Attachment 1 PWS 36C77625Q0083 v1-31-2025.docx

NDS HIA Services

HIG20-25

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Digital Health Office (DHO), Office of Health Informatics (OHI)

Health Information Governance (HIG) National Data Systems (NDS)

National Data Systems (NDS) Health Information Access (HIA) Services

HIG20-25

Date: 1/31/25 PWS Version Number: 2.3

Contents

BACKGROUND

National Data Systems (NDS) is responsible for ensuring that access to health information is managed in accordance with VA policy and Federal law, including the Privacy Act of 1974, http://www.justice.gov/opcl/privstat.htm and the Health Insurance Portability and Accountability Act (HIPAA) http://www.hhs.gov/ocr/privacy/. NDS is located within Veterans Health Administration (VHA) Digital Health Office (DHO) Health Information Governance (HIG). NDS manages the development and implementation of policy, regulation, and training around individuals accessing health information.

NDS manages all national health information data access requests as well as data queries and supports the reporting of VHA health information access, file extracts, Data Use Agreements (DUAs), and other related data access agreements. NDS responds to multiple requests for access to many of VHA’s health information systems, including Electronic Health Records (EHRs), national databases, and extracted datasets. The goal of NDS is to provide those who serve Veterans, proper access to the informational resources they need, while always maintaining the privacy and security of Veterans’ health information. Access may be required on a temporary or long-term basis.

NDS is the central program for managing, tracking, and approving all VHA data access requests to many of VHA’s health information resources. NDS approves user access to national data which contains Personal Health Information (PHI) to include the Veteran’s social security number. NDS fulfills requests from VHA health information resources to various Government customers including, but not limited to, clinicians, program offices, researchers, government oversight organizations. Non-Government customers include but are not limited to Veteran Service Organizations (VSO) access in order to advocate for Veterans with their claims for benefits. NDS is involved in data access activities and initiatives which manage the development and implementation of policy, regulation, training and the evaluation and monitoring of trending, and reporting on data access performance.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following (Check each of these):

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”

3. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

4. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program"

7. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/

12. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, https://www.va.gov/vapubs/

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2011

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide, February 2024

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA CYBER SECURITY PROGRAM,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Directive 6500, “VA Cybersecurity Program” January 23, 2019

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, June 30, 2023

24. VA Handbook 6500, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program,” October 15, 2024

25. VA Handbook 6500.6, “Contract Security,” March 12, 2010

26. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

27. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. Privacy Threshold Analysis (PTA) and Privacy Impact Assessment (PIA) Informational Guide

31. VA Handbook 6510, “VA Identity Credential and Access Management”, September 27, 2024

32. VA Directive 6300, Records and Information Management, September 21, 2018

33. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

34. NIST SP 800-37 Rev 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018

35. NIST SP 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations, September 2020

36. OMB Memorandum, “Transition to IPv6”, September 28, 2010

37. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

38. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

39. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

40. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

41. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

42. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

43. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

44. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

45. NIST SP 800-116 Rev.1, Guidelines for the Use of PIV Credentials in Facility Access, June 2018

46. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

47. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

48. NIST SP 800-157 Rev.1, Guidelines for Derived Personal Identity Verification (PIV) Credentials, November 14, 2024

49. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

50. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

51. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

53. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

54. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, July 19, 2017, https://www.cisa.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

55. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

56. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

57. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

58. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

59. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

60. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

61. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

62. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

63. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

64. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

66. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

68. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. “Veteran Focused Integration Process (VIP) Guide 4.0”, March 2021 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=27 “VIP Release Process Guide”, Version 2.0, October 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=27 “POLARIS User Guide”, Version 1.9, March 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=27 VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

70. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September 15, 2017. https://www.va.gov/files/2025-01/%237%20VA%20Rules%20of%20Behavior%20Org%20Users%20FY25.pdf

