Atch 1 - Draft PWS for Solicitation 36C25021Q2015.pdf

B.3 PERFORMANCE WORK STATEMENT (PWS) dated 2 August 2021

PERFORMANCE WORK STATEMENT (PWS)

AMAG Physical Access Control System (PACS) Upgrade and Sustainment for

Chillicothe VAMC

2 August 2021

1. GENERAL. This is a non-personnel services contract in which the contractor shall provide AMAG Physical Access Control System (PACS) upgrade and sustainment for Chillicothe VA Medical Center (VAMC) in Ohio.

The government shall not exercise any supervision or control over the contract service providers performing the services herein.

The Chillicothe Veterans Affairs Medical Center’s (CVAMC’s) Physical Access Control System (PACS) is an AMAG Technology, Homeland Security Edition (HSE), Security Management System (SMS) current version 9.3.5 (see attached photo of the Symmetry info page) utilizing SYMMETRY EN-1DBC-HSE Edge Controllers, structured to provide continuous control and monitoring of a combination of approximately 490 interior and exterior doors across 30 buildings. Card Readers currently installed are a combination of HID RP40 multiCLASS Readers (25% of total count) and RPK40 multiCLASS Readers with Keypads (75% of total count). There are 3 Community Based Outpatient Clinic’s (CBOC’s) that currently have 40 total card readers and an additional 2 more CBOC’s are planned which will add an additional 20 card readers. CVAMC main campus has 6 client computers and the above mentioned CBOC’s have 1 client computer each. Other current system components not mentioned above include Bosch DS150i Request‑to‑exit PIR Detectors, GE magnetic contacts model 1076D (Flush mount) and model 2507AD (Surface mount), and approximately 5 Locknetics Scramble pads.

The AMAG Symmetry platform software is installed on a VA owned virtual server. Each security device is connected via the VA OIT network and is assigned an IP address that is behind a network Access Control List (ACL) which adds to the complexity of the system. Please note that the AMAG system currently does not need to be FICAM compliant.

The contractor shall provide full-service maintenance and programming contract that includes replacement parts for failed system components, software updates, labor and travel during the hours of 8am to 5pm, Monday through Friday, with the exception of High Priority service requests (see specific task 3.4.1), which shall be responded to regardless of day or time. The contractor shall perform a system inspection and operability check to insure 100% system operability and stability. The contractor will ensure all existing hardware is compatible with the installed software and installed properly and in accordance with AMAG, Department of Veterans Affairs, as well as device manufacturer requirements. The contractor will update, and continue to keep up to date, all software within the AMAG system to the latest versions, including the Site Support Agreement (SSA), throughout the entirety of the contract. The contractor will install new card reader devices during the initial year of the contract as well as during each option year. The contractor will integrate the AMAG system into our existing CCTV (ExacqVision) and Alarm systems as required by the Department of Veterans Affairs Physical Security and Resiliency Design Manual.

Future construction projects and building additions completed by the CVAMC will be responsible for adding and programming new cards readers. The contractor, however, shall maintain these new card readers including purchase of licenses, as outlined in this performance work statement (PWS). The contractor may assume that approximately 150 new card readers will be installed by the government during the duration of this service agreement. It is also important to note that this contract DOES NOT include the following:

Does not include physical maintenance of the VA’s virtual server Does not include maintenance of the VA’s Cisco POE+ switches Does not include new installs/activations for building additions by 3rd party contractors (but maintenance is required after the 1-year warranty period has elapsed)

1.1 SCOPE SUMMARY. The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items necessary to provide AMAG PACS upgrade and sustainment for Chillicothe VAMC as established in this Performance Work Statement (PWS) and in accordance with terms and conditions established in the contract for the following location:

Chillicothe VA Medical Center (VAMC) 17273 State Route 104 Chillicothe, Ohio 45601

The contractor shall install, upgrade, repair and maintain ALL aspects of the current PACS System (AMAG), including Original Equipment Manufacturer (OEM) technical and site support agreement, (SSA) Servers Operating systems and Microsoft SQL. This is a High Priority System for which this service contract is needed.

