36C26326Q0074.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

437-26-1-5331-0003

36C26326Q0074

Becky De Los Santos 320-255-6480 10-29-2025

10:00 AM CDT

36C263

DEPARTMENT OF VETERANS AFFAIRS

NETWORK CONTRACTING OFFICE 23

1303 5TH STREET, SUITE 300

CORALVILLE IA 52241

X

811210

$34 Million

N/A

X

36C437

Fargo VA Health Care System

2101 North Elm Street

Fargo ND 58102

36C263

NETWORK CONTRACTING OFFICE 23

1303 5TH STREET, SUITE 300

CORALVILLE IA 52241

FMS-VA-2(101)

FINANCIAL SERVICES CENTER

PO BOX 149971

AUSTIN TX 78714-9971

See CONTINUATION Page

RFQ for Advarra Patient I.D. Service at Fargo VA.

See Statement of Work inserted in RFQ

The time of submission of offer, the offeror shall have an active registration in the System for Award Management(SAM) at www.sam.gov. All offerors shall fill out the certificate

Of Limitations of Subcontracting.

Base: 11/01/2025-10/31/2026

Option Year 1: 11/01/2026-10/31/2027

Option Year 2: 11/01/2027-10/31/2028

Option Year 3: 11/01/2028-10/31/2029

Option Year 4: 11/01/2029-10/31/2030

See CONTINUATION Page

437-3660152-5331-841100-2580-0100C0043

437-26-1-5331-0003 x X x 1

Becky De Los Santos

VA-VHA-RPOC-2025-0039

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 STATEMENT OF WORK

B.3 IT CONTRACT SECURITY

B.4 PRICE/COST SCHEDULE

ITEM INFORMATION

B.5 DELIVERY SCHEDULE

SECTION C - CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES (NOV 2023)

C.2 52.216-21 REQUIREMENTS (OCT 1995)

C.3 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.4 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

C.5 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV

2018)

C.6 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020)

C.7 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.8 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (JAN 2025) (DEVIATION FEB 2025)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (SEP 2023)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.3 52.204-29 FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT

ORDERS—REPRESENTATION AND DISCLOSURES (DEC 2023)

E.4 52.216-1 TYPE OF CONTRACT (APR 1984)

E.5 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.6 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (MAY 2024) (DEVIATION

FEB 2025)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: NCO 23 Contracting Officer Department of Veterans Affairs Network 23 Contracting Office 1303 5th St. Suite 300 Coralville, IA 52241

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[ ] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

[ x] a. Quarterly [ ] b. Semi-Annually [ ] c. Other:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

In order to comply with the Improper Payment Elimination and Recovery Act of 2010 (IPERA), the VA has mandated electronic invoice submission to the Veterans Affairs Financial Services Center (FSC).

The VA Financial Service Center (FSC) has partnered with third-party contractor, Tungsten, to transition vendors from paper to electronic invoice submission. Please go to this website:

http://www.tungsten-network.com/US/en/veterans-affairs/ to begin submitting electronic invoices, free of charge.

Vendor e-Invoice Set-Up Information:

Please contact the phone numbers or email address listed below to begin submitting your electronic invoices to the VA Financial Services Center for payment processing, free of charge. If you have questions about the e-invoicing program or Tungsten, please contact the FSC at the phone number or email address listed below:

Tungsten e-Invoice set-up information: 877-489-6135 Tungsten e-Invoice email: VA.Registration@Tungsten-Network.com FSC e-Invoice Contact Information: 877-353-9791 FSC e-Invoice email: vafsccshd@va.gov

More information on the FSC electronic invoicing process can be found at http://www.fsc.va.gov/einvoice.asp.

5. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

http://www.fsc.va.gov/einvoice.asp

B.2 STATEMENT OF WORK

1. INTRODUCTION/BACKGROUND:

a. The Fargo, North Dakota (ND) VA Health Care System (VAHCS) uses Advarra Patient ID system for Patient Identification via a printed wrist band system. The system is integrated with numerous computerized patient record systems and is a highly integral component in the delivery of quality healthcare to our Veteran patients. The system consists of an application installed on specific operator workstations, and wrist band printers slaved to the operator workstations.

1. OBJECTIVE:

a. The objective is to acquire a Firm Fixed Price service contract ( base plus 4 option periods) to maintain the Advarra Patient Identification System at the highest possible level of service, operational capability, and accuracy.

2. SCOPE OF WORK

a. This contract covers Bio-Point Patient Identification System Annual telephone technical support, software maintenance, documentation upgrades, and application upgrades for the period defined in PERIOD OF SERVICE section of this solicitation. The telephone support and software maintenance cover all critical & non-critical incidents including virus problems.