71. SOP BAA Management 2018

72. SOP Healthcare Operations Access (HOA) Requests August 2023

73. SOP Power of Attorney (POA) May 2020

74. SOP Research Requests DART February 2020

75. SOP Compensation & Pension Interchange (CAPRI)/Joint Longitudinal Viewer (JLV) August 2023

76. SOP Veteran Service Officer (VSO) Compensation & Pension Records Interchange (CAPRI) Forms February 2020

SCOPE OF WORK

The Contractor shall provide all labor, supervision and other resources required to deliver professional and technical services, to the NDS Program Office. These services include support for VHA health information user access management, and support for the Business Associate Agreement program.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance shall be a twelve (12) month base period, with four (4) twelve (12) month option periods.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities.

Work may be performed at government site with prior approval of the Program Manager and Contracting Officer. Government onsite space is limited to one space at VACO in Washington, DC.

a) Hours of service - Contractor shall provide service during normal business hours from 8:00 A.M. to 4:30 P.M. local time, Monday through Friday.

In addition, Temporary Duty Assignments (TDY) to a Government facility within the effort doesn’t change the Place of Performance to the Government Site.

TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the mandatory tasks and provide the specific deliverables described below within the performance period stated in this Performance Work Statement. If for any reason, any deliverable cannot be delivered on time according to the below schedule, the Contractor shall provide a written explanation to the Program Manager, Contracting Officer Representative (COR) and Contracting Officer (CO) as soon as discovered, but not later than three business days prior to deliverable due date. This written transmittal shall include a firm commitment of when the work shall be completed. This transmittal shall cite the reasons for the delay, and the impact on the overall project.

VHA User Access Management and Support The Contractor shall manage regional (Veteran Integrated Service Networks – VISNs) and national access to VHA health information resources. These services include data access requests, data access process support and business associate agreement support.

NDS customers include, but are not limited to, clinicians, researchers, peer reviewers, legal reviewers, and Veteran Service Organizations (VSO).

The Contractor shall be involved in information gathering and documentation development related to VHA data access. The Contractor shall assist with continuous improvement of existing processes and tools for VHA data access on a quarterly basis. The Contractor shall assist NDS in managing new initiatives or innovations that improve how VA processes VHA Data Access requests, which is driven by customer need. At a minimum, supervisory and/or lead Contractor staff shall regularly participate in all designated weekly, monthly, and ad hoc staff, workgroup, and access-related meetings and/or conference calls.

Data Access Requests (An option CLIN with additional quantities will be included in the schedule).

The contractor shall review all data access requests to ensure all required paperwork has been submitted and meets VHA policy requirements for data access approval. The Contractor shall be responsible for all processes in the provisioning of access to VHA data based on the data sources requested and enter the requests into a VA developed tracking system. All data access requests shall involve customer service-based interaction, with timely feedback to end users about status of request, missing documentation, and when the requestor may expect data after request is approved. Contractor must complete all requests within three business days from the date of receipt and comply with the standard operating procedures (SOP).

Refer to the associated standard operating procedures for additional detail. Please note the referenced SOP attachments may not be reflective of the actual level of effort involved.

Reference Attachments:

· SOP Healthcare Operations Access (HOA) Requests August 2023

· SOP Compensation & Pension Interchange (CAPRI)/Joint Longitudinal Viewer (JLV) August 2023

· SOP Veteran Service Officer (VSO) Compensation & Pension Records Interchange (CAPRI) Forms February 2020

· SOP Power of Attorney (POA) May 2020

· SOP Research Requests DART February 2020

· SOP BAA Management 2018

In support of ensuring adherence to NDS User Access Management processes, the Contractor shall conduct a quality assurance review to ensure appropriate access administration was completed accurately and in accordance with standard operating procedures.

The contractor shall be required to assist with compiling monthly statistics of user demographics and frequency of requests seeking special access to VA health information resources. The Contractor shall track all open, closed, and pending actions taken in existing VA system or platform under this task.

