36C77619Q0108-001.pdf

DRAFT PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration Office of Health Informatics

Services for VHA Governance Support

OHI – VHA Governance Support

1.0 BACKGROUND

The Veterans Health Administration (VHA), Office of Health Informatics (OHI) significant mission element is to provide the VHA Under Secretary for Health with oversight and analysis of the Department of Veterans Affairs (VA) Information Technology (IT) programs and the VA efforts to provide IT services and products to VHA. OHI represents VHA as the business owner who is the customer of VA IT program products and services.

The Investment Governance Services (IGS), Strategic Investment Management Office (SIM) under OHI provides oversight of budget planning activities relative to VHA IT needs, coordinates IT governance functions within VHA, and provides VHA liaison to VA-wide governance. OHI plays an extensive role in the formulation and coordination of business owner input into the VA IT budget formulation process and IT coordination. OHI also represents the IT needs of the VHA program offices, the Veterans Integrated Services Networks (VISNs), and VA medical centers (VAMC) in governance boards within IT and VHA. IGS works collaboratively with other VHA Program Offices, offices in OHI, and other VA Program offices to provide budget analysis at the program and project level to support Healthcare IT.

The VA IT Governance process requires regularly scheduled monthly meetings of board members who represent the IT program managers (VA) and the business owners (VHA and others) especially with regards to the IT/Non-IT Workgroup (ITW).

The Information Technology Committee (ITC) is an authorized committee which falls under thethe highest VHA governance board. The ITC recommends policies, plans, and decisions on the governance of IT resources supporting the VHA. The ITC meets monthly with board members representing VAMCs, VISN offices, and VA central office (VACO).

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement (PWS), the Contractor shall comply with the following:

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. FIPS Pub 201, “Personal Identity Verification of Federal Employees and

Contractors,” March 2006

3. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

4. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

5. Department of Veterans Affairs (VA) Directive 0710, “Personnel Suitability and

Security Program,” May 18, 2007

6. VA Directive 6102, “Internet/Intranet Services,” July 15, 2008

7. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility

Standards,” July 1, 2003

8. OMB Circular A-130, “Management of Federal Information Resources,” November

28, 2000

9. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

10. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, , 2012

11. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” September 20, 2012

12. VA Handbook 6500.1, “Electronic Media Sanitization,” March 22, 2010

13. VA Handbook 6500.6, “Contract Security,” March 12, 2010

3.0 SCOPE OF WORK

The contractor shall provide resources necessary to accomplish tasks and deliverables described in this PWS in support of the VHA IT programs. The contractor’s responsibilities include:

• Analyze, develop, organize and maintain a format to report IT Governance discussions, decisions, action items, and execution.

• Support Committees, Workgroups, and ad hoc partnership meetings between VHA and OIT leadership through topic development, calendar coordination, and reports on action items from the meetings.

• Provide administrative and analytical support to include: attending meetings, presentation preparation, speaker presentation reviews, tracking action items, and overseeing workgroup activities.

• Analyze and report on issues including budgetary requirements, programs, and field funding requirements, and funding policies and directives funding policies and directives particularly Directive 6008, Directive 6550, and IT Appropriation Law, and provide input to federal budgetary documentation for Congress and Office of Management and Budget.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance shall be a twelve (12) month base year, plus three (3) one (1) year option periods, if exercised. Options are exercised at the discretion of the Government based on funding and/or need.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Independence Day July 4 Veterans Day November 11

Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Government site.

Department of Veterans Affairs VA Central Office (VACO) 810 Vermont Ave, NW Washington, DC 20420

4.3 TRAVEL

Travel may be required. Travel costs will be included in the task order award as a separate, direct-reimbursable, “not to exceed” line item.

The contractor must obtain written approval from the project manager (PM) and contracting officer representative (COR) before any travel begins, utilizing the Travel Authorization Request Form. Travel and per diem expenses will be reimbursed on an actual expenditures basis in accordance with Federal Travel Regulations. Travel that occurs without written pre-approval will not be reimbursed.

In order to be reimbursed for travel, the contractor shall submit their invoice with supporting documentation as required in accordance with Federal Travel Regulations. Expenses for subsistence and lodging will reimbursed to the contractor only to the extent where an overnight stay is necessary and authorized by Federal Travel Regulations in effect at the time of the stay for the specific location.

