RFP 36C77620R0008 Amendment 0002.docx

5. PROJECT NUMBER (if applicable)

CODE

7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER

3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO.

1. CONTRACT ID CODE

FACILITY CODE

CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office.

is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER

16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30

PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) (such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

07-14-2020

N/A Y 00776 Department of Veteran Affairs

PCAC-ST. LOUIS

4401-D Meramec Bottom Rd Saint Louis MO 63129

Y 00776 Department of Veterans Affairs

PCAC-ST. LOUIS

4401-D Meramec Bottom Rd St. Louis MO 63129 To all Offerors/Bidders

36C77620R0008 06-26-2020

X

The purpose of this amendment is to provide the responses to questions received from the posted Request for Proposal 36C77620R0008.

When submitting your proposal all amendments must be acknowledged.

Please see responses provided below.

CONTINUATION PAGE

E.1 INSTRUCTIONS TO OFFERORS

The Department of Veterans Affairs is issuing a Full and Open Competitive solicitation for HCCH HIPAA Insurance Identification and Verification. The North American Industry Classification System (NAICS) code for this acquisition is 518210, Data Processing, Hosting, and Related Services, size standard is $32,5000,000.00. One firm fixed price Indefinite Delivery Indefinite Quantity (IDIQ) contract will be awarded with a base ordering period of 60 months. The VA intends on issuing a task order against this IDIQ after award is made.

SUBMISSION OF PROPOSALS: All proposals must be submitted electronically, via email, to the attention of the Contracting Officer/Contract Specialist Terry Hester and John Schiffhauer / Terry.Hester@va.gov and John.Schiffhauer@va.gov. Proposals must be received no later than 2:00PM Eastern Standard Time (EDT) on July 22, 2020.

QUESTIONS: All questions regarding the solicitation of a contractual nature or technical nature, must be submitted via email to John.Schiffhauer@va.gov no later than 2:00p.m. EDT July 7, 2020. The subject line of the email shall start with the RFP Reference Number 36C77620R0008 and HCCH HIPAA Insurance Identification and Verification Requirement. Questions with the Government’s responses will be posted no later than 2:00 p.m. EDT July 14, 2020. Be advised that the government reserves the right to transmit those questions and answers of a common interest to all prospective Offerors.

WARNING: Please do not wait until the last minute to submit your proposals! Late proposals will not be accepted for evaluation. To avoid submission of late proposals, we recommend the transmission of your proposal file 24 hours prior to the required proposal due date and time. Please be advised that timeliness is determined by the date and time an Offeror’s proposal is received by the Government not when an Offeror attempted transmission. Offerors are encouraged to review and ensure that sufficient bandwidth is available on their end of the transmission.

This RFP is does not authorize performance or obligate the Government for any costs incurred by the offeror for this requirement. The Government reserves the right not to award a contract in response to this RFP. Prior to commencement of any activities associated with performance of this requirement, the Government will issue a written directive or contractual document to be signed by the Awarded Contractor with appropriate consideration established. The Government reserves the right to cancel this solicitation, with no obligation to the contractor by the Government

OFFEROR’s PROPOSAL shall be submitted in accordance with the following instructions:

1. Format: The proposal shall be in Arial or Times New Roman fonts. Characters shall be set at no less than normal spacing at 100% scale. Font size shall be no smaller than 11-point. The response must be submitted with each Volume being a single application-generated (not scanned) PDF document. The totality of the proposal shall be less than or equal to 7MB in size. Document will be separated into five Volumes: Volume I – Cover Page and Completed RFP; Volume II- Technical; Volume III-Past Performance; Volume IV-Service-Disabled Veteran Owned Small Business/Veteran Owned Small Business: Volume V-Price.

1. Content Requirements:

Cover Page shall include:

1. Notice Number (36C77620R0008);

1. Company Name, mailing address, and website address;

1. Date submitted and proposal expiration date;

1. Company Point of Contact (Name, Phone Number, email address);

1. Company Data Universal Numbering System (DUNS) Number;

1. Company Business Size;

1. Company Business type (i.e., Service-Disabled Veteran-Owned Small Business);

1. Company’s Federal Supply Schedule (FSS) Contract (If applicable). Provide the GSA Contract Number and relevant Special Item Number(s) (SINs) applicable to this requirement.

1. Volume I- Completed RFP

1. Volume II- Technical will include:

D1. Accreditations D2. Payer Connectivity D3. Technical Capability

1. Volume III- Past Performance will include:

E1. Past Performance F. Volume IV – Service-Disabled Veteran Owned Small Business / Veteran Owned Small Business (VAAR 852.215-70) G. Volume V- Price will include:

F1. Completed Bid Schedule

E.2 BASIS FOR AWARD

This acquisition will utilize the Tradeoff source selection procedures in accordance with Federal Acquisition Regulation (FAR) 15.101-1 and 15.3 as supplemented by the Veterans Affairs Acquisition Regulation (VAARS) 815.300, to make an integrated assessment for a best value award decision. These regulations are available electronically at acquisition.gov.

The Government will select the best overall offer, based upon an integrated assessment of Technical, Past Performance, Service Disabled Veteran Owned Small Business/Veteran Owned Small Business, and Cost/Price IAW FAR 15.101-1(b)(2) All evaluation factors other than Cost or Price, when combined, are significantly more important than Cost or Price.

A contract may be awarded to the offeror who is deemed responsible in accordance with the FAR, as supplemented, whose proposal conforms to the solicitation's requirements (to include all stated terms, conditions, representations, certifications, and all other information required by Section E.2 of this solicitation) and is based on the evaluation factors and subfactors to represent the best value to the Government. The Government seeks to award to the offeror who gives the VA the greatest confidence that it will best meet, or exceed, the requirements. This may result in an award to a higher rated, higher priced offeror, where the decision is consistent with the evaluation factors, and the Source Selection Authority (SSA) reasonably determines that the technical and/or past performance of the higher price offeror outweighs the cost difference.

The SSA will base the source selection decision on an integrated assessment of proposals against all source selection criteria in the solicitation (described below). While the Government source selection evaluation team and the SSA will strive for maximum objectivity, the source selection process, by its nature, is subjective; and therefore, professional judgment is implicit throughout the entire process. The Government intends to award one (1) IDIQ contract as a result of this solicitation.

Offerors must submit the following requested information to be used in evaluating their offer:

Completed RFP - Completed RFP shall consist of the completed and signed RFP, to include any amendments issued, with a letter delineating any exceptions taken to the RFP terms and conditions with accompanying rationale. However, offerors are cautioned that any noncompliance with the terms and conditions of the RFP may cause their proposal to be determined not eligible for award. Offerors shall ensure that all clauses and provisions that require "fill in" information are appropriately completed.

Factor I- Technical Competence The Technical Factor is a combined rating of Sub-Factors I, II, and III below.

Sub-Factor I: Accreditations The Offeror shall be evaluated to determine the following accreditation requirements have been met or tangible evidence is provided to document the requirements will be met by solicitation close date. The purposes of accreditation, all contractors (Prime and any and all Sub-Contractors) participating in the contract are required to obtain and maintain both certifications in both categories A-(Either 1. EHNAC HNAP-EHM or 2. The VA Authority to Operate (ATO)), and B- CAQH CORE, no exceptions will be granted.

To meet the requirement of category A below, the prime contractor and all sub-contractors or teaming arrangement must demonstrate a certificate of either option 1 or option 2, but are not required to have both;

A. EHNAC HNAP-EHN:

1. (Option 1) Shall be fully “Accredited Healthcare Network” (HNAP-EHN) by the Electronic Healthcare Network Accreditation Commission (EHNAC) (https://www.ehnac.org)

OR

2. (Option 2) Adherence to all VA security and data privacy requirements as outlined by the General Security Requirements section to have a full Veterans Administration (VA) Authority to Operate (ATO).

To meet the requirement of category B below, the prime contractor and all sub-contractors or teaming arrangements must demonstrate a certificate (not simply endorsement) of;

B. CAQH CORE: The prime contractor and all sub-contracted entities shall be certified by the Council for Affordable and Quality Healthcare (CAQH) (https://www.caqh.org/core/operating-rules), as a CORE Phase II Certified trading partner for both batch and real-time HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271.

Sub-Factor II: Payer Connectivity The Offeror shall provide documentation demonstrating its ability to provide VA with HIPAA transaction services for the insurance carriers/payers listed in the Performance Work Statement (PWS). The contractor will include their existing payer connections, listing all insurance carriers/payers with whom VA may conduct transactions. To include A. HIPAA 270/271 Transactions identified in Attachment D of the PWS.

B. Insurance Coverage Discover Transactions identified in Attachment J of the PWS.

Sub-Factor III: Technical Capability The contractor shall demonstrate their approach to proposed solutions and demonstrate their ability to perform the type of work described in the PWS, to include;

A. Understanding the Requirement B. Methodology C. Transaction Preparedness

a. The Offeror’s proposal shall contain definitive evidence indicating readiness to conduct HIPPA 270/271 transactions on day one of the contract effective date.

b. The Offeror’s proposal shall contain definitive evidence indicating readiness to conduct insurance coverage discovery activities on day one of the contract effective date.

c. The Offeror’s proposal shall contain definitive evidence indicating system preparedness to conduct insurance coverage discovery transactions structured that can be received from VA and transmitted back to VA in the manner outlined in Attachment L – Insurance Coverage Discovery Interface. i.e.: The Vendor’s system is already programmed to begin exchanging customized transactions in the format described in Attachment L.

Factor II – Past Performance The Offeror shall demonstrate successful past performance by providing recent and relevant past performance information on a maximum of 3 (three) contracts, for work completed within 3 (three) years prior to June 1, 2020. Relevant past performance is defined as contracts completed similar in scope as the PWS and at a minimum valued at $1.0 Million per year. Include the following information for each Contract and Sub-Contract submitted:

0. Name of the Contracting Agency

0. Contract Number

0. Contract Title

0. Brief Description of Contract/Sub-Contract and Relevance of this Requirement

0. Total Contract Value

0. Contract Type

0. Period of Performance

0. Contacting Officer and Telephone Number

0. Program Manager or Project Officer, and Telephone Number

Offerors are required to explain what aspects of each contract are deemed relevant to scale and cost as related to the requirements of this solicitation. Failure to provide required relevancy description may impact the confidence rating. If in a teaming arrangement or joint venture with no combined past performance, contracts from either/both team members can be submitted not to exceed three (3) total contracts with at least one (1) contract from each team member.

Factor III – Service-Disabled Veteran Owned Small Business / Veteran Owned Small Business The Government will assign evaluation credit for an Offeror (prime contractor) which is a Service-Disabled Veteran-Owned (SDVOSB) or a Veteran-Owned Small Business (VOSB). Non-SDVOSB/VOSB Offerors proposing to use SDVOSBs or VOSBs as subcontractors will receive some consideration under this evaluation Factor.

(1) For SDVOSBS/VOSBs: In order to receive credit under this Factor, an Offeror shall submit a statement of compliance that it qualifies as a SDVOSB or VOSB in accordance with VAAR 852.215-70, Service-Disabled Veteran-Owned and Veteran-Owned Small Business Evaluation Factors (DEVIATION). Offerors are cautioned that they must be registered and verified in Vendor Information Pages (VIP) database (http://www.VetBiz.gov) and must meet federal small business size standards for the NAICS code assigned to this solicitation at time of both proposal submission and at time of award.

(2) For Non-SDVOSBs/VOSBs: To receive some consideration under this Factor, an Offeror must state in its proposal the names of SDVOSB(s) and/or VOSB(s) with whom it intends to subcontract and provide a brief description and the approximate dollar values of the proposed subcontracts. Additionally, proposed SDVOSB/VOSB subcontractors must be registered and verified in VIP database (http://www.VetBiz.gov) in order to receive some consideration under the Veteran’s Involvement Factor and must meet federal small business size standards for the NAICS code assigned to this solicitation at time of proposal submission and time of award.

Factor IV – Price The contractor shall provide a fixed transaction rate per line item, at the different transaction type levels on the attached Bid Schedule provided.

The Contracting Officer has determined there is a high probability of adequate price competition in this acquisition. Upon examination of the initial offers, the Contracting Officer will review this determination and if, in the Contracting Officer's opinion, adequate price competition exists no additional cost information will be requested and certification under FAR 15.406-2 will not be required. However, if at any time during this competition the Contracting Officer determines that adequate price competition no longer exists, offerors may be required to submit information to the extent necessary for the Contracting Officer to determine the reasonableness and of the price.

Responses to Questions received from RFQ 36C77620R0008

1. Can you please provide the primary contract’s current contractor’s name and contract number?

a. VA utilizes Change Healthcare contract #VA777-17-D-0006 as our primary EDI clearinghouse. Solicitation 36C776R0008 is for a new requirement not a follow-on solicitation. VA is seeking a HIPAA EDI clearinghouse to process electronic X12 HIPAA 270/271 transactions and customized electronic transactions to search for patient insurance.

2. Can you please provide the contractor name and contract number for the contractor performing this secondary HCCH role today?

a. Gi4, LLC contract # 36C776-20-C-0026

3. Is the current contractor eligible to compete for this solicitation?

a. This requirement is being solicited as Full and Open competition.

4. Who is the primary contract Contractor referenced under D.1 Performance Work Statement, 2. Background, page 43?

a. VA utilizes Change Healthcare contract #VA777-17-D-0006 as our primary EDI clearinghouse. This solicitation is a new requirement not a follow-on solicitation. VA is seeking a HIPAA EDI clearinghouse to process electronic X12 HIPAA 270/271 transactions and customized electronic transactions to search for patient insurance.

5. Will the secondary contract Contractor be expected to interface with the primary contract Contractor referenced above?

a. No. VA utilizes Change Healthcare contract #VA777-17-D-0006 as our primary EDI clearinghouse. The Contractor selected under this solicitation will not be required to interface with Change Healthcare.

6. Can the primary contract’s Contractor referenced above bid on this RFP?

a. This requirement is being solicited as Full and Open competition.

7. Under D.1 Performance Work Statement, 2. Background, page 43 the RFP states “This secondary Contract will transmit only HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271 transactions for various Payers.” Who are these “various Payers”- all of those listed in Attachments D, E, J, and K of the RFP?

a. Yes. Payers are listed in Attachments D, E, J, and K of the RFP.

8. Are any of the payers listed in Attachments D, E, J, and K already connected to the primary contract Contractor?

a. This solicitation is a new requirement not a follow-on solicitation. VA is seeking a HIPAA EDI clearinghouse to process electronic X12 HIPAA 270/271 transactions and customized electronic transactions to search for patient insurance for the payers listed in Attachments D, E, J and K.

9. Are projected transaction volumes listed in Attachment C – Projected Transaction Volumes annual volumes or volumes projected for the 60-month base period?

a. Attachment C displays transaction volume estimates broken down by annual volume across the 60-month ordering period.

10. Could the chosen contractor utilize trading partner and other clearinghouses to clear transactions to the list of Payers or is VHA looking for the contractor to have direct connections with each of the Payers?

a. Commercial EDI clearinghouses may utilize direct payer connections or trading partners to provide transaction services for the payers listed in Attachments D, E, J and K. Be aware, all Contractors who participate in transactions must meet the accreditation requirements of the RPF and outlined in Attachment M.

11. Are all eligibility transactions coming from the Financial Service Center or other data sources?

a. All X12 HIPAA 270 transitions will come from the Financial Service Center in Austin, TX and all X12 HIPAA 271 transactions shall be delivered to the Financial Services Center in Austin, TX.

12. Is the VA seeking a pure transactional solution (x12)? Or would you consider a response that includes web-based UI/workflow?

a. VA is seeking a HIPAA EDI clearinghouse to process electronic X12 HIPAA 270/271 transactions and customized electronic transactions to search for patient insurance. VA is not seeking web-based or user interface solutions.

13. If this is transactional, does the VA have pre-existing tech or connectivity requirements?

a. Yes. Please reference Section 10 of the PWS inside the RFP for standard HIPAA requirements, accreditation requirements (Attachment M) and customized electronic transactions to search for patient insurance (Attachment L). VA utilizes CAQH CORE Phase II v5010 Operating Rules connection requirements.

14. Are you looking to submit via X12, or would you be looking for an API based transaction?

a. VA is seeking a HIPAA EDI clearinghouse to process X12 HIPAA 270/271 transactions and customized electronic transactions to search for patient insurance. VA is not seeking API based solutions.

15. In the PWS, you state you require real-time and batch for insurance coverage discovery. Do you expect the vendor to do both processing methods? Or, can a vendor do one?

a. All deliverables specify real-time transactions, however if insurance coverage discovery cannot be completed within the standard real-time HIPAA specification, accommodations for intermediary transactions to retrieve insurance coverage discovery responses can be utilized (PWS 10.15) and are described in Attachment L.

16. If yes, please define real-time (e.g., turnaround time requirements)? In addition, help us understand why real-time insurance discovery is necessary vs. a batch process where results are typically returned within 24 hours?

a. Standard HIPAA real-time specifications are documented in CAQH CORE Phase I Eligibility and Benefits Real Time Response Time Rule and required in CAQH CORE Phase II Operating Rules. All deliverables specify real-time transactions, however if insurance coverage discovery cannot be completed within the standard real-time HIPAA specification, accommodations for intermediary transactions to retrieve insurance coverage discovery responses can be utilized (PWS 10.15) and are described in Attachment L.

17. If the VA’s usage of “par” and “non-par” follow the industry-standard terminology of transactions being sponsored by payers (or not), what does the VA mean by “standard” payers?

a. Par = Participating, Non-Par = non-participating, and standard reflect nomenclature assigned to three categories of charges historically experienced by VA. Naming conventions could also be generic in Tier 1, Tier 2, Tier 3; where each payer is assigned a tier rate and all transactions to that payer are charged at the corresponding tier rate. Each tier could carry a different per transaction charge rate.

18. In the evaluation factors these three items are listed under Factor III, can the VA clarify the distinction between items b. and c.?

a. Factor III refers to Service-Disabled Veteran Owned Small Business / Veteran Owned Small Business considerations, thus VA assumes the question refers to Factor I – Technical Competence, Sub-Factor III – Technical Capability, A. Understanding, B. Methodology and C. Transaction preparedness.

Sub-Factor III: Technical Capability

1. The Offeror’s proposal shall contain definitive evidence indicating system preparedness to conduct insurance coverage discovery transactions structured in the manner outlined in Attachment L – Insurance Coverage Discovery Interface. i.e: The vendor’s system is already programmed to begin exchanging customized transactions in the format described in Attachment L.

19. Attachments G, H and I require reports that break the totals down by CPAC/VISN/Station “provided by VA”, but doesn’t say what data will be provided or how the clearinghouse would determine the CPAC/VISN/Station using the limited data available in the customized EICD request. Respondents need to understand how this is to be accomplished in order to accurately price implementation development work, so please describe the information VA will provide for this task and how it translates from the requests/responses to the reports.

a. Each VA station carries a unique name and institutional NPI value transmitted in the 2100B/NM1 of the EICD request (as demonstrated in Attachment L). VA will supply these values in each of the EICD request messages and expects that value to be echoed back in each EICD response message. VA will also supply the organizational structure of each station as it relates to the specified VISN and CPAC assignment for report building. VISN and CPAC assignments for each VA station are not expected to change during the contract period.

20. Please define primary and secondary for insurance discovery vendors.

a. VA utilizes Change Healthcare contract #VA777-17-D-0006 as our primary EDI clearinghouse. The Change Healthcare contract does not contain insurance discovery services. This solicitation is a new requirement not a follow-on solicitation. VA is seeking a HIPAA EDI clearinghouse to process electronic X12 HIPAA 270/271 transactions and customized electronic transactions to search for patient insurance.

21. For coverage discovery is the VA seeking to “stack” vendors in sequential order for self-pay discovery?

a. No. VA utilizes Change Healthcare contract #VA777-17-D-0006 as our primary EDI clearinghouse. VA is seeking a HIPAA EDI clearinghouse to process electronic X12 HIPAA 270/271 transactions and customized electronic transactions to search for patient insurance.

22. What is the effective date of this award? For example, what date will the contract begin?

a. VA expects contract effective date is September 1, 2020 or the date of award if award is made after September 1, 2020.

23. Amend 1, page 3 of 8, section A states that the response must be submitted as a single PDF document. It further states that the document will be separated into three volumes. However, four volumes are listed (I-IV). Additionally, Sections C-G were modified, but list a completely different set of volumes from what is in Section A. It also includes a Volume III SDVOSB/VOSB volume which was removed in Section A.

a. The Amendment 0001 incorrectly changed the Instructions to Offerors section. Amendment 0001 only changes the proposal due date to 22 July 2020. The corrected Instructions to Offerors has been included in this Amendment 0002.

24. If our product is CAQH CORE Phase II certified, do we also need organizational accreditation?

a. CAQH CORE Phase II certification is required and must be documented via www.caqh.org. CAQH CORE certifies and awards CORE Certification Seals to entities that create, transmit or use the administrative transactions addressed by the CAQH CORE Operating Rules. CORE Certification means an entity has demonstrated that its IT system or product is operating in conformance with the CAQH CORE Operating Rules for a specific transaction.

25. Also, does adherence to the outlined general security requirements grant us an ATO or do we need to obtain an ATO?

a. No. Simply adhering to the general security requirements listed in the PWS does not in itself grant a VA ATO. An ATO is only granted after documentation, submission and evaluation by VA Authorizing Official (AO) in compliance with the guidelines developed by the National Institute for Standards and Technology (NIST) as documented in VA Directive 6500, VA Handbook 6500 and subsequent chapters. All Contractors must either obtain a VA ATO or have an EHNAC accredited healthcare network HNAP-EHN certification as outlined in Attachment M.