ATTACHMENT 1 PERFORMANCE WORK STATEMENT.docx

ATTACHMENT 1: PERFORMANCE WORK STATEMENT

ACUTE DIALYSIS SERVICES

For the

BOISE VA MEDICAL CENTER (BVAMC) BOISE, IDAHO

1.0. GENERAL:

1.1. Authority: Title 38 USC 8153/ VA Directive 1663

1.2. Services Required: Contractor to provide the services of a qualified Registered Nurse (RN) to provide Acute Bedside Dialysis Services to eligible patients of the Department of Veterans Affairs Medical Center, Boise, ID (BVAMC) for one base year with four option years. Approximately 125 patients are admitted to the hospital that requires dialysis. Boise VAMC does not have internal dialysis services available. This contract is to fill the dialysis needs of inpatients.

1.3. Place of Performance: Services are to be provided at the Department of Veterans Affairs Medical Center, 500 West Fort Street, Boise, ID 83702. No travel, lodging or per diem is authorized. Contractor personnel must be present at this facility and must perform the required services for the period specified in the contract. Offeror must be located within a 50-mile radius of the VA Medical Center, Boise, ID.

2.0. CONTRACT PERSONNEL QUALIFICATIONS:

2.1. Qualifications: Registered Nurses (RN) assigned by the Contractor to perform the services covered by this contract shall have the minimum qualifications shown in the following paragraphs. The Contractor must verify RN qualifications. A file on each RN providing services under this contract will be kept at the Boise VAMC Nursing Services Office. The qualifications of such personnel shall be subject to review and approval by the COR. Contractor agrees to submit proof of qualifications identified below prior to RN’s performing services at the Boise VAMC. Contractor agrees to allow access to employee files at their site upon request by the COR.

· RNs must have a current valid and unrestricted license in a State, Territory or Commonwealth of the United States or the District of Columbia.

· RNs must have competency in assignment.

· RNs provided must have a current certification in Basic Life Support (BLS) and must keep it current.

· RNs must have a negative PPD within the last year, or if a known reaction, a negative chest x-ray within the past year.

· RNs must have immunity against Hepatitis B (Hepatitis B-Surface Antibody Titer) or declination that vaccine was refused.

· RNs education level of a BSN preferred but not required.

2.1.1. License: The dialysis providers called for in this contract must have an unrestricted license in a US state, territory or US commonwealth. Proof of licensure must be provided to the BVAMC upon contract acceptance and yearly thereafter. The qualifications of such personnel shall also be subject to review and approval by the Chief of Staff and the ACOS for Medical Service.

2.1.2. Continuing Medical Education (CME)/ Certified Education Unit (CEU) Requirements: Contractor must maintain appropriate CME/CEU as required by state licensing to maintain nursing.

2.1.3. Credentialing and Privileging: Contractor must enter all staff that will perform services under this contract through the VA VetPro credentialing process for board certification and eligibility.

2.1.4. Registered Nurses (RN) assigned by the Contractor to perform the services covered by this contract shall have the minimum qualifications outlined in the following paragraphs. The Contractor must verify RN qualifications. A file on each RN providing services under this contract will be kept on file at the Boise VAMC Nursing Services Office. The qualifications of such personnel shall be subject to review and approval by the COR. Contractor agrees to submit proof of qualifications identified below prior to RN’s performing services at the Boise VAMC.

2.1.5. Training: Contractor staff must have Basic Life Support (BLS) and maintain it at the contractor’s expense. Contractor will complete a competency verification checklist for each RN. Contractor will also have all RNs complete the orientation modules provided by the Boise VAMC. Contractor will complete VA Privacy and Information Security Awareness and Rules of Behavior training and Privacy and HIPAA training through the VA computer training program. Competency checklist, orientation modules answer sheet and verification of computer training must be submitted to the BVAMC prior to the start of service. In addition, all RNs must complete a facility orientation training provided by the contractor. Verification of facility orientation shall be submitted to the COR upon completion.

