A1 - Statement of Work - Radiopharmaceuticals - STX.pdf

Attachment 1 Statement of Work

36C25725R0019 Page 1 of 13

STATEMENT OF WORK

RADIOPHARMACEUTICALS

SOUTH TEXAS VETERANS HEALTH CARE SYSTEM

1. Background

The South Texas Veterans Health Care System (STVHCS) requires the manufacturing and delivery of radiopharmaceuticals for the diagnosis and treatment of various disease processes through Nuclear Medicine Imaging. Delivery shall be made upon request of the STVHCS.

2. Place(s) of Performance:

Delivery Address:

South Texas Veterans Health Care System

Imaging Services: Nuclear Medicine, 2nd Floor, Room H208

7400 Merton Minter

San Antonio, TX 78229-4404

3. Scope:

Services/Delivery from a single Radiopharmaceutical Pharmacy/Vendor with both low (Core) and high (PET) energy dispensing capabilities.

Pharmacy / Contractor Qualifications:

1. Contractor must be licensed by the US Nuclear Regulatory Commission (USNRC), or a State with a formal Agreement with the USNRC that allows the State to regulate radioactive materials (Licensee) and be regularly established in the business of providing radiopharmaceuticals at the scale and frequency necessary to meet this requirement. The Radiopharmaceuticals must be shipped from the Licensee directly to STVHCS.

Contractor/Licensee must provide copies of all relevant licenses, certifications, and/or partnering agreement(s), along with their proposal to the Contracting Officer.

2. Contractor/licensee shall meet all applicable Nuclear Regulatory Commission, VA/National Health

Physics Program (NHPP), Department of Transportation, FDA, Joint Commission, OSHA, State, and

Federal requirements, rules, and/or regulations related to the supply of Radiopharmaceuticals.

3. Contractor/licensee must be able to provide general & therapeutic Nuclear Medicine radiopharmaceuticals to the STVHCS facilities:

4. In accordance with Presidential/White House request for preferential procurement made to the

Veterans Health Administration (VHA), >90% of Technetium-99m unit doses will be derived from Non-

High Enriched Uranium-235 (Non-HEU) sources, also known as Low Enriched Uranium-235 (LEU)

36C25725R0019 Page 2 of 13 sources. Pricing should include cost for both LEU and non-LEU derived Technetium-99m to account for those instances where product availability becomes limited.

4. SCHEDULE OF SUPPLIES AND SERVICES:

CORE – Tc 99m products low energy FDA Radiopharmaceuticals

• I123 capsules

• Tc99m products

• 1-131 Products

• WBC

• Tc 99m Lymphoseek

• Custom Compounded Agents

1. 1-123 RC Nal Cap (per mCi)

PET- high energy FDA Radiopharmaceuticals

• F-18 FDG Unit and Bulk Doses /Sources

• Ga-68 Dotatate

Technology capabilities

• Utilized to ensure dose/ patient accuracy.

• Utilized to ensure medication source traceability

• Utilized to ensure delivery tracking/accuracy.

Item Description

F-18 FDG UD

F-18 FDG UD Source

Ga-67 Gallium Citrate UD

GA-68 DOTA-O Injection UD

Ga-68 Gozetotide

I-123 Iobenguane Sulfate UD

I-123 Ioflupane

I-123USP Nal 100 uCi Capsule

I-123 USP Nal 1200 uCi Capsule

I-123 DX Nal mCi

I-131 USP Nal DX Capsule UD mCi

I-131 USP Nal DX Capsule UD uCi

I-131 USP Nal Tx Capsule

In-111 Chloride

In-111 Oxyquinoline

In-111 Autologous WBC Blood kit (Heparin)

In-111 Pentetate (UD) SDV/Vial

Tc-99m Autologous WBC’s Suspension

Tc-99m Cardiolite UD

Tc-99m Exametazime WBC’s UD

Tc-99m Filtered Sulfur Colloid mCi

36C25725R0019 Page 3 of 13

Tc-99m Filtered Sulfur Colloid Bone Marrow Imaging mCi

Tc-99m Macro Aggregated Albumin UD

Tc-99m MAA Reduced Particle UD

Tc-99m Mebrofenin UD

Tc-99m Medronate UD

Tc-99m Mertiatide UD

Tc-99m NaTc04 UD uCi

Tc-99m NaTc04 UD mCi

Tc-99m Oxidronate UD

Tc-99m Pentetate UD

Tc-99m Pentetate UD (Aerosol)

Tc-99m Pyrophosphate UD

Tc-99m Sestamibi UD

Tc-99m Sulfur Colloid UD

Tc-99m Tetrofosmin UD

Lymphoseek Study Dose

Xe-133 Xenon Gas 20 mCi Vial

Xe-133 Xenon Gas 10 mCi Vial

WBC Blood Kit

UltraVent Aerosol Nebulizer

Sincalide Vial

UltraTag Vial

Ra-233 Dichloride UD

DC Accuracy

DC Geometry

DC Linearity

The Department of Veterans Affairs. STVHCS, Nuclear Medicine Service, requires the contractor/licensee to provide radiopharmaceuticals, and any needed check/QC/etc. sources to be used with Radioassay, Radiopharmacy, Gamma Camera/SPECT & SPECT/CT imaging systems within the STVHCS. Items will be unit dose or bulk delivery, daily, and on an AS NEEDED basis, in accordance with patient requirements at the Agency’s discretion.

1. Contractor/licensee shall label all unit doses of delivered radiopharmaceutical with the amount, preparation time, expiration time, date, etc. Contractor must supply each STVHCS facility with a bar -code reader or comparable VA approved device that is compatible with the STVHCS Nuclear Medicine

Information System (NMIS) or provide approved infrastructure to meet this requirement.

2. If the Contractor's/licensee’s system varies from the STVHCS facility NMIS, the contractor shall provide means for compatibility or an alternative system with any needed data migration, technical support, and training for staff on its use at no additional cost to the government. Any additional tracking system(s) provided must comply with all VA and associated IT, as well as information security, requirements.

36C25725R0019 Page 4 of 13

3. An additional label shall be affixed to each syringe, vial, or other container used to hold a radioactive drug to be transferred for commercial distribution. The label must include the radiation symbol and the words "CAUTION, RADIOACTIVE MATERIAL" or "DANGER, RADIOACTIVE MATERIAL" and an identifier that ensures that the syringe, vial, or other container can be correlated with the information on the transport radiation shield label.

4. All packages containing radioactive material must be labeled and shipped in accordance with

Title 49, Code of Federal Regulations Part 172 and 173.

5. Contractor/licensee shall perform all quality control procedures as required by Federal, and when applicable, State regulatory agencies. Quality Control results will be furnished to

STVHCS upon request.

6. Contractor/supplier shall abide by Title 10, Code of Federal Regulation, which states: A

Licensee may use for medical purposes only:

(a) By-product material or cyclotron produced materials manufactured, labeled, packaged and distributed in accordance with a license issued pursuant to the regulations in Title 10, Code of

Federal Regulations, Part 35 and/or the equivalent regulations of an Agreement State.

(b) Reagent kit that has been manufactured, labeled, packed and distributed in accordance with approval by the Commission pursuant to Title 10 CFR 32.72 or an Agreement State under equivalent regulations for the preparation of radiopharmaceuticals for medical use.

7. Contractor/licensee shall have available an adequate supply of contracted products to meet the requirements of the South Texas VA Healthcare System with proof of contingency supply chain to prevent disruption of clinical care. Contractor will utilize only FDA approved products and sources for those products, unless otherwise mutually agreed upon in the context of compassionate care or IRB approved research. Pricing will be based upon a unit/bulk dose price per quantity of doses ordered with no other fees or surcharges. A tiered pricing structure with lower cost per increased quantity used is preferred.

8. Contractor/licensee shall provide and deliver the following products/services according to the need of the facility:

a. Unit and Bulk F18 FDG products

b. Radioactive blood-labeled products that meet/exceed USP825 standards.

9. Contractor/licensee will deliver radioisotope in an amount greater than or equal to the activity ordered with calibration for the specified appointment time so that patient administered quantity is within regulatory limits of the prescribed dose. All routine radiopharmaceutical dose deliveries must occur >30 minutes prior to the calibration time.

10. Pricing and Radiopharmaceutical Returns for Credit:

Pricing will be based upon a unit and bulk dose price per quantity of doses ordered with no other fees or surcharges. The Contractor shall accept returns for full credit toward future orders under the following conditions:

36C25725R0019 Page 5 of 13

a. Product(s) ordered or shipped in error.

b. Product(s) damaged in shipment.

c. Concealed shipping damages

d. Recalled product(s)

e. Outdated products in unopened, original container.

11. Contractor/licensee shall provide at least three (3) scheduled deliveries of radiopharmaceuticals per day. Note that the STVHCS facility in San Antonio provides both inpatient and outpatient care and is the tertiary VA Medical Center for the South Texas area.

Additional radiopharmaceutical delivery may be required based upon clinical schedule, including emergency/STAT deliveries. STAT delivery times during routine business hours should not exceed 60 minutes from time the order is placed, and 90 minutes afterhours and holidays. All other add-on deliveries, including radiolabeled blood products, should not exceed 120 minutes.

12. Radiopharmaceutical Returns for Credit: STVHCS facilities are each allowed a minimum 10% radioisotope returns for all contracted radiopharmaceuticals due to patient cancellation, no show, and/or rescheduling at no cost to the facility. In addition, the Contractor shall accept returns for full credit toward future orders under the following conditions:

a. Product(s) ordered or shipped in error.

b. Product(s) damaged in shipment.

c. Concealed shipping damages

d. Recalled product(s)

e. Outdated products in unopened, original container.

13. Invoicing: Contractor shall invoice at least once per month showing period covered, billing date, name of preparation, quantity, and amount, as well as the correct purchase order number.

Unit dose (UD) based invoicing is preferred. Offeror(s) that provides a volume driven tiered approach that results in discounting with increased quantity purchased, is preferred. If volume-based tiered pricing is quoted, quantity thresholds may be set at monthly or quarterly increments.

A mutually agreed upon method to track unused reimbursable doses must be established prior to contract initiation.

14. Normal/ Routine Ordering: Routine orders shall be placed by authorized VA personnel during normal business hours throughout the workday. Each day, first delivery shall be received no later than 07:00 am via direct delivery to the STVHCS Nuclear Medicine Section

Radiopharmacy. After award, the Contractor/licensee will be furnished the name(s) of VA personnel that are authorized to place orders against the Contract and will provide appropriate personnel and contact information for staff receiving orders, able to offer technical or administrative support, as well as staff involved in radiopharmaceutical delivery in accordance with VA Radiation Safety Office requirements. Orders shall only be placed by authorized

STVHCS NMS personnel via telephone, fax, e-mail, or via an approved, secure, online ordering system. For electronic ordering systems, a closed-loop communication process such as confirmation e-mails is preferred.

15. Normal/ Routine Deliveries: Depending upon changing Medical Center/Facility patient care

36C25725R0019 Page 6 of 13 requirements, the Contractor/licensee may be required to provide routine delivery and pick-up, multiple times (>3 times) throughout the day. It is incumbent upon the contractor to ensure delivery personnel are adequately familiar with each specific delivery location. Delivery personnel will park at the nearest secure location and proceed directly to the Nuclear Medicine

Service site where they will be escorted to the radiopharmacy (Hot Lab) by STVHS staff. The delivery personnel will follow delivery path according to Radiation Safety Officer directed SOP.

Delivery orders, or the electronic ordering system, shall include the following information:

• Contract item(s) and quantity

• Time(s) of delivery

• Applicable VA purchase order number

Offeror with VA approved Information Security systems that allow ordering that includes

Protected Health Information (PHI) to better protect patient safety (Example: Autologous radiolabeled blood products), is preferred.

As noted above, Contractor/licensee agrees to accept unused radiopharmaceutical and provide reimbursement per unit dose applicable towards future orders. A minimum 10% radiopharmaceutical return rate for all diagnostic tracers is considered requisite, and a broader return policy is preferred.

Contractor is responsible for on time delivery of radiopharmaceutical and will have back-up facilities/production options available to maintain greater than 99% on time delivery (per invoice cycle) or risk penalty that includes no charge doses that, at a minimum, equal the amount of missed doses and 10% discount for that invoice.

