Attachment 1- SOW for VISN 19 Zeiss Eye Clinic Ophthalmology Endpoints.docx

Statement of Work (SOW) Ophthalmology Endpoint Replacements and Upgrades

VISN 19 Rocky Mountain Network: Ophthalmology End Point Replacement and Upgrade Statement of Work

Version 2 03/03/2022

Contents

I. Background:

VISN19 is seeking to replace/upgrade existing Zeiss equipment in ophthalmology/eye clinic departments. The sites applicable for this procurement include VA Montana Health Care System (FHM), VA Cheyenne Health Care System (CHY), VA Eastern Colorado Health Care System (ECH), VA Salt Lake City Health Care System (SLC), Sheridan VA Medical Center (SHE), and Eastern Oklahoma VA Health Care System (MUS). In this equipment replacement it will include installation and connecting to the new FORUM server procured by EHRM IO (Electronic Health Record Modernization Integration Office). Optional tasks are added to anticipate growth. Currently CHY, and MUS have a FORUM server in place; FHM, ECH, SLC, and SHE do not have a FORUM server in place, but as mentioned EHRM IO procured FORUM to be put in place for all VISN 19 sites. Implementation of these replacement items shall be coordinated with EHRM IO installation of FORUM at VISN 19 sites, to try and eliminate duplicate work being done to integrate the devices to VA Network and Ophthalmology PACS system. Each site has their own existing VISTA/CPRS EHR system to integrate with. VISN 19 uses VISTA/CPRS EHR currently through anticipated year 2024 (subject to change) and will be migrating to VA Cerner EHR afterward.

The offers must include all hardware, software, and labor to fully implement the requirements in this document. The system shall support VA VMWare virtual server environment. All necessary software including third party software must be provided to implement these devices.

Table 1 – Locations

Sheridan, WY 82801

Table 2 – Package Items Summary

ECH

SLC

SHE

II. General Conditions:

III.

A. Definitions:

1. Acceptance Signature – COR, POC, or VA designee signature; indicates COR accepts work status as stated in SOW

2. ADT – Admissions, Discharges, and Transfers

3. CO – Contracting Officer

4. COR – Contracting Officer's Representative

5. CPMP – Contractor Project Management Plan

6. DICOM – Digital Imaging and Communications in Medicine

7. DMWL – DICOM Modality Work List

8. EHR – Electronic Health Record

9. ESR – Engineering Service Record/Report

10. FSE – Field Service Engineer

11. HCS – Health Care System

12. HL7 – Health Level 7 Standard

13. LDAP – Lightweight Directory Access Protocol

14. NIC – Network Interface Controller

15. OEM – Original Equipment Manufacturer

16. OI&T – Office of Information and Technology

17. PACS – Picture Archiving and Communication System

18. PHI – Protected Health Information

19. PIV – Personal Identification Verification

20. PMP – Project Management Plan

21. TRM – Technical Reference Model

22. VA – Department of Veterans Affairs

23. VAMC – Department of Veterans Affairs Medical Center

24. VHA – Veterans Health Administration

25. VISN – Veterans Integrated Service Network

26. VistA – Veterans Health Information Systems and Technology Architecture

27. VPN – Virtual Private Network

28. V&V – Verification & Validation

B. General Operation:

1. Vendor shall provide an electronic copy of user/training manual and service manual for all equipment received.

2. Vendor shall be in compliance with VA network security regulation according to VA Directive 6500 and 6550.

3. The vendor shall protect all finished spaces and surfaces at no additional cost to VISN 19. The vendor shall be responsible for paying for and repairing any damage or noted deficiencies to finished spaces and surfaces that occur as a result of the vendor’s (or associated sub-contractors) installation.

4. There are no dumpsters available for vendor use. Vendor shall be responsible for removal of all trash generated from installation.

C. Drawing Documents and Specifications:

1. Vendor shall provide, with their quote, a high-level network diagram to describe how the equipment will integrate with Vista/CPRS/Vista Imaging, FORUM server, and workstations as applicable.