1.2 PERIOD OF PEFORMANCE. The periods of performance for base period and all option periods for this contract are summarized as follows:

Base Year: 25 September 2021 to 24 September 2022 Option Year One (1): 25 September 2022 to 24 September 2023 Option Year Two (2): 25 September 2023 to 24 September 2024 Option Year Three (3): 25 September 2024 to 24 September 2025 Option Year Four (4): 25 September 2025 to 24 September 2026

1.3 GENERAL REQUIREMENTS

1.3.1 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall identify and define the management concept for ensuring compliance with all contract requirements. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor will have an on-going quality assurance and /or quality improvement program designed to objectively and systematically measure, assess, and improve performance to enhance patient care and all patient care services. The contractor’s quality control program is the means by which the contractor assures that all work complies with the requirement of the contract. The contractor shall provide a copy of the QCP with their offeror as specified by the Contracting Officer (CO) and upon request thereafter. After acceptance of the quality control plan, the contractor shall immediately notify the contracting officer of any proposed changes to their quality control program and submit a change request in writing to the contracting officer. The contractor shall furnish copies of these records if requested by the CO, COTR or individual(s) designated by the COTR and/or CO in writing. The contractor’s quality control program shall include the following:

1.3.2 Quality Assurance. The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s):

1.3.3 Federally Recognized Holidays. The contractor is not anticipated but may be required to provide service on Federally recognized holidays in accordance with the terms and conditions established in this PWS to include but not limited to the following:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.3.4 Hours of Operation. The contractor shall be available to schedule services from Monday through Friday from 0800-EST to 1630-EST, except on Federally recognized holidays. The contractor shall coordinate with the COTR and/or authorized government representative designated in writing by the COTR and/or Contracting Officer to schedule services prior to the first working day of the calendar month. All services shall be performed at the rates established in the SCHEDULE OF SERVICES – PRICE SCHEDULE in accordance with the terms and conditions of this contract. The contractor must maintain an adequate workforce to ensure that uninterrupted services are performed for all requirement defined within this PWS. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.3.5 Place of Performance. The contractor shall furnish provide services in accordance with the terms and conditions of this contract as requested by the authorized government representative(s) designated in writing by the COTR and/or CO in accordance with the procedures specified within this PWS for the following location:

Chillicothe VA Medical Center (VAMC) 17273 State Route 104 Chillicothe, Ohio 45601

Athens CBOC 88 N Plains Rd. The Plains, OH 45780

Portsmouth CBOC 4038 Rhodes Ave New Boston, OH 45662

Cambridge CBOC 2146 Southgate Parkway Cambridge, OH 43725.

Wilmington CBOC 448 W. Main St. Wilmington, OH 45177

Lancaster CBOC 1703 N. Memorial Dr. Lancaster, OH 43130

1.3.6 Type of Contract. The government intends to award a single-award firm-fixed price (FFP) contract for the effort specified herein. The base and option periods (if any) specified in the SCHEDULE OF SERVICES – PRICE/COST SCHEDULE shall be exercised at the discretion of the government. The authority that will be utilized to award this effort is FAR Part 13.5 (Simplified Procedures for Certain Commercial Items).

1.3.7 Security Requirements and Background Checks. All contractor employees shall comply with the security and background check requirements required by Federal, State, Local and the Department of Veterans Affairs to perform service in support of this VA medical facility in the state of Ohio.

1.4.12.1 VAMC/VAACC Identification Badges: The contractor shall ensure that all personnel obtain VAMC/VAACC identification badges from the each VAMC/VAACC security personnel office as appropriate in compliance with all federal and local VAMC/VAACC facility policies.

1.4.12.2 PHYSICAL Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.4.12.3 Key Control: Not Applicable.

1.4.12.4 Lock Combinations: Not Applicable.

1.4.12.5 SECURITY REQUIREMENTS. The contractor, contractor personnel, prime contractor’s subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security..

1.4.12.6 RESERVED.

1.4.12.7 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

1.4.12.7.1 The prime contractor or prime contractor for the subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

1.4.12.7.2 All contractors, their subcontractors, and their third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

1.4.12.7.3 A background investigation (BI) is not required per VA Information and Information System Security/Privacy Requirements for IT Contracts dated August 2008 if the following exception applies for contractor personnel with limited and intermittent access to equipment connected to facility networks on which limited VA sensitive information may reside, including medical equipment contractors who install, maintain, and repair networked medical equipment such as CT scanners, EKG systems, ICU monitoring, etc.