The system currently consists of 5 application workstations, and 5 printers.

b. This telephone support may include remedial instruction on basic system usage, assistance with the performance of routine system procedures as described in the user documentation;

assistance with the application of software patches, maintenance releases and upgrades;

consultation of proposed workflow and system configuration changes, system and application performance tuning, system and application configuration, and changes to group configuration files.

c. The contractor will make remote diagnostic and corrective procedures using a VPN account to connect to the Advarra System at the Fargo VAHCS campus. The contractor shall comply with all information security requirements as outlined in the section VA INFORMATION AND

INFORMATION SYSTEM SECURITY/PRIVACY REQUIREMENTS of this solicitation.

d. The contractor shall perform schedule maintenance as required by the manufacturer and provide quotations for unscheduled maintenance requirements when requested by the

Contracting Officers Representative.

3. SPECIAL REQUIREMENTS:

a. TELEPHONE SUPPORT:

i. Provide Telephone Support in accordance with the Scope of Work during the Normal

Hours of Coverage. Calls not answered immediately shall be responded to within 15 minutes of message receipt, when received during Normal Hours of Coverage.

ii. Action to correct stoppage issues must be initiated within 1 hour of call receipt during normal hours of coverage, all other issues must be initiated within 2 hours of receipt when received during Normal Hours of Coverage.

iii. Normal Hours of Coverage are from 0800 to 2000 EDT, Monday through Friday excluding Federal Holidays.

iv. Federal Holidays observed by the VAHCS are: New Years' Day; Martin Luther King

Day; Presidents' Day; Memorial Day; Juneteenth; Independence Day; Labor Day;

Columbus Day; Veterans' Day; Thanksgiving Day; Christmas Day

b. SOFTWARE AND DOCUMENTATION SUPPORT:

i. The Contractor shall provide Fargo, ND VAHCS with software upgrades and updates as released by the manufacturer. Updates shall include all modifications, (including new features with enhanced functionality, Upgrade installation assistance and user documentation updates) corrections, and enhancements to software applications that the manufacturer makes available to its customers. Updates shall include mandatory updates

(mandated by the manufacturer or to comply with changes in federal or state laws and regulations.

c. SCHEDULED MAINTENANCE (Routine Scheduled Maintenance):

i. The Contractor is responsible for maintaining the Advarra Patient Identification System including, but not limited to, the following in accordance with manufacturer's specifications:

1. APPLICATION ENVIRONMENT: To include but not limited to Application version upgrades including new features and enhanced functionality

2. SYSTEM MANAGEMENT UTILITIES

3. DOCUMENTATION

d. UNSCHEDULED MAINTENANCE (Emergency Repair Service)

i. Response Time: Contractor's technical contact shall respond with a phone call to the COR or his/her designee within four (4) normal business hours after receipt of telephone notification. This unscheduled maintenance may include both telephone support and software support. This includes applications support, making modifications of the system configuration, downloading patient image files, running remote diagnostics of the system hardware and network, and providing applications support with simultaneous telephone conversations.

e. OPERATIONAL UP-TIME REQUIREMENTS:

i. With the exclusion of internal network, server, or computer outages the Advarra Software system shall be operable and available for use 95% of the normal operating hours of the equipment as detailed in this scope of work.

ii. Downtime will be computed from notification of problem during normal work hours.

Scheduled maintenance will be excluded from downtime. Operational Uptime will be computed during a month long time period.

iii. Repeated failure to meet this requirement can subject the contractor to DEFAULT action.

Downtime due to failure of VA to meet its responsibilities in system maintenance will not be counted.

f. REPORTING OF ISSUES REQUIRING SERVICES BEYOND THE CONTRACT SCOPE:

i. The Contractor shall immediately, but no later than 48 (forty-eight) consecutive hours after discovery, notify the CO and COR (ln writing) of the existence or the development of any defects in, or repairs required, to the system which the Contractor considers he/she is not responsible for under the terms of the contract. The Contractor shall furnish the CO and

COR with a written estimate of the cost to make necessary repairs.

4. REPORTS/DELIVERABLES:

a. The Contractor shall provide a report of all calls upon the Contracting Officer’s

Representative.

i. The date and time of the call

ii. The Requestor

iii. The Contractor’s service personnel responding

iv. The nature of the reported problem

v. A summary of the remedies employed to correct the issue.

vi. The date and time of resolution.

b. The report may be provided upon request.

5. ROLES AND RESPONSIBILITIES:

a. Fargo, ND VAHCS will maintain the environmental conditions in accordance with manufacturer's specifications. The Advarra System shall be operated within parameters specified by the manufacturer. The Advarra system shall be accessible via the hospital computer system, and the vendor is required to have a VPN account to access the equipment. Fargo, ND VAHCS will ensure that all data files are adequately duplicated and documented. (The Contractor is not responsible for duplicating and documenting data files.