2. Vendor shall provide a completed VA Pre-procurement assessment 6550 Appendix A form.

D. Check in and check out requirements: The vendor shall be required to report to Biomedical Engineering to check in. This check in is mandatory. When the service is completed, the FSE shall document services rendered on a legible Service Report(s). The FSE shall be required to log out with Biomedical Engineering and submit the Service report(s) to the Point oif Contact (POC) and Chief of Biomedical Engineering (or their representative). ALL service reports shall be submitted to the Chief of Biomedical Engineering or their representative for their “acceptance signature” and POC for an "authorization signature". If the POC is unavailable, a signed, authorized copy of the service report will be sent to the POC after the work can be reviewed (if requested or noted on the service report). Service report shall describe the work that was completed and list parts that were installed or replaced. A copy of the service report shall be signed and left with a representative of Biomedical Engineering prior to the departure of the service person.

E. Competency of personnel: All work shall be performed by an OEM certified field service engineer. All work performed shall be in accordance with commercial practices and the equipment manufacturer’s specifications.

F. Acceptance of work: Completion of all work is subject to the approval of the Biomedical Engineering personnel. When the work is deemed satisfactory and documentation is provided, representatives of Biomedical Engineering will indicate their approval on the Contractor’s service sheets prior to the Contractor’s departure.

G. Payment: - Invoices will be paid in arrears. Invoices, MUST INCLUDE, at a minimum, the following information: Contract No., Purchase Order No., and itemized cost.

H. Hours of Coverage:

1. Standard business hours are Monday through Friday from 7:00 am to 4:00 pm local time, excluding holidays.

2. Federal Holidays observed by the VAMC can be found at this website Federal Holidays (opm.gov)

IV. Functional and technical specifications:

A. The contractor shall provide all resources necessary to accomplish the deliverables as described in this statement of work (SOW), except as otherwise specified. The contractor shall provide all necessary labor, management, supervision, technical skills, quality control, materials, parts, tools, transportation, and equipment to complete upgrade, installation, and validation of the systems being procured below.

1. Optical Biometer – Qty: 4:

a. Central Topography that allows for:

i. Central corneal shape asymmetries taking into account posterior and anterior refractive powers.

b. Barrett measurement

i. Automatic calculation of Barrett TK Universal II, Barrett TK Toric and Barrett True K with TK.

c. Easy and intuitive reading of central corneal shape information

d. Keratometry measurement

i. Allowing for direct measurement and automatic measurement of the posterior corneal surface

e. Detect unusual eye geometries using Cornea-to-Retina Scans

f. Detect poor fixation so that you can correct and eliminate the risk of refractive surprises from incorrect measurements.

g. Show all measurement calipers to allow for visual verification of what structure has been measured.

h. Measurement Range:

i. Axial length: 14 – 38 mm

ii. Corneal Radii: 5-11 mm

iii. Anterior chamber depth: 0.7 – 8 mm

iv. Lens thickness:

· 1-10 mm (phakic eye)

· 0.13 – 2.5 mm (pseudophakic eye)

v. Central corneal thickness: 0.2 – 1.2 mm

vi. White-to-white: 8 – 16 mm

i. Display scaling:

i. Axial length: 0.01 mm

ii. Corneal radii: 0.01 mm

iii. Anterior chamber depth: 0.01 mm

iv. Lens thickness: 0.01 mm

v. Central corneal thickness: 1 µm

vi. White-to-white: 0.1 mm

j. SD of repeatability:

i. Axial length: 5 µm

ii. Corneal radii: 0.09 D

iii. Cylinder > 0.75 D, axis 3.8º

iv. Anterior chamber depth: 7 µm

v. Lens thickness: 6 µm

vi. Central corneal thickness: 2.5 µm

vii. White-to-white: 111 µm

k. IOL calculation formulas:

i. Barrett Universal II & Barrett TK Universal II

ii. Barrett toric & Barrett TK toric

iii. Barrett True K & Barrett True K with TK

iv. Haigis

v. Haigis-L

vi. Haigis-T

vii. Hoffer Q

viii. Holladay 1 and 2

ix. SRK/T

l. Minimum of two USB 2.0 ports

m. Ethernet port

n. DICOM license to allow connection to modality worklist, sending to FORUM, and sending to the EHR

o. Shall be able to connect to Zeiss FORUM

p. Illumination option reference image

q. YAG Table for system

r. Operating System must be Windows 10 LTSC or newer.

i. Operating System must not be end of life with-in the year of installation.

s. All cabling and peripherals shall be provided.

2. IOLMaster Windows OS Upgrade – Qty: 1:

a. Windows Operating System Upgrade required for existing IOLMaster 700. Windows upgrade must be Windows 10 LTSC or newer.

i. Operating System must not be end of life with-in the year of installation.