In this case, Veterans Health Administration facilities must have a duly executed VA Business Associate Agreement (BAA) in place with the vendor in accordance with VHA Handbook 1600.1, Business Associates, to assure compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in addition to the contract. Contractor personnel, if on site, shall be escorted by VA IT Staff.

1.3.8 Special Qualifications – Contractor Experience Requirement. The government will determine on a SR basis what positions are considered key personnel. The contractor shall identify, by name, the key management and technical personnel who will work under this task order at the time the work is being negotiated.

If a key person becomes unavailable to complete the SR, the proposed substitutions of key personnel shall be made only as approved directed by the contracting officer and the COTR. The government will not dictate specific experience and education requirements of the employees initially proposed to perform the work stated herein. The contractor shall submit a resume of qualifications for the COTR and all other direct employees proposed for the project. All contractor employees will be approved by the COTR prior to bringing on duty. If, at any time from date of award to the end of the contract, non-key personnel contractor personnel are no longer available, HES/HIS reserves the right to review the qualifications of the proposed replacement personnel and to reject individuals who do not meet the qualifications set forth in the TLO. Team personnel proposed by the contractor should possess some of the following knowledge and/or skills:

1.3.8.1 The contractor must notify VHA in advance and we will approve or reject proposed contractor key personnel for the performance of this contract. The contractor shall submit a resume of qualifications to the COTR for key personnel and all other direct employees proposed for the project. All contractor employees will be approved by the COTR prior to bringing on duty. If, at any time from date of award to the end of the contract, contractor personnel are no longer available, the VHA will approve the qualifications of proposed replacement personnel and will reject individuals who do not meet qualifications set forth herein. The contractor must inform the VHA COTR, and Project Manager/Task Manager when personnel are removed from the contract for any reason. The Contractor shall remove any employee from the performance of this contract within five (5) workdays of receiving notice from the contracting officer that the employee's performance is unsatisfactory. All contractor employees are subject to immediate removal from performance of this contract when they are involved in a violation of the law, VA security, confidentiality requirements and/or other disciplinary reasons.

1.3.8.1.1 The contractor must inform the VHA COTR, and Project Manager/Task Manager when personnel are removed from the contract for any reason.

1.3.8.1.2 If a key person becomes unavailable to complete the SR, proposed Substitutions of key personnel shall be made only if approved by the COTR and Project Manager.

1.3.8.1.3 The contractor shall submit a resume of qualifications to the COTR for all direct employees proposed for the project. All Contractor employees will be approved by the COTR prior to bringing on duty.

1.3.8.2 CONFIDENTIALITY AND NONDISCLOSURE. The contractor shall agree with the following terms and conditions:

1.3.8.2.1 The preliminary and final deliverables, and all associated working papers, application source code, and other material deemed relevant by VA which have been generated by the contractor in the performance of this task order, are the exclusive property of the U.S. Government and shall be submitted to the CO at the conclusion of the task order

1.3.8.2.2 The CO will be the sole authorized official to release, verbally or in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to this task order, presented to the contractor, shall be submitted to the CO for response.

1.3.8.2.3 Press releases, marketing material, or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the CO.

1.3.8.3 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS. All contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to subcontractor personnel requiring the same access.

1.3.8.3.1 Position Sensitivity – The position sensitivity has been designated as____ Low ______________

(Insert High Risk, Moderate Risk or Low Risk.)

1.3.8.3.2 Background Investigation – The level of background investigation commensurate with the required level of access is __National Agency Check with Inquiries______ (Insert Background Investigation, Minimum Background Investigation or National Agency Check with Written Inquiries).

1.3.8.3.3 Contractor Responsibilities

a. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship, and are able to read, write, speak and understand the English language.

b. The contractor shall submit or have their employees submit the required forms (SF 86 or SF 85P, SF 85P-S, FD 258, Contractor Fingerprint Chart, VA Form 0710, Authority for Release of Information Form, and Optional Forms 306 and 612) to the VA Office of Security and Law Enforcement within 30 days of receipt.

c. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the affected employee from working under the contract.

d. Failure to comply with contractor personnel security requirements may result in termination of the contract for default.