An estimation of travel requirements is listed below. This estimation should be used in developing the Not to Exceed travel price quote by the contractor.

Base Year:

Estimated Locations of VA facilities for base year site visits

Approximate # of trips during period of performance

Approximate # of personnel per trip

Approximate # of days per trip (includes travel)

Orlando, FL

1 1 4 Kansas City, MO 1 1 4 San Diego, CA 1 1 4 Providence, RI 1 1 4

Option Year 1:

facilities for option year 1 site visits

Approximate # of trips during period of performance

Approximate # of personnel per trip

Approximate # of days per trip (includes travel)

Kansas City, MO

1 1 4

San Diego, CA

1 1 4

Providence, RI 1 1 4

Option Year 2:

facilities for option year 2 site visits

Approximate # of trips during period of performance

Approximate # of personnel per trip

Approximate # of days per trip (includes

MO

1 1 4

San Diego, CA

1 1 4

Option Year 3:

facilities for option year 3 site visits

Approximate # of trips during period of performance

Approximate # of personnel per trip

Approximate # of days per trip (includes

MO

1 1 4

San Diego, CA

1 1 4

Contractor travel within the local commuting area will not be reimbursed. See Federal Travel Regulations for specific information on local commuting

5.0 SPECIFIC TASKS AND DELIVERABLES

TASK 5.1 – Attend Veterans Affairs (VA) Information Technology (IT) governance and VA IT budget related meetings and analyze IT governance discussions, decisions, action items, and budget reviews: The VA IT governance process includes regularly scheduled monthly meetings of board members who represent IT program managers (VA) and business owners (Veterans Health Administration (VHA)) and others. Additionally, there are Office of Information and Technology (OIT) sponsored meetings to discuss budget related issues that are supported by VA IT. VHA Office of Health Informatics (OHI) executive managers are the subject matter experts on the IT issues discussed at these meetings. Pre-briefs are provided to VHA member representatives to prepare them for governance and budget related discussions.

The Contractor will attend governance and budget meetings and pre-meetings, and review and analyze associated pre- and post-meeting documentation.

Deliverable 5.1.1: Provide a monthly VA IT governance and budget summary report.

The report will include a summary of items related to VHA IT to include, but not limited to, issues pertaining to VHA programs, such as action items, funding decisions, and next steps required of VHA. The summary report should include relevant discussion points, action items, and recommendations on identified action items as applicable from the material provided for the VA IT governance and budget related meetings. The summary report should include analysis and recommendations based OIT multi-year programming meetings, to include VHA sustainment/infrastructure budget needs, and other associated budget related items, in accordance with applicable federal budget rules and procedures. Report will be provided in PDF file via email.

TASK 5.2 – Support VHA Governance Integration Activities and Governance workgroups:

The Board of Governors (BoG) is the highest governance body within the Veterans Health Administration (VHA) and chaired by the Under Secretary of Health. Directly under the BOG are several committees including the Information Technology Committee (ITC). To support the BoG, ITC representatives participate in meetings such as the Executive Committee (EC), the Resource Committee (RC), and governance workgroups that fall directly under the BoG. The Contractor will provide oversight of BoG committee/sub-committee, and governance workgroup activities, by reviewing agendas, minutes, and action items, and identifying and providing updates and/or recommendations for opportunities for collaboration with the ITC.

Deliverable 5.2.1: Provide a monthly BoG committee/sub-committee summary report that identifies key activities and actions of the BoG committee/sub-committees that are of interest to the ITC. Report will be provided in PDF file via email.

Deliverable 5.2.2: Provide a weekly BoG committee/sub-committee actions items report of action items and due dates with background information of BoG committee/sub-committee meeting or governance workgroup directed tasks to the ITC. Report will be provided in PDF file via email.

Deliverable 5.2.3: Provide a twice yearly BoG committee/subcommittee and governance workgroup activities summary report on BoG committee/subcommittee and governance workgroup activities and action items. Report will be provided in PDF file via email.