Historical/Projected Workload Data:

Provided below is a chart identifying projected data of volume of requests for each task 1 workload category. This information is based on reporting matrix within the organization.

This information is provided as data to be utilized for information purpose only. Some contract staff below are cross utilized within multiple workload categories.

NDS Workload Projections

Deliverables 5.1:

Contractor shall complete all data access requests as described and also provide in a monthly progress report, VHA User Access Management tasks and documentation support to include the quantities for each workload category to the VHA COR and PM. This report shall contain:

· NDS User Access Management Status of open, closed, and pending requests for each workload type

· All open, closed, and pending actions taken during the Quality Assurance Review

· All open, closed, and pending actions on Help Desk Support items

· Log of attended meetings/conference calls

· Acknowledgement of quality assurance review completion

Deliverable 5.1.1 (Quantities for each) must be completed within three business days from the date of receipt and comply with the standard operating procedures (SOP):

A. Healthcare Ops Access B. CAPRI/Joint Longitudinal Viewer C. Power of Attorney D. Research – Data Access Request Tracker (DART) Business Associate Agreement (BAA) Support (An option CLIN with additional quantities will be included in the schedule).

The Contractor shall provide administrative support to the VHA Business Associate Program Manager (PM). The Contractor shall provide the updated status in response to email and telephone inquiries regarding the progression of each Business Associate Agreements (BAA) action. These actions include but are not limited to the initial profile application step, scoring the risk analysis worksheet, preparing draft BAA documents for PM review, acquiring appropriate signatures (Business Associate and VHA), scanning completed agreements and archiving (upload into database), setting meetings with vendors, follow up with non-responsive vendors (email and phone calls), and other BAA administrative tasks that result from the above duties. The Contractor shall assist with managing and updating the BAA databases and trackers. Reference attachment for SOP BAA Management. NDS currently has approximately 467 active BAAs in the database. The contractor shall attend weekly BAA status meetings via phone with the VHA Business Associate Agreement PM.

Task 5.2 Historical/Projected Data:

Based on historical data, the Government estimates that one (1) FTE can support the following BAA transactions. Note: During the Period of Performance (PoP) May 2023 through April 2024 the following transactions were completed. This historical data is based on available PoP data with the understanding that transactions can fluctuate.

May 2023 – Apr 2024

Deliverables 5.2 must comply with the standard operating procedures (SOP):

Contractor shall provide administrative support as described and also provide in a monthly progress report a monthly status report of BAA Support to include the quantities for each BAA action to the VHA COR, PM, and BAA Reviewer. The Business Associate Reviewer will review and validate data input against information contained in the BAA Tracker. This report shall contain:

A. BAAs Reviewed (quantities) B. BAAs Executed (quantities)

Support for each BAA transaction includes the following administrative tasks and are consistent for each BAA transaction:

· Emailing clients with attachments to include Business Associate Profile Questionnaires, draft BAAs, final BAAs, partially executed Business Associate Agreement Termination Letters and fully executed Business Associate Termination Letters within 2 business days of from date of last contact or action taken on the file

· Follow up status emails to clients within 10 business days of from date of last contact or action taken on the file

· Emailing Business Associate Agreement PM with attachments to include Business Associate Profile Questionnaires, draft BAAs, final BAAs, partially executed Business Associate Agreement Termination Letters and fully executed Business Associate Termination Letters within 2 business days of last action or contact taken on the file

· Phone calls to clients for status updates within 20 business days of last contact or action taken on the file

· Scoring the Business Associate Risk Analysis Worksheet within 2 business days of last action on the file

· Updating the BAA Tracker daily

· Updating the network drive BAA folders daily

BAA Support: Deliverables 5.2 A-C shall comply with the BAA standard operating procedures.

Monthly Progress Report: Shall include documentation for BAA Support as described and is due on the fifth (5th) business day of each month Reporting Requirements The Contractor shall provide the PM and COR with Monthly Progress Reports in electronic form in Microsoft Word. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the PWS and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The contractor shall notify the PM, COR, and CO in writing if problems arise that could adversely impact the performance of the task order.