1.3.8.3.4 Government Responsibilities

a. The VA Office of Security and Law Enforcement will provide the necessary forms to the contractor, or to the contractor’s employees, after receiving a list of names and addresses.

b. Upon receipt, the VA Office of Security and Law Enforcement will review completed forms for accuracy and forward the forms to the office of Personnel Management (OPM) to conduct background investigations.

c. The VA Office of Security and Law Enforcement will notify the CO, and contractor, of adjudication results received from OMB.

d. Upon being notified about a favorable determination, the CO may issue a notice to proceed to the contractor.

1.3.9 Post Award Conference/Periodic Progress Meetings. The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COTR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.3.10 Contracting Officer’s Technical Representative (COTR). The (COTR) if designated will be identified by separate letter issued by the cognizant government Contracting Officer. The COTR monitors all technical aspects of the contract and assists in contract administration The COTR is authorized to perform the following functions:

assure that the contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of contractor personnel. A letter of designation issued to the COTR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COTR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COTR is not authorized to change any of the terms and conditions of the resulting order.

1.3.11 Key Personnel. The following personnel are considered key personnel by the government: Project Manager/Alternate Project Manager and Officer in Charge. The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract.

1.3.11.1 Personnel Roster. Not later than ten calendar days after notification of award prior to commencement of any services, the contractor shall provide a list of all personnel that will perform services under this contract to include copies of their certification in diagnostic medical physics by the ABR or similar qualifications per VHA Directive 1105.04, their work schedules, and information regarding a contact person for this contract to the Contracting Officer (CO). Thereafter, any changes to the personnel roster of the contractor shall be submitted to the CO, COTR and VA Police to include all authorized government representative(s) designated in writing by the COTR and/or CO within 24 hours of any change in staff.

1.3.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

1.3.13 Contractor Travel: Not Applicable

1.3.14 Other Direct Costs: Not Applicable

1.3.15 Data Rights: Not Applicable

1.3.16 Organizational Conflict of Interest: Not Applicable

1.3.17 Phase-In /Phase-Out Period: Not Applicable

2. DEFINITIONS AND ACRONYMS

2.1. DEFINITIONS

BENEFICIARY. Veterans and other members determined to be eligible for benefits by the VA.

COMMUNITY LIVING CENTER (CLC). The Community Living Centers (CLCs) are inpatient units for

VAMC nursing homes.

CONTRACTOR. A vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime contractor and its employees. The contractor is fully responsible for performance of their sub-contractor(s) and shall ensure that their subcontractor(s) are fully compliant with the terms and conditions of this contract at all-times.

CONTRACTING OFFICER (CO). A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

CONTRACTING OFFICER'S REPRESENTATIVE (COTR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

CONTRACTING OFFICER'S TECHNICAL REPRESENTATIVE (COTR). A government official or officials that work under the authority of the government Contracting Officer responsible for placing patient transport requests for authorized work within the scope and in accordance with the terms and conditions of this contract as specified in the COTR designation letter.

DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

DELIVERABLE. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

NOT TO EXCEED (NTE). The price and/or quantity that the contract or purchase order shall not exceed.

PATIENT BUSINESS SERVICES. An administrative department which processes patients’ medical records, appointments, etc.

PHYSICAL SECURITY. Actions that prevent the loss or damage of government property.

QUALITY ASSURANCE. The government procedures to verify that services being performed by the contractor are performed according to acceptable standards.

QUALITY CONTROL. All necessary measures taken by the contractor to assure that the quality of an end product or service shall meet contract requirements.

QUALITY ASSURANCE. Those actions taken by the government to assure services meet the requirements of this contract.

QUALITY ASSURANCE EVALUATOR(S): Government personnel responsible for surveillance of contractor performance.

QUALITY ASSURANCE SURVEILLENCE PLAN (QASP). An organized written document specifying the surveillance methodology to be utilized by the government for surveillance of contractor performance.

QUALITY CONTROL PLAN (QCP): The QCP is the contractor's management plan for executing the contract which shall be provided to the government upon request and whenever updated by the contractor. The contractor QCP describes the way in which the contractor will produce the deliverables, and the step-by-step approach that will be taken to ensure the quality of service provided to the government.

SUBCONTRACTOR(S). A subcontractor is one who enters into a contract with a contractor (or prime contractor). The contractor (or prime contractor) may choose to subcontract a nominal amount of patient transports during periods of increased demand to comply with the terms and conditions of this contract. The prime contractor is fully responsible for performance of their sub-contractor(s) and shall ensure that their subcontractor(s) are fully compliant with the terms and conditions of this contract at all-times. In addition, the prime contractor shall ensure that their subcontractor(s) clearly identify themselves as the subcontractor for the prime contractor in all written correspondence (i.e. log books, etc.) and verbal exchanges with government representatives.