TASK 5.3 – Prepare Pre- and Post-meeting packages, agendas and presentations, and aid workgroups for monthly updates to the National Leadership Council (BoG) Information Technology Committee (ITC): The Information Technology Committee (ITC) is a committee under the BoG and is composed of representatives from Veterans Affairs (VA) medical centers, Veterans Integrated Service Network (VISN) offices, and VA central office. The ITC normally meets the first Thursday of every month. The Contractor will provide action planning for ITC meetings and associated leadership boards and workgroups which may include topics such as information technology (IT) releases that pertain to field operations, widespread IT needs from VA Central Office (VACO) and the field, and emergent requirements related to IT budget formulation and execution. The Contractor will attend ITC pre-meetings and the ITC meeting and related meetings.

Deliverable 5.3.1: Provide a monthly ITC meeting agenda. The agenda will include presentation documentation and background information for the ITC agenda items identified. A finalized ITC agenda will be provided NLT 5 business days prior to the ITC meeting. Agenda will be provided in PDF file via email.

Deliverable 5.3.2: Provide a monthly ITC summary report. The report will include activities completed in the preceding month including action planning, facilitation requirements, issues to be resolved, and follow-up reporting. Report will be provided in PDF file via email.

Deliverable 5.3.3: Provide a monthly ITC pre- meeting package which includes the meeting agenda, action items, presentations, and important decision material no later than three business days before the ITC meeting. The pre-meeting package will be uploaded to the ITC SharePoint Site and provided in PDF file via email.

Deliverable 5.3.4: Provide a quarterly workgroup status report on workgroup activities under the ITC. For each workgroup the report shall include, actions/activities that have occurred the past three months, future agenda topics, and ITC related efforts in progress. Report will be provided in PDF file via email.

Deliverable 5.3.5: Provide a monthly post-meeting package which includes action items, presentations, and important decision material no later than ten business days after the ITC meeting. The post-meeting package will be uploaded to the ITC SharePoint Site and provided in PDF file via email.

Task 5.4 – Monitor, analyze and report on VA IT/Non-IT Workgroup (ITW): The ITW is a deliberative body which reviews and interprets policy questions as it relates to Veterans Affairs (VA) Directive 6008, VA Directive 6550, and information technology (IT) appropriation law. The ITW makes recommendations for revisions to applicable directives, and reviews and interprets policy questions and issues identified by business owners. Resulting recommendations are made to the Planning, Programming, Budgeting and Execution Board (PPBEB). Veterans Health Administration (VHA) Office of Health Informatics (OHI) as the business owner’s representative, is responsible for tracking ITW VHA requests to ensure the best interests of VHA are met. Pre-meetings are conducted with business owners presenting issues for consideration. The contractor with attend ITW meetings and support business owner ITW pre-meetings.

Deliverable 5.4.1: Provide a monthly ITW report on outstanding VHA ITW reviews including the progress to date, business owner, and next steps. Report will be provided in PDF file via email.

Deliverable 5.4.2: Provide a quarterly ITW report on ITW related items, determinations, procurement documentation, directive understanding and applicability, and documentation resulting from work with ITW and/or business customers. Report will be provided in PDF file via email.

6.0 GENERAL REQUIREMENTS

6.1 POSITION/TASK RISK DESIGNATION LEVEL(S) AND CONTRACTOR PERSONNEL

SECURITY REQUIREMENTS

6.1.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

Position Sensitivity

Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Security Suitability Program,” Appendix A)

Low

National Agency Check with Written Inquiries (NACI) A NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), FBI name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

Position Sensitivity

Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Security Suitability Program,” Appendix A)

Moderate

Moderate Background Investigation (MBI) A MBI is conducted by OPM and covers a 5-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, law enforcement check; and a verification of the educational degree.

High

Background Investigation (BI) A BI is conducted by OPM and covers a 10-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and a verification of the educational degree.