If any files are lost during Contractor maintenance, the cost of reconstructing this data will not be covered by this contract.)

b. Fargo, ND VAHCS will identify a subject matter expert to act as the system administrator, or someone with equivalent skill. This VA employee shall be responsible for the ongoing maintenance of the Advarra.

c. Fargo, ND VAHCS will ensure that fully qualified service personnel perform all equipment services.

d. Critical incidents - problems affecting a single critical production function of the system, causing the system to operate in a degraded state, or having an adverse financial impact to the Fargo, ND VA Health Care System – shall be reported to the Contracting Officer’s

Representative immediately upon discovery. Conversely, any critical incidents discovered by the Fargo VAHCS staff will be reported to the contractor to ensure awareness of the operational capability of the system.

e. The Government and the Contractor understand and agree that the services to be delivered under this contract by the Contractor to the Government are non-personal services and the parties recognize and agree that no employer-employee or master-servant relationships exist or will exist under the contract between the Government and the Contractor’s employees.

f. No Government personnel, other than the Contracting Officer, have the authority to change or alter these requirements. The COR shall clarify technical points or supply relevant technical information, but no requirements in this scope of work may be altered as a sole result of such verbal clarification.

6. PERIOD OF SERVICE:

a. The base period of the service shall be for a period of 1 year from the date of award, plus 4 option years.

7. ORDERS FOR SERVICES:

a. Personnel authorized by the Contracting Officer shall make requests for service by telephone. Request for services will be made to the telephone number specified by the

Contractor or to a back-up number in the event of no answer at the primary number specified. All contacts from the Contractor will be to the Contracting Officer’s Representative or during non-administrative hours, the Administrative Officer of the Day (AOD) at (701) 239-

3700 extension 9-3400.

b. A list of authorized ordering personnel shall be made available upon award of the contract.

Employees may be added or deleted from the list during the term of the contract at the discretion of the Contracting Officer and the COR. The Contractor shall be notified of such changes as they occur.

8. PRICE SCHEDULE

a. The following price schedule is populated based on market research quotes and anticipated pricing structure of the service as delivered by the Vendor. The following CLINs are an estimate of need; and are not a contractual commitment.

BASE YEAR: November 1, 2025 through October 31, 2026

CLIN Description

Q u a n ti ty

U n it o f

Is s u e it P ri c

E x te n d d

P ri

CLIN000

Bio-Point Patient Identification System

Annual telephone technical support and software maintenance IAW the Scope of

Work. BASE YEAR

1 YR

Base Year Total:

OPTION YEAR 1 : November 1, 2026 through October 31, 2027

CLIN Description

Q u a n it o f

Is s it P ri te n d

CLIN100

Bio-Point Patient Identification System

Annual telephone technical support and software maintenance IAW the Scope of

Work. OPTION YEAR 1

1 YR

Option Year 1 Total:

OPTION 2 : November 1, 2027 through October 31, 2028

CLIN Description

Q u a n it o f

Is s it P ri te n d

CLIN200

Bio-Point Patient Identification System

Annual telephone technical support and software maintenance IAW the Scope of

Work. OPTION YEAR 2

1 YR

Option Year 2 Total:

OPTION 3 : November 1, 2028 through October 31, 2029

CLIN Description

Q u a n it o f

Is s it P ri te n d

CLIN300

Bio-Point Patient Identification System

Annual telephone technical support and software maintenance IAW the Scope of

Work. OPTION YEAR 3

1 YR

Option Year 3 Total:

OPTION 4 : November 1, 2029 through October 31, 2030

CLIN Description

Q u a n it o f

Is s it P ri te n d

CLIN400

Bio-Point Patient Identification System

Annual telephone technical support and software maintenance IAW the Scope of

Work. OPTION YEAR 4

1 YR

Option Year 4 Total:

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY REQUIREMENTS

1. GENERAL

Contract + All Options Grand Total:

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and

VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party services and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and

Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive

Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a

Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security

Clearance must be processed through the Special Security Officer located in the Planning and

National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data -

General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure

VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that

VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records

Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information

Management and its Handbook 6300.1 Records Management Procedures, applicable VA

Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable

Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under

Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate

Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus.

If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to

VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal violations associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5.SPECIALIZED DEVICES/SYSTEMS (MEDICAL DEVICES, SPECIAL PURPOSE

SYSTEMS, RESEARCH SCIENTIFIC COMPUTING).