THE JOINT COMMISSION (TJC). A national not-for-profit organization dedicated to administering accreditation programs that improve the care, safety and treatment of patients in a health care facility and environment.

UNIVERSAL PRECAUTIONS. The standard precautions which shall be taken by the contractor when it is anticipated that an individual may encounter blood or body fluid while performing normal duties which require the use of personal protective equipment (e.g., gloves).

2.2. ACRONYMS:

AQL Access Control List CBOC Community Based Outpatient Clinic CFR Code of Federal Regulations CLC Community Living Centers CO Contracting Officer CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer’s Representative COTR Contracting Officer's Technical Representative COTS Commercial-Off-the-Shelf FAR Federal Acquisition Regulation HIPAA Health Insurance Portability and Accountability Act of 1996 NHCU Nursing Home Care Unit NTE Not to Exceed OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OAC Ohio Administrative Code ORC Ohio Revised Code PBS Patient Business Services PIPO Phase In/Phase Out PACS Physical Access Control System POC Point of Contact

PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Plan QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program SMS Security Management System SSA Site Support Agreement TE Technical Exhibit VAAR Veteran’s Administration Acquisition Regulation VAPS VA Police System VISTA Veteran’s Health Information Systems and Technology Architecture VSC VHA Service Center VAACC Veteran’s Administration Ambulatory Care Clinic VAMC Veteran’s Administration Medical Center VHA Veteran’s Health Administration VHA PM Veteran’s Health Administration Procurement Manual

3. GOVERNMENT FURNISHED ITEMS AND SERVICES: No government furnished equipment (GFE) will be provided for this requirement. The contractor shall ensure that they provide all replacement parts required in accordance with the terms and conditions of this contract. In addition, government furnished information (GFI) will be provided by an authorized government representative in the form of existing AutoCAD drawings.

3.1. Services: Not applicable

3.2 Facilities: Not applicable.

3.3 Utilities: Not applicable.

3.4 Equipment: Not applicable.

3.5 Materials: Not applicable.

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items necessary to perform all services under this contract as defined in this PWS and in accordance with the terms and conditions of this contract.

4.2. Materials, Supplies and Equipment: The contractor shall furnish all material, supplies and equipment required to perform work under this contract. The contractor shall NOT be permitted to borrow medical equipment from the Medical facilities. The contractor shall at no time and under any circumstances exchange supplies and/or equipment with VA. The prices quoted in the SCHEDULE OF SERVICES – PRICE SCHEDULE shall be inclusive of consumables used in transport.

5. REQUIREMENTS – SPECIFIC TASKS:

5.1 The contractor shall furnish all labor, material, supplies, equipment, and qualified AMAG personnel required to maintain the existing card readers and installation of new card readers summarized as follows:

Base Year: 20 New Locations Option Year One (1): 10 New Locations Option Year Two (2): 10 New Locations Option Year Three (3): 10 New Locations Option Year Four (4): 10 New Locations

The locations of these new card reader installations will be determined by the CVAMC Physical Security Specialist, Department of Veterans Affairs Physical Security and Resiliency Design Manual and VA Handbook 0730/4. In addition to the standard card reader system components (e.g. recessed card reader, request to exit, surface mounted door position monitor, additional license, programming, etc.) the contractor shall install turnkey door hardware retrofits on existing doors with the following assumptions:

Existing Masonry walls Existing Grout filled metal frames Existing wood or metal door Contractor to provide and install:

New electrified panic hardware with surface mounted door loop or new electric strike in existing door frame (base pricing on which ever cost more) Power supplies as needed Security system wiring junction box above ceiling on secure side of door Wiring (power and coms) to be in surface mounted conduit painted to match existing wall Run new cat 6A data in 0.75” conduit to local signals closet. For pricing, assume that the maximum distance is 200’.

If all of the card reader installs shown above per year are not required, turn over unused equipment to the VA but labor costs will not be recovered by the VA.

5.2 HARDWARE.

5.2.1 The AMAG service contract shall include integration of up to 400 existing cameras within Symmetry.

It should also plan to integrate an additional 50 new cameras in the future. These 50 new cameras will require new video software licenses in Symmetry paid for by this AMAG service contract.