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements

Task Number Low/NACI Moderate/MBI High/BI

5.1 5.2 5.3

5.4 X

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

6.1.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

b. The Contractor shall bear the expense of obtaining background investigations.

c. Within 3 business days after award, the Contractor shall provide a roster of

Contractor and Subcontractor employees to the COR to begin their background investigations. The roster shall contain the Contractor’s Full Name, Full Social Security Number, Date of Birth, Place of Birth, and individual background investigation level requirement (based upon Section 6.2 Tasks).

d. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

e. For a Low Risk designation, the following forms are required to be completed: 1.OF- 306 and 2. DVA Memorandum – Electronic Fingerprints. For Moderate or High Risk, the following forms are required to be completed: 1. VA Form 0710 and 2. DVA Memorandum – Electronic Fingerprints. These should be submitted to the COR within 5 business days after award.

f. The Contractor personnel will receive an email notification from the Security and Investigation Center (SIC), through the Electronics Questionnaire for Investigations Processes (e-QIP) identifying the website link that includes detailed instructions regarding completion of the investigation documents (SF85, SF85P, or SF 86). The Contractor personnel shall submit all required information related to their background investigations utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP).

g. The Contractor is to certify and release the e-QIP document, print and sign the signature pages, and send them to the COR for electronic submission to the SIC.

These should be submitted to the COR within 3 business days of receipt of the e-QIP notification email.

h. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. If damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

i. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) finger print results, training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and, the signed “Contractor Rules of Behavior.” However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

j. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

k. Failure to comply with the Contractor personnel security investigative requirements may result in termination of the contract for default.

6.2 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: MS Word 2016, MS

Excel 2016, MS PowerPoint 2016, MS Project 2016, MS Access 2016, MS Visio 2016, AutoCAD 2016, and Adobe Postscript Data Format (PDF).

6.3 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Performance Levels for Objectives associated with this effort.

Performance Objective Performance Standard Acceptable Performance Levels

1. Technical Needs

Shows understanding of requirements

Efficient and effective in meeting requirements

Meets technical needs and mission requirements

Offers quality services/products

Satisfactory or higher

2. Project Milestones and Schedule

Quick response capability

Products completed, reviewed, delivered in timely manner

Notifies customer in advance of potential problems

Satisfactory or higher

3. Project Staffing

Currency of expertise

Personnel possess necessary knowledge, skills and abilities to perform tasks

Satisfactory or higher

4. Value Added

Provided valuable service to Government

Services/products delivered were of desired quality

Satisfactory or higher

The Government will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable manner. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion.

Note 1: Significant errors or omissions are defined as deliverables not meeting the intent of the task and the work considered to be within scope of this order.

Note 2: Continued repetitive errors may result in an unacceptable rating on performance report to be used as part of the evaluation criteria on future order competition.

Late Deliverables and/or Significant Errors or Omissions shall be handled in the following manner:

1st Attempt Meets or exceeds all acceptable quality levels and expectations of task/ deliverable

2nd Attempt

Does not meet all acceptable quality levels and expectations of task/ deliverable: 5 days to remedy and resubmit.

3rd Attempt Does not meet all acceptable quality levels and expectations of task/ deliverable: 3 days to remedy and resubmit with 5% deduction off line item price

4th Attempt Does not meet all acceptable quality levels and expectations of task/ deliverable: 1 day to remedy and resubmit with 10% off line item price

5th Attempt Does not meet all acceptable quality levels and expectations of task/ deliverable: The Government may not accept a deliverable that does not meet all acceptable quality levels and expectations of task/ deliverable after the 5th round of revisions from a Contractor. The contract in whole or part may be terminated for cause for failure to perform.

The above QASP is only a sample and may change based on what the Contractor(s) submit in their proposed PWS.

Late deliverables:

a. Deliverables must be provided on the dates specified. Any changes to the delivery date must have prior approval (in writing) by the PM/CO or designate at least five business days prior to the deliverable due date

b. If the deliverable cannot be provided within the scheduled time frame, the Vendor is required to contact the Project Manager/Contract Manager in writing with a reason for the delay and the proposed revised schedule. The request for a revised schedule must include the impact on related tasks and the overall project

c. A request for a revised schedule must be reviewed and approved by the PM/CO before placed in effect. Contract Terms and Conditions may dictate penalties, costs, and other actions based on the facts related to the request for a revised schedule

6.4 QUALITY ASSURANCE SURVEILLANCE PLAN

See S02 Attachment QASP.

6.5 FACILITY/RESOURCE PROVISIONS

The Government will provide office space, telephone service and system access when authorized contract staff work at a Government location as required to accomplish the Tasks associated with this PWS. All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact.