16. Contractor will provide STVHCS NMS personnel access to relevant online and/or live

Continuing Education opportunities at no cost to STVHCS to ensure staff remain current in safe receipt and handling of radioactive materials/radiopharmaceuticals, as well as related regulatory requirements.

17. Same-Day Delivery/STAT Orders:

Contractor/licensee will be available for and provide Emergency/STAT radiopharmaceuticals, 24/7/365, in accordance with the schedule of supplies. STAT deliveries during normal business hours will occur within 60 minutes from time the order is placed, and 90 minutes afterhours and holidays.

Same-Day Add-on Delivery of routine non-Emergent radiopharmaceutical can be received at

STVHCS facilities up to 90 minutes after the order is placed during normal business hours if approved by STVHCS authorized personnel. Nuclear Medicine Service normal business hours are considered Monday through Friday: 6:30 AM – 4:00 PM, except Federal Holidays.

The following are Federal Holidays:

New Year’s Day

Birthday of Martin Luther King, Jr. (day of observance)

Washington’s Birthday

Memorial Day

36C25725R0019 Page 7 of 13

Juneteenth Day

Independence Day

Labor Day

Columbus Day

Veteran’s Day

Thanksgiving Day

Christmas Day

(Any other day designated as a National Holiday by the President of the United States.)

18. Ordering Contact Information: Contractor/licensee shall provide contact information for the placement of orders for items listed in the “Schedule of Supplies and Services” Section.

POC Name:

Address:

City/State/Zip Code:

Ordering Phone Number:

Ordering Fax Number:

Ordering E-Mail Address:

19. DELIVERY COMMITMENT: Time of delivery specified or mutually agreed to at the time of receipt of telephone/electronic order(s) shall become mandatory upon the

Contractor's/licensee’s acceptance to commitment. Delivery of supplies by the scheduled time will be complete except as otherwise authorized by the Ordering Personnel. Failure to perform in accordance with the delivery commitment may be grounds for termination of contract in accordance with the provisions for default. The Government may terminate this contract in whole or in part if the contractor fails to meet the required delivery schedule. The contractor/licensee shall not be charged with damages when the delay in delivery arises out of causes beyond their control and without the fault or negligence of the contractor/licensee.

Delivery location will be defined for each shipment by STVHCS authorized personnel.

Access to a STVHCS radiopharmacy, during non-business hours, shall be obtained by contacting designated on-call personnel, or the VA Police Service. Delivery personnel must be escorted at all times within facility ‘Controlled areas’/Nuclear Medicine Service, as per TJC and

NRC/regulatory requirements.

Contractor/licensee will provide updated lists of delivery personnel who will sign in/sign out with STVHCS/Nuclear Medicine Service staff upon each delivery of radiotracer and follow all relevant policies and procedures in place at STVHCS facilities/Nuclear Medicine Service.

Compliance with all applicable regulatory bodies, including FDA and TX/US DOT is requisite.

Upon request by STVHCS/Radiation Safety Officer, the Contractor shall provide a copy/reports of contractor’s/licensee’s RSO Safety Audits of Federal Compliance.

36C25725R0019 Page 8 of 13

Information Technology Security Requirements:

As prescribed in 839.201, the contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with

VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive

Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a

Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security

Clearance must be processed through the Special Security Officer located in the Planning and

National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S.

to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the

36C25725R0019 Page 9 of 13 contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the

VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in

Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure

VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media

Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business

Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information

36C25725R0019 Page 10 of 13 in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the Contracting Officer’s Representative (COR).

GENERAL RULES OF BEHAVIOR

a. Rules of Behavior are part of a comprehensive program to provide complete information security. These rules establish standards of behavior in recognition of the fact that knowledgeable users are the foundation of a successful security program. Users must understand that taking personal responsibility for the security of their computer and the information it contains is an essential part of their job.

b. The following rules apply to all VA contractors. I agree to:

(1) Follow established procedures for requesting, accessing, and closing user accounts and access. I will not request or obtain access beyond what is normally granted to users or by what is outlined in the contract.

(2) Use only systems, software, databases, and data which I am authorized to use, including any copyright restrictions.