5.2.2 The contractor shall install all hardware properly in accordance with the AMAG Technology installation instructions, U.S. Department of Veterans Affairs Physical Security and Resiliency Design Manual, VA Engineering Specifications, and VA Handbook 0730/4. If it is discovered that any door hardware or wiring is not installed to the AMAG standard the door will be corrected to meet the current approved AMAG installation standard by the contractor under this contract. This shall include but is not limited to wiring of all hardware at the door and AMAG Controllers. The contractor shall also be responsible for verifying and correcting any software configuration errors within the AMAG system including but not limited to the AMAG platform software on the VA owned virtual server and the SQL database. The contractor will provide support in correcting the current configuration to include but not limited to hours, time codes, holidays, schedules, predefined, and triggers. All work listed above will be covered under this contract before the system can be cleared as being stable.

5.3 FIRMWARE: A recent symmetry upgrade to 9.3.50 resulted in approximately three-hundred forty-two (342) EN1DBC HSE door controllers to go offline. AMAG has a firmware patch to resolve this issue. This patch will need to be pushed out to all 342 affected controllers. This will require the contractor to visit each OIT closet (approximately 76 locations), remove the comms cable(s) from the patch panel and plug into a laptop that has the firmware patch file and push the update out to the controller. The contractor shall ensure that all firmware upgrades are coordinated with the authorized government representative(s) to ensure a seamless upgrade without any loss or degradation of service at no additional cost to the government.

5.4 IDENTIFICATION, LABELING AND CREATION OF CAD DOCUMENTS. The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items necessary to identify, label and create CAD documents summarized as follows:

5.4.1 The contractor shall label all readers and both end of wires inside the existing AMAG enclosures.

5.4.2 The contractor shall create AutoCAD documents for all security equipment with locations of readers, encoders, enclosures, and badging station.

5.4.3 The contractor shall add AutoCAD drawings as required into the AMAG system and configured to work with alarms within the software.

5.4.4 The contractor shall provide hard copy AutoCAD drawings to the Police Service Physical Security Specialist.

5.4.5 The contractor shall identify all wiring, programming, and installation issues and correct to AMAG standards.

5.4.6 The contractor shall verify all existing floor plan graphics are accurate and shall maintain/update graphics for all new installs under this scope and additions built by 3rd party contractors (see site description for anticipated quantity of new card readers to be installed and programmed by 3rd party contractors. VAMC Chillicothe will provide all floor plan files in AutoCAD format (gov’t furnished information.

5.5 SUPPORT REQUESTS AND REPORTS. The contractor shall provide a Web Based Support Site so that the CVAMC staff can request and track all support calls. The website must give the CVAMC System the ability to open support tickets and track status, 24/7. The CVAMC shall have the ability to login to the support website and run reports of past support tickets every quarter. This is required in accordance with policy due to this being a high-priority of the system.

5.6 ON-SITE RESPONSE REQUIREMENTS.

5.6.1. HIGH PRIORITY SUPPORT REQUEST. The contractor shall provide CVAMC whenever the AMAG system is experiencing a 50% to 100% system outage, or a server is down, a 2-hour call back after the work request has been submitted and a 4 hour, (weather permitting) on-site response. This will also include High priority doors to sensitive areas to include but not limited to the following:

5.6.1.1 Canteen Office.

5.6.1.2 Agent Cashier

5.6.1.3 Pharmacy Drug Storage areas

5.6.1.4 IT Server Room and Data Closets

5.6.1.5 Telephone Equipment room

5.6.1.6 Evidence Storage room

5.6.1.7 Weapon Storage/Armory

5.6.1.8 Laboratory

5.6.1.9 Nuclear Medicine Hot room

5.6.1.10 IT Equipment Storage room

5.6.1.11 Pharmacy Dispensing Areas

5.6.1.12 Inpatient Wards and Treatment Areas

5.6.1.13 Police Operations Office

5.6.1.14 Inpatient Wards and Treatment Areas

5.6.1.15 Police Operations Office

5.6.1.16 Commercial Electric, Telecommunications/Data Connections areas

5.6.1.17 Warehouse

5.6.1.18 Pharmacy Cache

5.6.1.19 PIV Room

5.6.2 LOW TO MEDIUM PRIORITY SUPPORT REQUESTS. The contractor shall provide an AMAG certified technician onsite with 24 to 72 hours if the AMAG system is experiencing up to a 50% system outage which shall include all other areas not listed above.