2.1.6. Standard Personnel Testing:

· RNs must have a negative PPD within the last year, or; if a known reaction, a negative chest x-ray within the past year.

· RNs must have immunity against Hepatitis B (Hepatitis B-Surface Antibody Titer) or declination that vaccine was refused.

2.1.7. National Provider Identification (NPI): Covered health care providers and all health plans and health care clearinghouses must use the NPIs in the administrative and financial transactions adopted under HIPAA.

2.1.8. Conflict of Interest: The Contractor shall not employ any person who is an employee of the United States Government if the employment of that person would create a conflict of interest. The Contractor shall not employ any person who is an employee of the Department of Veterans Affairs unless such person seeks and receives approval in accordance with VA Regulations and public law. Nor shall the Contractor employ any person who is a member of the immediate family of a VA employee employed at the BVAMC if the employment of that family member would create a conflict of interest or the appearance of a conflict of interest, particularly with regard to influencing the contract negotiations, terms of the contract or the work carried out under the contract. In any such case, VA must review the matter and give its approval in accordance with agency ethics rules.

2.1.8. Citizenship related Requirements: U.S. citizenship is required in the event no qualified citizens are available in accordance with current regulations non-citizens may be appointed. Employees must be proficient in reading, speaking and understanding the English language.

2.1.9. Annual Office of Inspector General (OIG) Statement: To ensure that the individuals providing services under the contract have not engaged in fraud or abuse regarding Sections 1128 and 1128A of the Social Security Act regarding federal health care programs, the contractor is required to check the Health and Human Service – Office of Inspector General, List of excluded individuals/entities on the OIG Website (www.hhs.gov/oig) for each person providing services under this contract. Further the contractor is required to certify in its proposal that all persons listed in the contractor’s proposal have been compared against the OIG list and are not listed. During the performance of this contract the Contractor is prohibited from using any individual or business listed on the List of Excluded Individuals/Entities.

2.2. Non-Personal Services: The service portion of this contract is a non-personal health care services contract. The Government will evaluate the quality of professional and administrative services provided but retains no control over the medical and professional aspects of the services rendered.

2.2.1. No Employee status: Personnel rendering the services are not subject, either by the contract terms or by the manner of its administration, to the supervision and control usually prevailing in relationship between the Government and its employees. The Contractor shall be fully responsible for the actions of its employees and shall indemnify the Government for any liability producing act or omission by the contractor, its employees and agents occurring during contract performance.

2.3. Key Personnel and Emergency Substitutions: The contractor shall identify, in writing, at least one individual (key personnel) who has the authority to fully represent the contractor in all contracting matters, including all day-to-day matters. No substitutions or changes may be made in the first ninety (90) days of the contract.

3.0. HOURS OF OPERATION:

3.1. Business Hours: Inpatient Care is a 24/7 operation and may require Acute Dialysis at any time. Work will be dependent upon patient needs; therefore, schedule will vary. Workdays may include weekdays, weekends, off tours, and holidays.

3.1.1. Definitions: Contractor’s employee must be present at the VA facility during scheduled working hours and must be performing the required services identified in the Performance Work Statement or the cost will be decreased accordingly during each billing cycle. In the event the VA incurs additional cost for ensuring patient care is maintained due to the Contractor’s employee missing a shift, the Contractor shall be responsible for those costs. The payments for holiday time and for any leave, including sick leave or vacation time is the responsibility of the contractor. The services covered by this contract shall be furnished by the Contractor during work hours as defined herein. The Contractor will not be required, except in case of an emergency, to furnish such services on a national holiday or during non-working hours as described below.

3.1.2. Work Schedule: See 3.1.

3.1.3. Federal Holidays: The ten holidays observed by the Federal Government are:

· New Year’s Day

· Martin Luther King, JR’s Birthday

· Washington’s Birthday

· Memorial Day

· Juneteenth National Independence Day

· Independence Day

· Labor Day

· Columbus Day

· Veterans Day

· Thanksgiving Day

· Christmas Day

· Plus, any other day specifically declared by the President of the United States to be a national holiday.

3.1.4. Cancellation Policy: If services are requested by Boise VAMC designated staff for Acute Dialysis services, it is the expectation that services be provided without cancelation from contractor. Contractor personnel must be present at this facility and must perform the required services for the period specified in the contract.

4.0. CONTRACTOR RESPONSIBILITIES:

4.1. Services Required: The exact schedule of the Dialysis services, to include, Hemodialysis, Peritoneal Dialysis and full service Continuous Renal Replacement Therapy (CRRT), will be determined by a mutual agreement between the VA Chief of Staff or designee, the contractor and the COR. It is understood that efficiency of patient care is the critical factor in determining this schedule.

4.1.1 The contractor must furnish all equipment required to perform contract requirements. Contractor shall retain the responsibility for maintaining equipment in good working order and repair if necessary, so that contract requirements are met. The contractor will supply the following items: Continuous Renal Replacement Therapy cartridges, PD solutions, HD solutions, tubing, needles, and cleaning supplies, such as bleach and vinegar.

4.1.2. The Government does not assume any liability, nor will the government reimburse the contractor for any damage or theft to this equipment resulting in any way from the performance of this contract. Contractor must provide and maintain insurance coverage as deemed necessary if damage or theft may occur.

4.1.3. Contractor shall ensure that adequate preventative maintenance is performed on dialysis equipment on a regular basis to ensure patient safety. Contractor shall provide semi-annual reports consisting of copies of maintenance records, downtime and equipment safety certifications. These reports shall be submitted at the time of contract award and every six months thereafter through the life of the contract.

4.1.4. Contractor shall clean the dialysis equipment according to the manufactures recommend process after each use. The contractor shall provide a copy of the manufacturer’s recommendations for cleaning the machines to Boise VAMC and a copy of the contractor’s Standard Operating Procedure for disinfecting the machine.

4.1.5. Contractor will ensure that all equipment is stored in accordance with VHA policy.

4.1.6. Contactor will maintain logs verifying when all weekly, monthly and quarterly cleaning and maintenance of the equipment is completed.

4.1.7. The contractor is required to submit reports demonstrating a compliance level of no less 90% in the following areas: maintenance of vascular access site, compliance with dialysis prescription, assessment/reassessment of pain, patient education regarding treatment documented and hand off communication to hospital RN is documented.

4.1.8. Contractor shall have a Performance Improvement Plan, collect data and submit the information to the Department of Veterans Affairs, at least quarterly.

4.1.9. The services to be performed by the contractor will be performed within the VA policies, procedures and regulations.

4.1.10. Contractor will transact business only with the appropriate offices of the VA and in no case deal directly with, or solicit from beneficiaries of the VA.

4.2. Standards of Practice:

a. Contractor shall be responsible for meeting or exceeding VA and Joint Commission (or equivalent) standards.

b. The contractor shall be responsible for protecting the personnel furnishing services under this contract. To carry out this responsibility, the contractor shall provide the following for these personnel:

· Worker’s compensation

· Professional liability insurance

· Health examinations income tax withholding, and

· Social Security payments

4.2.1. CONTRACTOR STANDARDS: Contractor is responsible for developing and maintaining written policies and procedures for licensure and certification, competency evaluation, orientation and continuing education, which are appropriate for the scope of care and services provided by employees and subcontractors under this contract.