(3) I will not use other equipment (OE) (non-contractor owned) for the storage, transfer, or processing of VA sensitive information without a VA CIO approved waiver, unless it has been reviewed and approved by local management and is included in the language of the contract. If authorized to use OE IT equipment, I must ensure that the system meets all applicable 6500 Handbook requirements for OE.

(4) Not use my position of trust and access rights to exploit system controls or access information for any reason other than in the performance of the contract.

(5) Not attempt to override or disable security, technical, or management controls unless expressly permitted to do so as an explicit requirement under the contract or at the direction of the COR or ISO. If I am allowed or required to have a local administrator account on a

36C25725R0019 Page 11 of 13 government-owned computer, that local administrative account does not confer me unrestricted access or use, nor the authority to bypass security or other controls except as expressly permitted by the VA CIO or CIO's designee.

(6) Contractors’ use of systems, information, or sites is strictly limited to fulfill the terms of the contract. I understand no personal use is authorized. I will only use other Federal government information systems as expressly authorized by the terms of those systems. I accept that the restrictions under ethics regulations and criminal law still apply.

(7) Grant access to systems and information only to those who have an official need to know.

(8) Protect passwords from access by other individuals.

(9) Create and change passwords in accordance with VA Handbook 6500 on systems and any devices protecting VA information as well as the rules of behavior and security settings for the particular system in question.

(10) Protect information and systems from unauthorized disclosure, use, modification, or destruction. I will only use encryption that is FIPS 140-2 validated to safeguard VA sensitive information, both safeguarding VA sensitive information in storage and in transit regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA.

(11) Follow VA Handbook 6500.1, Electronic Media Sanitization to protect VA information. I will contact the COR for policies and guidance on complying with this requirement and will follow the COR's orders.

(12) Ensure that the COR has previously approved VA information for public dissemination, including e-mail communications outside of the VA as appropriate. I will not make any unauthorized disclosure of any VA sensitive information through the use of any means of communication including but not limited to e-mail, instant messaging, online chat, and web bulletin boards or logs.

(13) Not host, set up, administer, or run an Internet server related to my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA unless explicitly authorized under the contract or in writing by the COR.

(14) Protect government property from theft, destruction, or misuse. I will follow VA directives and handbooks on handling Federal government IT equipment, information, and systems. I will not take VA sensitive information from the workplace without authorization from the COR.

(15) Only use anti-virus software, antispyware, and firewall/intrusion detection software authorized by VA. I will contact the COR for policies and guidance on complying with this requirement and will follow the COR's orders regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with VA.

(16) Not disable or degrade the standard anti-virus software, antispyware, and/or firewall/intrusion detection software on the computer I use to access and use information assets or resources associated with my performance of services under the contract terms with VA. I will report anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages to the COR.

(17) Understand that restoration of service of any VA system is a concern of all users of the system.

(18) Complete required information security and privacy training, and complete required training for the particular systems to which I require access.

36C25725R0019 Page 12 of 13

Records Management

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR

Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of

44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, contractor shall maintain all records created for government use or created in the course of performing the contract and/or delivered to, or under the legal control of the government and must be managed in accordance with Federal law.

Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. South Texas VA Health Care System and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of South Texas VA Health Care System or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.

In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, contractor must report to South Texas VA Health Care System. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The contractor shall not remove material from government facilities or systems, or facilities or systems operated or maintained on the government’s behalf, without the express written permission of the Head of the Contracting

Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to South Texas VA Health Care System control, or the contractor must hold it until otherwise directed. Items returned to the government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address

36C25725R0019 Page 13 of 13 prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts.

The contractor (and any sub-contractor) is required to abide by government and South Texas VA

Health Care System guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The contractor shall only use government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with South Texas VA Health Care System policy.

8. The contractor shall not create or maintain any records containing any non-public South

Texas VA Health Care System information that are not specifically tied to or authorized by the contract.

9. The contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The South Texas VA Health Care System owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which South Texas VA Health Care System shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR

52.227-20.

11. Training. All contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take VHA-provided records management training, Talent Management System (TMS) Item #10176, Privacy and Information Security, Rules of Behavior. The contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.