This entire section applies when the acquisition includes one or more Medical Device, Special Purpose System or Research Scientific Computing Device. If appropriate, ensure selected clauses from section 6 or 7 and 8 through 12 are included.

a. Contractor supplies/delivered Medical Devices, Special Purpose Systems-

Operational Technology (SPS-OT) and Research Scientific Computing Devices shall comply with all applicable Federal law, regulations, and VA policies. New developments require creation, testing, evaluation, and authorization in compliance with processes specified on the Specialized Device Cybersecurity Department

Enterprise Risk Management (SDCD-ERM) Portal, VA Directive 6550, Pre-

Procurement Assessment and Implementation of Medical Devices/Systems, VA

Handbook 6500, and the VA Information Security Knowledge Service. Deviations from Federal law, regulations, and VA Policy are identified and documented as part of VA Directive 6550 and/or the VA Enterprise Risk Analysis (ERA) processes for

Specialized Devices/Systems processes.

b. All contractors and third-party service providers shall address and/or integrate applicable VA Handbook 6500 and Information Security Knowledge Service specifications in delivered IT systems/solutions, products and/or services. If systems/solutions, products and/or services do not directly match VA security requirements, the contractor shall work though the COR/CO for governance or resolution.

c. The contractor shall certify to the COR/CO that devices/systems that have completed the VA Enterprise Risk Analysis (ERA) process for Specialized

Devices/Systems are fully functional and operate correctly as intended.

Devices/systems must follow the VA ERA authorized configuration prior to acquisition and connection to the VA computing environment. If VA determines a new

VA ERA needs to be created, the contractor shall provide required technical support to develop the configuration settings. Major changes to a previously approved device/system will require a new ERA.

d. The contractor shall comply with all practices documented by the Food Drug and

Administration (FDA) Premarket Submission for Management of Cybersecurity in Medical Devices and Postmarket Management of Cybersecurity in Medical

Devices.

e. The contractor shall design devices capable of accepting all applicable security patches with or without the support of the contractor personnel. If patching can only be completed by the contractor, the contractor shall commit the resources needed to patch all applicable devices at all VA locations. If unique patching instructions or packaging is needed, the contractor shall provide the necessary information in conjunction with the validation/testing of the patch. The contractor shall apply security patches within 30 business days of the patch release and have a formal tracking process for any security patches not implemented to include explanation when a device cannot be patched.

f. The contractor shall provide devices able to install and maintain VA-approved antivirus capabilities with the capability to quarantine files and be updated as needed in response to incidents. Alternatively, a VA-approved whitelisting application may be used when the contractor cannot install an anti-virus / anti-malware application.

g. The contractor shall verify and document all software embedded within the device does not contain any known viruses or malware before delivery to or installation at a VA location.

h. Devices and other equipment or systems containing media (hard drives, optical disks, solid state, and storage via chips/firmware) with VA sensitive information will be returned to the contractor with media removed. When the contract requires return of equipment, the options available to the contractor are the following:

(1) The contractor shall accept the system without the drive, firmware and solid state.

(2) VA’s initial device purchase includes a spare drive or other replacement media which must be installed in place of the original drive at time of turn- in;

or

(3) Due to the highly specialized and sometimes proprietary hardware and software associated with the device, if it is not possible for VA to retain the hard drive, firmware, and solid state, then:

(a) The equipment contractor shall have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact.

(b) Any fixed hard drive, Complementary Metal-Oxide-Semiconductor

(CMOS), Programmable Read-Only Memory (PROM), solid state and firmware on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be pre-approved and described in the solicitation, contract, or order.

NARA Records Management Language for Contracts (July 10, 2019) https://www.archives.gov/records-mgmt/policy/records-mgmt-language

RECORDS MANAGEMENT OBLIGATIONS

A. Applicability

This clause applies to all Contractors whose employees create, work with, or otherwise handle

Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes Fago records.

2. Does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their

[Agency] contract.

4. may include deliverables and documentation associated with deliverables.

https://www.archives.gov/records-mgmt/policy/records-mgmt-language

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a).

These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act

(FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for

Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with

Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. Fargo and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of Fargo or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the

Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to [FACILITY]. The agency must report promptly to

NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity.

When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to Fargo control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by

Government and Fargo guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with Fargo policy.

8. The Contractor shall not create or maintain any records containing any non-public Fargo information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The Fargo owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which Fargo shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take [FACILITY]-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

[Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.]

D. Flowdown of Requirements to Subcontractors

1. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

B.3 IT CONTRACT SECURITY

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as

VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and

Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive

Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a

Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security

Clearance must be processed through the Special Security Officer located in the Planning and

National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data -

General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure

VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that

VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media

Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable

Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate

Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus.

If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal…