with the contract modification from the CO.
2.3. Contract Management
For this contract, there is one designated CO, one COR, and one alternate Point of Contact (POC), the Facility Privacy Officer, located at FARGO VAHCS. The CO will issue the Task Order (TO) and the COR will initiate and monitor the TOs for all equipment and services. The COR and/or POC will have full responsibility for day-to-day document destruction operations, including but not limited to invoice verification and approval and bin relocations and deletions.
3.0—SPECIFIC REQUIREMENTS
3.1. Bin Descriptions and Quantities
The sizes of the provided bins should include 8-9 gallon consoles and 65-gallon bins. Each bin/container must have a scannable unique identification number. All similar-style bins must be keyed alike. Keys may be different from site to site. Containers are to meet the National Fire Protection Association (NFPA) Life Safety Code Edition 2012 (LS.02.01.70 EP 6, LS.03.01.70 EP 6) and be labeled and listed as meeting the requirements of FM Approval Standard 6921 (or equivalent).
The Contractor shall not utilize containers that are greater than 96 gallons for documents awaiting destruction. Containers that are 96 gallons or less, and are labeled and listed as meeting the requirements of FM Approval Standard 6921 (or equivalent), and are used solely for recycling clean waste (including patient records awaiting destruction) are permitted in an unprotected area.
All containers are to be in serviceable condition and compliant with current regulations and standards. Any containers deemed unserviceable by the COR shall be removed and replaced at no additional cost to the government.
3.1.1. The estimated quantity and physical location of bins are listed at the end of this SOW.
3.1.2. The Fargo VA reverse the right to change location of bin or container within a facility at no extra charge. The Contractor will be notified by the COR in writing.
3.1.3. In the event additional services or bins are needed, the CO is the only government staff member responsible for requesting changes with the contractor. All changes must be documented by contract modification. Once the COR requests and CO authorizes the request for additional service, the contractor will be notified of the request. Any requests the contractor completes outside of the knowledge and approval from the CO will be considered unapproved. FARGO VAHCS will not reimburse the contractor for any unapproved requests or services.
3.1.4 The bins shall be kept locked at all times to ensure the protection of the confidential materials enclosed. The contractor will provide a set of master keys for each site to the Privacy Officer and COR. In the event FARGO VAHCS staff identify a bin that is unlocked, the COR or Privacy Officer will use his/her master set of keys to lock the bin and notify the contractor. If there are three or more reported instances of the contractor providing unlocked bins, the contractor will need to formally address this noncompliance with staff, and provide documentation of these remediation efforts to the COR.
3.1.5 The containers must protect against unauthorized access (i.e., reaching through an opening to retrieve a document, bypassing the locking mechanism with a device other than a key, etc.)
3.1.6 The Contractor is responsible for checking and emptying all bins on the schedule at each site.
Containers that are 96 gallons or less, and are labeled and listed as meeting the requirements of FM Approval Standard 6921 (or equivalent), and are used solely for recycling clean waste (including patient records awaiting destruction) are permitted in an unprotected are
3.2. Shredding Specifications
3.2.1. The contractor shall provide shredding document destruction services for all secure materials that are collected both in the locked bins and special bulk pick-ups. The contractor will shred paper material in accordance with the most current VA Directive 6371. This directive requires that final destruction of paper records is pulped, macerated, or shredded to a degree that ensures documents are not readable or re-constructible to any degree.
3.2.2. The contractor will shred all collected paper material onsite via an application that meets all regulation that apply and should be approved by COR and facility Privacy Officers. Prior to beginning performance of the contract, the shredding process will be inspected by COR and/or Privacy Officers during the Post Award Briefing for readiness.
3.2.3. The Contractor will be responsible to ensure Contractor employees providing work on this contract are fully trained and completely competent to perform the required work. The contractor will provide telephone information sufficient to contact management and other contractor officials for customer service during normal business hours. The Contractor will provide a quarterly Diverted Waste report to the COR to account for paper waste tonnage diverted from landfills. Periodic site evaluations with site managers will be conducted to ensure the shredding program is up to date and customized to the specification of the VA.
3.2.4. The contracted facility should either be:
A National Association for Information Destruction (NAID) certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction who has contracted to provide sufficient reasonable safeguards to protect the temporary paper records throughout the entire destruction process; or a non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in the Minimum Standards for Information Destruction listed in Appendix A of VA Directive 6371.
3.2.5 The Contractor shall provide the Contracting Officer with a written contingency plan in case of equipment failure or other unforeseen events.
3.2.6 Destruction service is performed in the parking lot in a designated area.
3.3. Certificates of Destruction:
3.3.1. The Contractor shall submit a legible report (Interim) documenting first line destruction, which shall include detailed description of the shredding accomplished on-site. The contractor shall implement reasonable physical safeguards to protect VA temporary paper records during transportation, transfer, or short-term storage prior to the completion of their final destruction. Contractor shall maintain certifications of responsibility and provide documentation to the COR that meet the most current VA Directive 6371 Final destruction requirements.
3.3.2. Written documentation known as a certificate of destruction (COD) shall be provided by the contractor to attest to that final destruction of records has occurred. The COD can be a memo, letter, or any format attesting to the documents’ complete destruction. The COD should contain sufficient information to attest to the final destruction including:
· the date destroyed
· the name of the campus serviced
· what destruction method was used (i.e. shredding)
· the name and location where final destruction occurred
· the weight (in pounds) of material destroyed
· signature of attestation by the Contractor or delegate The contractor shall send the COD to the COR on a monthly basis when destruction is complete. There shall be one COD for each campus.
3.4. Contractor Vehicles:
3.4.1. The onsite shredded material must be transported via locked secured vehicles from FARGO VAHCS locations to the contractor’s (or subcontractor’s or third party’s) location.
3.4.2. All contractor vehicles utilized in the performance of this contract shall maintain insurance (at least the minimum coverage required by the state where the vehicle is registered) and shall maintain current state vehicle registration.
3.4.3. All contractor employees shall possess a valid state driver’s license and have a clean driving record. The contractor and its employees shall not use personal vehicles to transport containers to and from the government and contractor site while performing under this contract.
3.4.4. The contractor vehicles shall be locked and properly secured at all times while at the government site or travelling to and from contractor site(s). Vehicles used in the performance of the contract shall not be left unattended and unlocked at any time while transporting FARGO VAHCS sensitive information.
4.2. Safety:
4.2.1. The contractor shall have a documented and comprehensive Health and Safety program to ensure all shredding activities are provided in a safe and secure manor.
i. Wearing a face mask covering both the mouth and nose within the VA facility is a requirement.
ii. It shall be understood that, throughout performance of the contract, the Contractor’s personnel, while on VA property, shall adhere to all requirements and regulations that govern the VA Health Care System and its property.
iii. Contractor to follow facility guidelines regarding COVID protocols
4.3. Payment and Invoicing:
4.3.1. The contractor shall only invoice and receive payment for bins that are serviced during the billing period. Servicing will be documented on a receipt of temporary records, which will identify the location of every bin the contractor comes in contact with during the scheduled pick up day. Servicing can include the complete swap of a used bin with an empty bin. Servicing can also include the contractor observing a bin to note it is empty and leaving it in place for the following week. In the event the contractor leaves an empty bin in place, the contractor still needs to account for said bin on the receipt. In the event the contractor fails to empty/replace a bin because they missed it, they have 24 hours from the time of notification to empty/service the container and provide the COR the receipt. If a bin cannot be serviced, the contractor shall notify the COR of the reason that the bin was not able to be serviced.
4.3.2. The contractor must, prior to departing each FARGO VAHCS campus for the day, provide the certificate of destruction to the COR or designated representative who will forward the COD to the COR. This documentation is required per VA Directive 6371 and is critical for privacy and information security matters. If the contractor does not provide this documentation to the designated representatives on the day of servicing before leaving the campus, the COR is unable to establish appropriate custody of the sensitive documents. Therefore, the COR will not be able to pay for the bins serviced that day, as the facility will be noncompliant with VA Directive 6371. This is a zero-tolerance matter.
4.3.3. In the event a discrepancy arises in which FARGO VAHCS staff advise a bin was not emptied for the week, the contractor will work with the COR to resolve the matter. The contractor can either come back to FARGO VAHCS within 24 hours to service that bin.
4.3.5. The contractor will submit a consolidated invoice monthly.
4.4. Security Requirements:
4.4.1. Due to the sensitive nature of equipment and data present at all FARGO VAHCS locations, contractor personnel requiring facility access shall meet the FARGO VAHCS Security Program Procedural Requirements to obtain badges, complete information security and privacy training, and sign the Rules of Behavior. An escort will be provided when required for access into restricted work areas. All security requirements must be met, and the employees must be cleared prior to the contractor performing work under the contract. Employees that cannot meet the security requirements and clearance requirements will not be allowed to perform work under this contract. Upon contract award, COR will assist awardee to ensure the appropriate type of background investigation and/or fingerprints are initiated, and ultimately completed, on contract personnel in accordance with the contract terms and conditions and the VA/VHA Directive and Handbook 0710 Series. This also includes any required training for contract personnel (e.g. VA Cyber Security Awareness, VHA Privacy Policy, etc.) including Compliance and Business Integrity (CBI) Training. The COR will work security issues with the Contractor, as needed, to ensure that sensitive, private, and protected information is safeguarded. While on FARGO VAHCS premises, contractor’s employees will strictly adhere to current procedures for registering entry, wear of identification/visitor badge, and departure from FARGO VAHCS. Alternatively, Contractor personnel who expect to be at FARGO VAHCS frequently may undergo an appropriate level background investigation for their level of access and complete specified training needed to obtain a longer-term badge unique to the person holding it.
TRAINING:
| 1. | All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems: |
| (a) | Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, relating to access to VA information and information systems; |
| (b) | Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training; |
| (c) | Successfully complete the appropriate VA privacy training and annually complete required privacy training; and |
| (d) | Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.] |
| 2. | The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required. |
| 3. | Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete. |
Talent Management System (TMS) Self – Enrollment Instructions link: http://vaww.visn8.portal.va.gov/northflorida/cos/education/shared/MSE-Profile-Creation-Contractors-JobAid-508.pdf
4.4.2. Under HIPAA Privacy and Security Rules, the contractor providing services under this contract has access to protected health information and is not considered to be a “covered entity.” Thus, the contractor is required to enter into a Business Associate Agreement with VA or provide a copy of a National Business Associate Agreement already in place.
GENERAL:
Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.
1. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS:
A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.
All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.
Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.
Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.
The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.
2. VA INFORMATION CUSTODIAL LANGUAGE:
Information made available to the contractor or subcontractor by VA for the Performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).
VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.
Prior to termination or completion of this contract, contractor/subcontractor must Not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.
The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.
The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.
If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.
If a VHA contract is terminated for cause, the associated BAA must also be Terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.
The contractor/subcontractor must store, transport, or transmit VA sensitive Information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.
The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.
Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.
Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.
For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.
3. SECURITY INCIDENT INVESTIGATION:
The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.
To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.
With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.
In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.
| 4. | LIQUIDATED DAMAGES FOR DATA BREACH: | ||
| a. | Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. | ||
| b. | The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. | Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. | |
| c. | Each risk analysis shall address all relevant information concerning the data breach, |
including the following:
| (a) | Nature of the event (loss, theft, unauthorized access); |
| (b) | Description of the event, including: |
| (1) | date of occurrence; |
| (2) | data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code; |
| (c) | Number of individuals affected or potentially affected; |
| (d) | Names of individuals or groups affected or potentially affected; |
| (e) | Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; |
| (f) | Amount of time the data has been out of VA control; |
| (g) | The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); |
| (h) | Known misuses of data containing sensitive personal information, if any; |
| (i) | Assessment of the potential harm to the affected individuals; |
| (j) | Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and |
| (k) | Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised. |
| 4. | Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: |
| (a) | Notification; |
| (b) | One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; |
| (c) | Data breach analysis; |
| (d) | Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; |
| (e) | One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and |
| (f) | Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs. |
4.5. Contract Transition:
4.5.1. In the event FARGO VAHCS awards a follow-on contract to other than the incumbent contractor, the contractor will cooperate to the extent required to allow for an orderly changeover to the successor contractor. This transition shall be as smooth and transparent as possible to ensure no interruption in the services currently being provided. The incumbent contractor shall schedule a time with the COR to remove containers/consoles/bins throughout the VA 437 facilities at no additional cost to the government once the incumbent has the proper bins in stock.
Fargo VA Health Care System Note: POC information for each location will be provided at the time of the contract kick-off.
The Fargo VA Medical Center Main Campus is the only location with a loading dock. This is a multilevel structure, but a freight elevator may be utilized.
| Location – VA Facility and Address |
| Estimate # of Console |
| Estimate # of Rolling Bins – 65 gal. |
| Frequency |
Fargo VA Medical Center Main Campus 2101 Elm St. N Fargo ND 58102
| 15 |
| Weekly |
Main Campus: Non-Paper Media Destruction Console
| 1 |
| 1 |
| Monthly |
Fergus Falls VA Community Based Outpatient Clinic (CBOC) 1839 N Park St Fergus Falls, MN
| 0 |
| 1 |
| Every other week |
Bemidji VA CBOC 1217 Anne St NW Bemidji, MN
| 2 |
| 2 |
| Every other week |
Bismarck VA CBOC Gateway Mall 2700 State St Suite Bismarck, ND
| 1 |
| 2 |
| Every other week |
Devils Lake VA CBOC 1031 7th St NE Devils Lake, ND
| 0 |
| 1 |
| Monthly |
Grafton VA CBOC 1319 11th St W.
Grafton, ND
| 0 |
| 2 |
| Monthly |
| Location – VA Facility and Address |
| Estimate # of Console |
| Estimate # of Rolling Bins |
(65 gal) Frequency
Grand Forks VA CBOC 3221 32nd Ave S Suite 700 Grand Forks, ND
| 4 |
| 2 |
| Monthly |
Jamestown VA CBOC 2430 20th St SW, Suite 8 Jamestown, ND
| 2 |
| 0 |
| Every other week |
Minot VA CBOC 3400 S Broadway St Minot, ND
| 3 |
| 0 |
| Monthly |
Fargo VA Annex* 474 45th St S.
Fargo ND
(Spring 2022 moving to GSA Post Office Bldg)
| 2 |
| 1 |
| Every other week |
GSA (Post Office Bldg) 657 2nd Avenue N.
Fargo, ND
| 0 |
| 1 |
| Monthly |
Community Resource & Referral Center 721 1st Ave. N.
Fargo ND
| 0 |
| 1 |
| Every other week |
Home Based Primary Care Site Federal Building, 304 East Broadway Bismarck, ND
| 1 |
| 0 |
| Monthly |
Page 1 of
Page 1 of Page 1 of
File details come from the government source that posted it. Updated .