4.3. Resident Supervision and Teaching: N/A

4.4. Medical Records: The Contractor shall document the services provided, in accordance with the documentation policies of the VA. The documentation will be given to the Ward Clerk to be scanned into the patient’s electronic medical record. VA policies shall stipulate the use of the Contractor’s standard forms related to the provision of dialysis services. VA policies shall include, but not be limited to, procedure and schedule for bacteriological and chemical water testing, procedure and schedule to assure sterility and/or cleanliness of the equipment before each dialysis, and infection control procedures for the prevention and control of hepatitis. Any changes in VA policies regarding inpatient dialysis services shall be subject to joint development with the Contractor and agreed to by both parties.

4.4.1. Authorities: By performing services under this contract, the Contractor is considered part of the VA healthcare activity for purposes of the following statutes and respective regulations implementing these statutes: Title 5 U.S.C Section 552a (Privacy Act), Title 38 U.S.C. Section 5701, Title 38 U.S.C. Section 5705, Title 38 U.S.C Section 7332, and Public Law 104-191 (HIPAA).

4.4.2. HIPAA: Contractor will complete VA Privacy and Information Security Awareness and Rules of Behavior training and Privacy and HIPAA training through the VA computer training program. Competency checklist, orientation modules answer sheet and verification of computer training must be submitted to the BVAMC prior to the start of service.

4.4.3. Disclosure: Any contract resulting from this solicitation will be subject to the Privacy Act of 1974. Federal Acquisition Regulations 52.224-1 Privacy Act Notification and 52.224-2 Privacy Act are incorporated by reference.

4.4.4. Professional standards for documenting care: Contract personnel are responsible for ensuring that their documentation practices are in accordance with all applicable state and federal regulations. SEE VHA HANDBOOK 1907.01, HEALTH INFORMATION MANAGEMENT AND HEALTH RECORDS.

http://www1.va.gov/vhapublications/ViewPublication.asp?pub_ID=1469

4.4.5. Release of Information:

a. Contract personnel shall have access to patient medical records/information and general files only to the extent necessary to perform their contractual duties. Contract personnel shall only release medical information obtained during this contract to those VA medical staff members involved in the necessary care and treatment of the individual patient to which the information pertains. Notwithstanding any other clause and/or provision of this contract, if a request for release or disclosure of information is not necessary for the care and treatment of an individual patient, the Contractor and contract personnel shall not disclose any information contained in general files, patient records, and/or any other individually identifiable health information, including information and records generated by the Contractor in performance of this contract, except pursuant to explicit instruction and written approval from VA. For the purposes of this paragraph, instruction to disclose or copy such records and/or information may be provided by the following only: VA Regional Counsel, Chief, Health Information Management Services, or Privacy Officer through the VA Contracting Officer. Violation of the statutes may result in criminal and/or civil penalties.

b. Contract RN and VA Staff RN will complete an SBAR (Situation, Background, Assessment, Recommendation) hand off form before starting the treatment. The SBAR form is to be used to facilitate prompt and appropriate communication regarding the patient’s healthcare information. The SBAR form will be scanned into the patient’s record by the Ward Clerk.

c. Information or records accessed and/or created by the Contractor while performing services under this contract are the property of the VA and shall not be accessed, released, transferred, or destroyed except in accordance with applicable federal law, regulations, and/or VA/VHA policy. The Contractor will not copy information contained in VA information systems, either by printing to paper or by copying to another digital format, without the explicit instruction and written approval from of the VA officials, except as is necessary to make single copies in the ordinary course of providing patient care. The Contractor will not commingle the data from VA information systems with information from other sources. Contractor shall report any unauthorized disclosure of VA information to the VA officials.

5.0. DIRECT PATIENT CARE:

5.1. Appearance:

· Contractor employees shall always wear agency identification badges as well AS VA badge while on the premises of the BVAMC.

· All Contractor employees shall maintain a neat personal appearance and maintain a professional decorum.

· Uniforms are not required; scrub suits may be worn.

· Contractor employees are required to always wear closed-toed shoes when working at the BVAMC.

· Contractor employees shall not wear heavy perfume.

· Contractor employee may not have fingernails that exceed ¼ inch. Artificial fingernails are not authorized.

5.1.1. Contractor employees shall wear special protective clothing when required. These protective clothing items will be supplied by the BVAMC and will remain the property of the BVAMC. Damage to this clothing will be at the Contractor's expense.

5.2. Contractor shall be responsible for:

5.2.1. Provide Acute Bedside Dialysis Services to eligible patients of the Department of Veterans Affairs Medical Center, Boise, ID (BVAMC).

5.2.2. Summary invoices shall be submitted weekly or monthly, in areas performing service. Contract number must be referenced on all correspondence, sales slips, delivery tickets, receipts, invoices and/or billings. Payments will be made upon receipt of a properly prepared, certifiable invoice to include purchase order number, contractor’s name, address and telephone number, name of contract personnel providing service, hours and date service provided and amount billed. All invoices from the Contractor shall be submitted through the Invoice Payment Processing System (IPPS).

6.0. ADMINISTRATIVE:

6.0.1. CONTRACT ADMINISTRATION: The Contracting officer is the only person authorized to approve changes or modify any of the requirements of this contract. The contractor shall communicate with the contracting officer on all matters pertaining to contract administration. Only the contracting officer is authorized to make commitments or issue changes which affect price, quantity or performance of this contract.

6.0.2. The services may be changed by written modification to this contract. The modification will be prepared by the VA contracting officer and, prior to becoming effective, shall be approved by the VA Chief of Staff or his/her designee.

6.0.3. In the event of the contractor effects any such change at the direction of any person other than the contracting officer, the change shall be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in cost incurred as a result thereof.

6.1. Contractor shall be responsible for:

6.1.1. Task 1: Contract Nurses must be generally acquainted with the hospital fire and disaster procedures and infection control and hand hygiene practices.

7.0. GOVERNMENT RESPONSIBILITIES: The government will supply a secure storage room for the equipment and supplies provided by the contractor.

7.1. Oversight of Service/Performance Monitoring:

7.1.1 The Contracting Officer will appoint individuals identified as Contracting Officer’s Representative (COR), in writing, who are authorized to place individual orders under this contract. These individuals may issue individual verbal or written orders to the Contractor(s) for nursing support. The terms and conditions of this contract will be applicable to the resulting contract (individual orders). BVAMC will not pay for services ordered by unauthorized individuals.

7.1.2. The Nursing Service Administrative Officer will be appointed Contracting Officer Representative (COR) upon award of this contract, and pursuant to the Delegation of Authority to be issued, will be responsible for verifying contract compliance.

7.1.3. The COR will periodically evaluate workload accomplished during the contract period to assure necessary services are consistently provided.

7.1.4. The contractor will be monitored through a variety of mechanisms, including but not limited to sign in/outs, chart documentation of patient diagnosis, treatment and/or follow up procedures, QA monitors designed to assess the quality of care provided, logbooks to document and number of procedures completed.

7.1.5. The COR will be responsible for monitoring the quality of services provided under this contract.

8.0. PERFORMANCE STANDARDS, QUALITY ASSURANCE AND QUALITY IMPROVEMENT:

8.1. The contractor is required to submit reports demonstrating a compliance level of no less than 90% in the following areas: maintenance of vascular access site compliance with dialysis prescription, assessment/reassessment of pain, patient education regarding treatment documented and hand off communication to hospital RN is documented.

8.2. Performance Standards: The COR will be responsible for monitoring the quality of services provided under this contract. The contractor will be monitored through a variety of mechanisms, including but not limited to sign in/outs, chart documentation of patient diagnosis, treatment and/or follow up procedures, QA monitors designed to assess the quality of care provided, logbooks to document and number of procedures completed. See attached QASP for performance requirements, standards, acceptable quality levels, and method of surveillance.

9.0. SPECIAL CONTRACT REQUIREMENTS

9.1. CONTRACTOR Security Requirements:

a. Contractor will only have access to such information as provided by the BVAMC as required to provide medical care as described in this PWS.

9.2. Liquidated Damages for Data Breach:

a. Consistent with the requirements of 38 U.S.C. 5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a "security incident" as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data.

Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) Date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data considering the degree of protection for the data, e.g., unencrypted, plain text.

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least three (3) relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One (1) year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

Appendix A – SPECIAL CONTRACT REQUIREMENTS

Under the authority of Public Law 104-262 and 38 USC 8153, the contractor agrees to provide Health Care Resources in accordance with the terms and conditions stated herein, to furnish to and at the Department of Veterans Affairs Medical Center, Boise, ID VAMC (BVAMC), the services and prices specified in the Section entitled Schedule of Supplies/Services of this contract.

1. SERVICES:

a. The services specified in the Sections entitled Schedule of Supplies/Services and Special Contract Requirements may be changed by written modification to this contract.

b. Other necessary personnel for the operation of the services contracted for at the VA will be provided by the VA at levels mutually agreed upon which are compatible with the safety of the patient and personnel and with quality medical care programming.

c. The services to be performed by the contractor will be performed in accordance with VA policies and procedures and the regulations of the medical staff by laws of the VA facility.

2. TERM OF CONTRACT:

This contract is effective 01 December 2025 through 30 November 2026, plus 4 one-year options that may be exercised by the VA. The contract is subject to the availability of funds. The contractor shall perform no services after September 30 of any year until the Contracting Officer authorizes such services in writing.

3. QUALIFICATIONS:

Personnel assigned by the Contractor to perform the services covered by this contract shall be licensed in a State, Territory, or Commonwealth of the United States or the District of Columbia. All licenses held by the personnel working on this contract shall be full and unrestricted licenses. The qualifications of such personnel shall also be subject to review by the VA Chief of Staff and approval by the VA Facility Director.

4. WORK HOURS:

a. The services covered by this contract shall be furnished by the contractor as defined herein. The contractor will not be required, except in case of emergency, to furnish such services during off-duty hours as described below.

b. The following terms have the following meanings:

(1) Work hours: Inpatient Care is a 24/7 operation and may require Acute Dialysis at any time. Work will be dependent upon patient needs; therefore, schedule will vary. Workdays may include weekdays, weekends, off tours, and holidays.

AND any other day specifically declared by the President of the United States to be a national holiday.

(2) Off-Duty hours: none

5. PERSONNEL POLICY:

The contractor shall be responsible for protecting the personnel furnishing services under this contract. To carry out this responsibility, the contractor shall provide the following for these personnel:

· general liability

· workers compensation

· professional liability insurance

· health examinations

· income tax withholding, and

· social security payments.

The parties agree that the contractor, its employees, agents and subcontractors shall not be considered VA employees for any purpose.

6. RECORD KEEPING:

The BVAMC shall establish and maintain a record keeping system that will record the hours worked by the contractor employee(s). Contractor's employee(s) shall report to the Administrative Officer, or designee upon arrival at the BVAMC.

7. CONTRACT PERFORMANCE MONITORING:

Monitoring of contractors’ time shall be demonstrated through sign-in/ sign-out sheets. The contractor shall be required to sign an attendance log upon reporting to work and departing from work. The COR shall be the VA official responsible for verifying contract compliance. After contract award, any incidents of contractor noncompliance as evidenced by the monitoring procedures shall be forwarded immediately to the Contracting Officer.

8. KEY PERSONNEL AND TEMPORARY EMERGENCY SUBSTITUTIONS:

The Contractor shall assign to this contract the following key personnel:

a. During the first ninety (90) days of performance, the Contractor shall make NO substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment. The Contractor shall notify the Contracting Officer, in writing, within 15 calendar days after the occurrence of any of these events and provide the information required by paragraph (c) below. After the initial 90-day period of the contract, the Contractor shall submit the information required by paragraph (c) to the Contracting Officer at least 15 days prior to making any permanent substitutions.

b. The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the Contracting Officer. Proposed substitutes shall have comparable qualifications to those of the persons being replaced. The Contracting Officer will notify the Contractor within 15 calendar days after receipt of all required information of the decision on the proposed substitutes. The contract will be modified to reflect any approved changes of key personnel.

c. For temporary substitutions where the key person will not be reporting to work for three (3) consecutive workdays or more, the Contractor will provide a qualified replacement for the key person. This substitute shall have comparable qualifications to the key person. Any period exceeding two weeks will require the procedure as stated above.

9. HHS/OIG:

To ensure that the individuals providing services under the contract have not engaged in fraud or abuse regarding Sections 1128 and 1128A of the Social Security Act regarding federal health care programs, the contractor is required to check the Health and Human Service – Office of Inspector General, List of excluded individuals/entities on the OIG Website (www.hhs.gov/oig) for each person providing services under this contract. Further the contractor is required to certify in its proposal that all persons listed in the contractor’s proposal have been compared against the OIG list and are not listed. During the performance of this contract the Contractor is prohibited from using any individual or business listed on the List of Excluded Individuals/Entities.

10. NATIONAL PROVIDER IDENTIFIER:

The National provider identifier (NPI) is a standard, unique 10-digit numeric identifier required by HIPAA. The Veterans Health Administration must use NPIs in all HIPAA-standard electronic transactions for individual (health care practitioners) and organizational entities (medical centers). The contractor shall ensure that the health care practitioners and/or medical center providing service under the contract obtains a NPI and provides it to the contracting officer.

11. ALTERNATE SECURITY LANGUAGE IN LIEU OF UPDATED VAAR DATA SECURITY CLAUSE FEBRUARY 2012:

A. Any contractor and/or subcontractor retained to do work for VA under this contract/order that requires the access, use, storage, modification, or transmission of VA Sensitive Personal Information (SPI) must follow and adhere to the security controls, enhancements, compensating controls, protocols, regulations, and VA directions as the Contracting Officer (CO) shall direct, including, but not limited to those derived from the Federal Information Security Management Act (FISMA), OMB Circular No. A-130 and VA Handbook 6500/6500.6. The contractor must report any data breach according to the protocols and timeframes in HB 6500.

B. If any contractor/sub-contractor retained to do work for VA under this contract/order requires access, use, etc., of VA SPI as aforesaid, and if an actionable data breach occurs because of the contractor/subcontractor’s acts, omissions, or negligence in following the VA-directed security controls, enhancements, compensating controls, protocols, and/or measures, including, but not limited to the sources above, the contractor/subcontractor is further subject to the statutory requirement to assess liquidated damages against contractors and/or subcontractors under 38 U.S.C. §5725 in the event of a breach of Sensitive Personal Information (SPI)/Personally Identifiable Information (PII). Said liquidated damages shall be assessed at $37.50 per affected Veteran or beneficiary. A breach in this context includes the unauthorized acquisition, access, use, or disclosure of VA SPI which compromises not only the information’s security or privacy but that of the Veteran or beneficiary as well as the potential exposure or wrongful disclosure of such information because of a failure to follow proper data security controls and protocols.

12. For all facsimile transmissions made under this contract, a facsimile cover sheet must be used, and the following statement must be included on said cover sheet:

“This fax is intended only for the use of the person or office to which it is addressed and may contain information that is privileged, confidential, or protected by law. All others are hereby notified that the receipt of this fax does not waive any applicable privilege or exemption for disclosure and that any dissemination, distribution, or copying of this communication is prohibited. If you have received this fax in error, please notify this office immediately at the telephone number listed above.”

APPENDIX B – IT CONTRACT SECURITY

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor while performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above- mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. SECURITY INCIDENT INVESTIGATION

a. The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/ subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/ subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. 5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a "security incident" as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) Date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text.

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to…