The contractor shall take minutes of all formal conference calls and/or meetings held with the PM. Copies of these minutes shall be attached to the monthly progress report.

Monthly progress reports shall contain, but are not limited to, the following:

· Status summary

· Change request status (new, open, closed since last report)

· Issue status (new, open, closed since last report)

· Schedule status

· Minutes of status meetings

· Contractor staff roster (providing updates as they occur, including personnel and security requirements)

· Status of required background investigations

Deliverables 5.3:

Monthly Progress Report. Due the fifth (5th) business day of each month Optional Task (Additional Quantities as outlined in section 5.1.1) Data Access Requests Deliverable 5.4 must be completed within three business days from the date of receipt and comply with the standard operating procedures (SOP):

A. Healthcare Ops Access B. CAPRI/Joint Longitudinal Viewer C. Power of Attorney D. Research – Data Access Request Tracker (DART)

Optional Task (additional Quantities as outlined in section 5.2) Business Associate Agreement (BAA) Support Deliverables 5.5 must comply with the standard operating procedures (SOP):

E. BAAs Reviewed (quantities) F. BAAs Executed (quantities)

GENERAL REQUIREMENTS

KEY PERSONNEL

The following minimum standards shall apply for personnel performing under this contract and shall be maintained throughout the life of the contract.

A. Program Assistant Functional Responsibilities:

Provide administrative support to the VHA Business Associate Program Manager. Provide the updated status in response to email and telephone inquiries regarding the progression of each Business Associate Agreements (BAA) action. These actions include sending and receiving profile applications, scoring the risk analysis worksheet, drafting BAAs, acquiring appropriate signatures (Business Associate and VHA), annotating communications between VHA and business associate, scanning completed agreements and archiving (upload into database), setting meetings with vendors, non-responsive vendor follow up, and other BAA administrative tasks that result from the above duties. The contractor shall assist with managing and updating the BAA databases and trackers.

Minimum Experience/Education:

Possess at least a 2-year degree in business, administration, office automation or healthcare related fields, with preferred background and/or training in the Health Insurance Portability and Accountability Act (HIPAA) business associate provisions.

B. Program Analyst Functional Responsibilities:

Possess and be able to apply expert level knowledge of research, the use of data for research, and research methodologies to the review and approval process for applicable VHA data access requests. Using analytical ability, provide professional and thorough written and/or verbal communications in response to email and telephone inquiries regarding the approval process and any identified deficiencies that may exist within a request. These actions include collaborating with other entities identified in the approval process; reviewing submitted documentation and applying scrutiny in accordance with applicable policy, procedures, and guidance; acquiring appropriate approvals; and annotating communications and status within identified applications. The contractor shall assist with managing, updating, and identifying business requirements for the applicable tools used in the approval process.

Minimum Experience/Education:

Possess at least a 2-year degree in business, administration, office automation or healthcare related fields, with a minimum of 2 years’ experience in the Health Insurance Portability and Accountability Act (HIPAA) and Privacy Act of 1974.

SECURITY AND PRIVACY REQUIREMENTS

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the contract, and shall comply with VA Directive 6066.

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

Within three (3) business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-3 are to encrypt the file, use a secure fax, or use a traceable mail service.

1. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

b. The Contractor shall ensure the following required forms are submitted to the COR within 5 business days after contract award:

1) Optional Form 306

2) Self-Certification of Continuous Service

3) VA Form 0710

4) Completed SIC Fingerprint Request Form The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-QIP).

1. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

1. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM. However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of OPM.

1. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Deliverable:

A. Contractor Staff Roster

0. METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: Microsoft 365 or later, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products Satisfactory or higher

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems Satisfactory or higher

2. Personnel possess necessary knowledge, skills and abilities to perform tasks Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion.