5.6.3 REMOTE SYSTEM ACCESS. The preferred method of technical support is on-site, however, when issues arise that require more critical AMAG support, a method of on-line support via VA staff workstation is available for limited use. The contractor shall only remote access the CBOC’s AMAG system from CVAMC main campus. In addition, the contractor shall provide software updates to client computers located at the CBOC’s onsite at the

CBOC.

5.7 SYSTEM SOFTWARE AND LICENSING. The contractor shall update all existing AMAG system software and licenses (including SSA’s) to keep the system current and operating properly. Any new software or licenses that may be required will be installed and maintained by the contractor. After each software upgrade, the contractor will be required to verify proper operation of the card readers (including at each of the 5 CBOC’s).

5.7.1 See Appendix #1 for current software version but keep in mind that this will change with each update that is required under this contract.

5.7.2 See Appendix #2 for a list of the current licenses installed in the system. This list may change as new devices are added to the system under this contract and future building addition contracts.

5.8 CONTROL CABINET BACKUP BATTERIES. The contractor shall ensure that all control cabinet backup batteries are replaced within 90 days of contract award, and again every 2 years.

5.9 YEARLY OPERATOR TRAINING. The contractor will provide on-site operator training on the system, (within 30 days of contract award and renewal), for new Employees and for all new system operating options yearly.

Scheduling of training will be coordinated through CVAMC Physical Security Specialist.

5.10 PERFORMANCE MONITORING.

5.10.1 The COTR will maintain a record for Service Calls and daily reports during door installations.

5.10.2 The COTR and or Approved VA alternate will visually inspect work site of door installations for cleanliness and that the ICRA and ILSM are posted and followed.

5.10.3 The COTR will monitor and report to the CO, quarterly or more frequently, if problems become trending, on contract completion percentage in relation to stated delivery dates.

5.11 SECURITY REQUIREMENTS. There will be access to VA Sensitive Information in the form of Staff Personal Identifiable Information, PII with this contract. The contractor will need access to the AMAG Security Management System database server. If the contractor needs access to any Sensitive Areas, the Contractor will be escorted by CVAMC Physical Security Specialist or designee (see security requirements documents in appendix 1 and appendix 2 below).

5.12 OTHER PERTINENT INFORMATION OR SPECIAL CONSIDERATIONS.

5.12.1 CERTIFICATIONS. The contractor shall be an AMAG Certified Reseller in good standings with AMAG and must have a Certified Systems Engineer ICAM PACS (CSEIP) on staff. The contractor must provide a copy of their AMAG certification card, showing they are in good standing. The contractor shall have at minimum

(2) current Certified Symmetry Essentials AMAG Installers. This is needed to maintain a high level of support at all times. All work performed on AMAG Servers and Workstations by the Contractor must also be performed by a Certified Symmetry Essentials AMAG Installers.

5.12.2 IDENTIFICIATION OF POSSIBLE FOLLOW-ON WORK. This contract is for a base year with four option years. Sections 5.1 through 5.8 will renew each option year and include coverage for additional equipment installed during all previous option periods.

5.12.3 IDENTIFICATION OF POTENTIAL CONFLICTS OF INTEREST (COI). There is no conflict of interest at this time however the contractor shall notify the government representative(s) if there is one.

5.12.4 IDENTIFICATION OF NON-DISCLOSURE REQUIREMENTS. The contractor shall ensure that Personal Identifiable Information, (PII) is accessible and a disclosure agreement shall be required for all contract personnel.

5.12.5 PACKAGING, PACKING AND SHIPPING INSTRUCTIONS. If the contractor is unable to transport necessary equipment and materials, or additional equipment and materials are needed while they are on-site, the equipment may be shipped to the CVAMC warehouse. CVAMC will not be responsible for storing or securing any contractor equipment or materials. The address for the VA Police which shall be coordinated by the contractor in advance of prior to any shipment is summarized as follows:

Chief David Petrie Chief of Police Chillicothe VAMC W (740)773-1141 ext. 7273 C (740)649-5983

5.12.6 INSPECTION AND ACCEPTANCE CRITERIA. The COTR or designated VA alternate will be responsible for certifying that the work done under the contract is performed to time and standard. They are also responsible for assuring the inspection and acceptance of products provided are incidental to services.