The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

VA will provide access to VA specific systems/network as required for execution of the task via remote access technology (e.g. Citrix Access Gateway (CAG), site-to-site VPN, or VA Remote Access Security Compliance Update Environment (RESCUE)). This remote access will provide access to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, ProPath, Primavera, and Remedy, including appropriate seat management and user licenses. The Contractor shall utilize Government-provided software development and test accounts, document and requirements repositories, etc. as required for the development, storage, maintenance and delivery of products within the scope of this effort.

The Contractor shall not transmit, store or otherwise maintain sensitive data or products in Contractor systems (or media) within the VA firewall IAW VA Handbook 6500.6 dated March 12, 2010. All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this PWS. For detailed Security and Privacy Requirements refer to ADDENDUM A and ADDENDUM B.

6.6 GOVERNMENT FURNISHED PROPERTY

A government furnished laptop will be provided.

ADDENDUM A

A1.0 Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall.

Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the Project Manager, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order.

The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS), and will be tracked therein.

The TMS may be accessed at https://www.tms.va.gov. If you do not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

A2.0 VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

A2.1. VA Internet and Intranet Standards:

The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to: creating announcements;

collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

A3.0 Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508) On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508. These standards have been developed are https://www.tms.va.gov/ https://www.tms.va.gov/ http://www.ea.oit.va.gov/index.asp http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2 http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2 published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

Section 508 – Electronic and Information Technology (EIT) Standards:

The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure Electronic and Information Technology (EIT). These standards are found in their entirety at: http://www.section508.gov and http://www.access-board.gov/sec508/standards.htm. A printed copy of the standards will be supplied upon request. The Contractor shall comply with the technical standards as marked:

_x_§ 1194.21 Software applications and operating systems _x_§ 1194.22 Web-based intranet and internet information and applications _x_§ 1194.23 Telecommunications products _x_§ 1194.24 Video and multimedia products _x_§ 1194.25 Self contained, closed products _x_§ 1194.26 Desktop and portable computers _x_§ 1194.31 Functional Performance Criteria _x_§ 1194.41 Information, Documentation, and Support

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the EIT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

A4.0 Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

A5.0 Confidentiality and Non-Disclosure The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

http://www.section508.gov/ http://www.access-board.gov/sec508/standards.htm

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”).

Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA.

These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA Contracting Officer will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information.

Any request for information relating to this contract presented to the Contractor shall be submitted to the VA Contracting Officer for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract.

Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA Contracting Officer.

5. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

b. Controlled access to system and security software and documentation.

c. Recording, monitoring, and control of passwords and privileges.

d. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

e. VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

f. Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

g. Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

h. Contractor does not require access to classified data.

8. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

ADDENDUM B

APPLICABLE PARAGRAPHS TAILORED FROM: THE VA INFORMATION AND

INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6,

APPENDIX C, MARCH 12, 2010

B1. GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

B2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with

VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The Contractor or Subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ. The Contracting Officer must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

B3. VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2. VA information should not be co-mingled, if possible, with any other data on the

Contractors/Subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA information is returned to VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of Contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3. Prior to termination or completion of this contract, Contractor/Subcontractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a Contractor/Subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

4. The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies.

If Federal or VA information confidentiality and security laws, regulations and policies become applicable to VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

5. The Contractor/Subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

6. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

7. If a VHA contract is terminated for cause, the associated Business Associate Agreement

(BAA) must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

8. The Contractor/Subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

9. The Contractor/Subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA minimum requirements. VA Configuration Guidelines are available upon request.

10. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA prior written approval. The Contractor/Subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

11. Notwithstanding the provision above, the Contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus.

If the Contractor/Subcontractor is in receipt of a court order or other requests for the above mentioned information, that Contractor/Subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

12. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or a Memorandum of Understanding- Interconnection Service Agreement (MOU-ISA) for system interconnection, the Contractor/Subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

B4. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

a. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, Contractors/Subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The Contractor’s security control procedures must be equivalent, to those procedures used to secure VA systems. A Privacy

Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA network involving VA information must be reviewed and approved by VA prior to implementation.

b.…