FACILITY/RESOURCE PROVISIONS

The Government will provide office space, telephone service and system access when authorized contract staff work at a Government location as required in order to accomplish the Tasks associated with this PWS. All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

VA may provide remote access to VA specific systems/network in accordance with VA Handbook 6500, which requires the use of a VA approved method to connect external equipment/systems to VA’s network. Citrix Access Gateway (CAG) is the current and only VA approved method for remote access users when using or manipulating VA information for official VA Business. VA permits CAG remote access through approved Personally Owned Equipment (POE) and Other Equipment (OE) provided the equipment meets all applicable 6500 Handbook requirements for POE/OE. All of the security controls required for Government furnished equipment (GFE) must be utilized in approved POE or OE. The Contractor shall provide proof to the COR for review and approval that their POE or OE meets the VA Handbook 6500 requirements and VA Handbook 6500.6 Appendix C, herein incorporated as Addendum B, before use. CAG authorized users shall not be permitted to copy, print or save any VA information accessed via CAG at any time. VA prohibits remote access to VA’s network from non-North Atlantic Treaty Organization (NATO) countries. The exception to this are countries where VA has approved operations established (e.g. Philippines and South Korea). Exceptions are determined by the COR in coordination with the Information Security Officer (ISO) and Privacy Officer (PO).

This remote access may provide access to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, PAL, Primavera, and Remedy, including appropriate seat management and user licenses, depending upon the level of access granted. The Contractor shall utilize government-provided software development and test accounts, document and requirements repositories, etc. as required for the development, storage, maintenance and delivery of products within the scope of this effort. The Contractor shall not transmit, store or otherwise maintain sensitive data or products in Contractor systems (or media) within the VA firewall IAW VA Handbook 6500.6 dated March 12, 2010. All VA sensitive information shall be protected at all times in accordance with VA Handbook 6500, local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this PWS. The Contractor shall ensure all work is performed in countries deemed not to pose a significant security risk. For detailed Security and Privacy Requirements (additional requirements of the contract consolidated into an addendum for easy reference) refer to ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED and ADDENDUM B - VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE.

GOVERNMENT FURNISHED PROPERTY

GFE may be furnished (upon approval of VA PM, COR and IT) for full time contract staff that provide access services.

The Government has determined that remote access solutions involving Citrix Access Gateway (CAG) have proven to be an unsatisfactory access method to complete the tasks on this specific contract The Government also understands that GFE is limited to Contractors requiring direct access to the network to: access development environments; install, configure and run TRM-approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner, etc.); upload/download/ manipulate code, run scripts, apply patches, etc.; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

Based on the Government assessment of remote access solutions and the requirements of this contract, the Government estimates that the following GFE will be required by this contract:

1. Standard laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra PIV readers, peripheral devices, additional RAM, etc. The Contractor is responsible for providing these types of IT accessories in support of the contract as necessary and any VA installation required for these IT accessories shall be coordinated with the PM.

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, unless the connection uses FIPS 140-2 (or its successor) validated encryption, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the PM, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010, by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract, or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS), and will be tracked therein. The TMS may be accessed at https://www.tms.va.gov. If you do not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

VA Internet and Intranet Standards

The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to: creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

A3.1 Section 508 – Information and Communication Technology (ICT) Standards

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

The Contractor shall comply with:

E206 Hardware E206.1 General. Where components of ICT are hardware and transmit information or have a user interface, such components shall conform to the requirements in Chapter 4.

E302 Functional Performance Criteria

· 302.1 Without Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

· 302.2 With Limited Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

· 302.3 Without Perception of Color. Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

· 302.4 Without Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

· 302.5 With Limited Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

· 302.6 Without Speech. Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

· 302.7 With Limited Manipulation. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

302.8 With Limited Reach and Strength. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

302.9 With Limited Language, Cognitive, and Learning Abilities. ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

Confidentiality and Non-Disclosure The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”).