5.12.7 FACILITY POLICIES. The contractor shall comply with all Chillicothe VA Medical Center policies and regulations.

5.12.8 OSHA TRAINING. The contractor shall ensure during new equipment and door installations that the onsite supervisor has his or her 30-hour OSHA card and onsite techs have their 10-hour OSHA card.

5.12.9 FIREWALL PENETRATIONS. The contractor shall that all penetrations made through firewalls are approved UL listed penetrations. All penetrations shall be inspected by COTR or designated VA replacement.

5.12.10 INFECTIOUS CONTROL RISK ASSESSMENT (ICRA) AND INTERIM LIFE SAFETY MEASURES (ILSM). The contractor shall keep in their possession in plain sight their signed ICRA and ILSM for the installation job they are performing, for the duration of the job. For installation of new card readers the contractor shall comply with the following requirements:

5.12.10.1 During Construction Work:

5.12.10.1.1 Obtain permit from the Contracting Officer’s Technical Representative.

5.12.10.1.2 Remove or Isolate HVAC system in area where work is being done to prevent contamination of duct system.

5.12.10.1.3 Complete all critical barriers i.e. sheetrock, plywood, plastic, to seal area from non-work area or implement control cube method (cart with plastic covering and sealed connection to work site with HEPA vacuum for vacuuming prior to exit) before construction begins. Install construction barriers and ceiling protection carefully.

5.12.10.1.4 Maintain negative air pressure, 0.01 inches of water gauge, within work site utilizing HEPA equipped air filtration units and continuously monitored with a digital display, recording and alarm instrument, which must be calibrated on installation, maintained with periodic calibration and monitored by the contractor.

5.12.10.1.5 Contain construction waste before transport in tightly covered containers.

5.12.10.1.6 Cover transport receptacles or carts. Tape covering unless solid lid.

5.12.10.2 Upon Completion:

5.12.10.2.1 Do not remove barriers from work area until completed project is inspected by the Contracting Officer’s Technical Representative and thoroughly cleaned by the VA Environmental Services Department.

5.12.10.2.2 Remove construction barriers and ceiling protection carefully to minimize spreading of dirt and debris associated with construction, outside of normal work hours.

5.12.10.2.3 Vacuum work area with HEPA filtered vacuums.

5.12.10.2.4 Wet mop area with cleaner/disinfectant.

5.12.10.2.5 Upon completion, restore HVAC system where work was performed.

5.12.10.2.6 Return permit to the Contracting Officer’s Technical Representative

5.12.11 CONTRACTOR’S EQUIPMENT AND LADDERS. The contractor shall ensure their tools and equipment are in good working order and have all the appropriate OSHA decals for use on the facility.

5.13 PRE-BID SITE VISIT. All offerors may have the opportunity for a site visit as specified in the solicitation as time permit prior to submission of offer not later than the offer due date.

5.14 RISK CONTROL. The contractor shall take the necessary precautions when an approved ICRA and ILSM for work completed puts the staff and/or patients at risk.

5.15 VA INFORMATION CUSTODIAL LANGUAGE.

5.15.1 Information made available to the prime contractor or their subcontractors through the prime contractor by VA for the performance or administration of this contract or information developed by the contractor and their subcontractors in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

5.15.2 The prime contractor and their subcontractor(s) shall store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

5.16 INFORMATION SYSTEMS HOSTING, OPERATIONS, MAINTENANCE OR USE:

5.16.1 Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes with options summarized as follows:

5.16.1.1 Vendor must accept the system without the drive;

5.16.1.2 VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

5.16.1.3 VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

5.16.1.4 Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

5.16.1.4.1 The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact; and

5.16.1.4.2 Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be preapproved and described in the purchase order or contract.

5.16.1.4.3 A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed. The ISO needs to maintain the documentation.

5.17 SECURITY INCIDENT INVESTIGATION

5.17.1 The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

5.17.2 To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

5.18 LIQUIDATED DAMAGES FOR DATA BREACH

5.18.1 Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

However, it is the policy of VA to forgo collection of liquidated damages in the event the contractor provides payment of actual damages in an amount determined to be adequate by the agency.

5.18.2 Based on the determinations of the independent risk analysis the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

5.18.2.1 Notification;

5.18.2.