3. Ophthalmic Perimeter – Qty: 1:

a. Instrument that allows the measurement and evaluation of the area, visual field. Assists in determining the central and peripheral visual field and the areas of lost or depressed vision.

b. Comfortable headrest

c. Large, easily seen test stimuli

d. Ergonomic response button

e. Automated peripheral vision testing device

f. Test specifications:

i. Maximum temporal range: 30º

ii. Stimulus duration: 300 ms

iii. Visual field testing distance: infinity

iv. Background illumination: 100 cd/m10

g. Threshold test library:

i. N-30

ii. C-20

h. Screening test library:

i. C-20

ii. N-30

i. Screening test modes: age corrected

j. Fixation control: Heijl/Krakau blind spot monitor

k. Operator interface: LCD

l. Stimulus: Frequency doubling

m. General testing features: Stimulus sizes: 10º

n. Thermal printer

4. CIRRUS 5000 HD OCT Windows OS Upgrade – Qty: 2:

a. Windows Operating System Upgrade required for existing CIRRUS 5000 HD OCT. Windows upgrade must be Windows 10 LTSC or newer.

i. Operating System must not be end of life with-in the year of installation.

5. Optical Coherence Tomography (OCT) System, Advanced with Angiography – Qty: 4:

a. OCT system that provides 100,000 scans per second.

b. Methodology: Spectral domain OCT

c. Optical source: Superluminescent diode (SLD), 840 nm

d. A-scan depth: 2.0 – 2.9 mm (in tissue)

e. Scan speed: 100,000 A-scans per second

f. Minimum pupil diameter: 2.0 mm

g. Resolution:

i. Axial resolution: 5 µm (in tissue), 1.95 µm (digital)

ii. Transverse resolution: 15 µm (in tissue)

h. Refractive error adjustment: -20D to +20D

i. Fundus Imaging:

i. Methodology: Line Scanning Laser Ophthalmoscope (LSO)

ii. Optical Source: SLD 750 nm

iii. Field of view (degrees): 36x30

j. Posterior Segment Scans:

i. OCT:

· Cube scan (Macula and Optic Disc)

· HD Raster (1, 5, 21-line, cross and radial); Raster scan length 3-12 mm; image averaging up to 100x

ii. OCTA:

· 3x3, 6x6, 8x8, 12x12 mm (Macula); 4.5x4.5 mm (Optic Nerve Head); 14x10 mm (Montage), 14x14 mm (Montage)

k. Anterior Segment Scans: Cube, HD Cornea, Pachymetry, HD Angle, Wide Angle-to-Angle, Anterior Chamber, 5-line Raster

l. Minimum of four USB 2.0 ports

m. Ethernet port

n. 22” widescreen HD monitor with 1920x1080 resolution.

o. DICOM license to allow connection to modality worklist, sending to FORUM, and sending to the EHR

p. Shall be able to connect to Zeiss FORUM

q. Operating System must be Windows 10 LTSC or newer.

i. Operating System must not be end of life with-in the year of installation.

r. All cabling and peripherals shall be provided

6. Ophthalmic Perimeter, High End – Qty: 9:

a. Instrument that allows the measurement and evaluation of the area, visual field. Assists in determining the central and peripheral visual field and the areas of lost or depressed vision.

b. Provided Guided Progression Analysis to determine if visual field loss is progressing

c. Allow viewing of patient test history and easily change baselines.

d. Provide Progression Analysis Probability Plot to assist in identifying statistically significant progression events in consecutive visits at individual test points.

e. Provide Visual Field Index to help differentiate rapid versus slow progressing visual field loss.

f. Uses Liquid Trial Lens technology to reduce setup time by automatically loading the patient’s refractive correction from their previous exam.

g. Comfortable headrest

h. Ergonomic response button

i. Test specifications:

i. Maximum temporal range (degrees): 90

ii. Stimulus duration: 200 ms

iii. Visual field testing distance: 30 cm

iv. Background illumination: 31.5 ASB

j. Threshold Test library:

i. 24-2, 30-2, 10-2, Macula

ii. 50-4, Nasal step

k. Threshold Test Strategies: SITA Standard, SITA Fast, SITA Faster, Full Threshold, FastPac, SITA-SWAP

l. Suprathreshold Test Library: C40, C76, C80, C64, C-Armaly, Peripheral test patterns

m. Suprathreshold Test Modes: Age corrected, Threshold related, Single intensity

n. Special Test Library:

i. Social Security Disability, monocular, binocular

ii. Esterman monocular, binocular, superior 36, 64

iii. Kinetic Testing

iv. Custom Kinetic Testing

v. Custom Static Testing

o. Fixation Control: Heijl-Krakau blind spot monitor, video eye monitor, gase tracking, head tracking, vertex monitoring

p. Operator interface: touchscreen LCD and medical grade keyboard

q. Stimulus: white-on-white, red- or blue-on-white, Blue-on-yellow (SWAP)

r. Stimulus sizes: Goldmann I-V

s. Other general testing features: Foveal threshold testing, automatic pupil measurement, Liquid Trial Lens (AutoTLC), RelEYE eye review

t. Software features: single Field Analysis (SFA), Glaucoma Hemifield Test (GHT), Visual Field Index (VFI), Guided Progression Analysis (GPA), Mixed GPA, Serial field overview

u. Shall included all licensing required including:

i. Barrett suite license

ii. Central Topography license

iii. Keratometry license

iv. Illumination option reference image

v. Shall include YAG table

w. Minimum of two USB 2.0 ports

x. Ethernet port

y. DICOM license to allow connection to modality worklist, sending to FORUM, and sending to the EHR

z. Shall be able to connect to Zeiss FORUM

aa. Operating System must be Windows 10 LTSC or newer.

i. Operating System must not be end of life with-in the year of installation.

ab. All cabling and peripherals shall be provided

7. Corneal Topography System – Qty: 3:

a. Corneal Topography System that assists in determining the configuration of the anterior corneal surface and the refractive power by projecting concentric circular rings on the cornea.

b. Technical Specifications shall meet the following:

i. Field of view: minimum of 17 mm x 14.5 mm

ii. Placido Rings: 22 (18 superiorly, 22 inferiorly)

iii. Illumination source: non-visible infrared (950nm) LED

iv. Optics: Digital CMOS camera with 1280x1024 pixel resolution

v. Curvature:

· Measurement range: 15 to 95 (3.5 to 22.5 mm)

· Accuracy: ±0.05 D (±0.01 mm)

· Reproducibility: ±0.10 D (±0.02 mm)

vi. HVID (white to white):

· Measurement range: 10.0 to 14.0 mm

· Resolution: 0.1 mm

vii. Pupillometry:

· Acquired Images: Scotopic and photopic (700 nm)

· Measurement range: 0.5 to 11.0 mm

· Resolution: 0.1 mm

viii. Views:

· Axial Curvature

· Tangential Curvature

· Elevation (Best-Fit Sphere)

· Irregularity (Best-Fit Ellipsoid)

· Videokeratoscopic (Rings, Scotopic, Photopic)

· Keratometry

· Refractive Power

· Mean Curvature

· Corneal Wavefront

· Image Simulation

· Point spread Function (PSF)

· Modulation Transfer Function (MTF)

ix. Presentation Displays:

· Single View

· Overview

· OD/OS Comparison

· Difference

· Trent with Time, Trend analysis

x. Software shall include:

· PathFinder II Corneal Analysis Software

· MasterFit II Contact Lens Software

· ATLAS Review Software

· Cone-of-Focus alignment system

· DICOM Gateway

· Wave Contact Lens Software

xi. All in one System

c. Cone-of-Focus Alignment System and Arc-Step algorithm to deliver sub-micro elevation accuracy

d. SmartCapture that analyzes 15 digital images per second during alignment and selects the highest quality image.

e. Provide key topographical information needed to enhance IOL power calculation and IOL selection

f. Provide repeatable, reliable results

g. Shall be compatible with existing Carl Zeiss Atlas data

h. DICOM license to allow connection to modality worklist, sending to FORUM, and sending to the EHR

i. Shall be able to connect to Zeiss FORUM

j. Operating System must be Windows 10 LTSC or newer.

i. Operating System must not be end of life with-in the year of installation.

k. All cabling and peripherals shall be provided.

l. Applicable power table for the corneal topography system shall be provided.

8. Optical Coherence Tomography (OCT) System – Qty: 7:

a. OCT system that provides 100,000 scans per second.

b. Methodology: Spectral domain OCT

c. Optical source: Superluminescent diode (SLD), 840 nm

d. A-scan depth: 2.0 – 2.9 mm (in tissue)

e. Scan speed: 100,000 A-scans per second

f. Minimum pupil diameter: 2.0 mm

g. Resolution:

i. Axial resolution: 5 µm (in tissue), 1.95 µm (digital)

ii. Transverse resolution: 15 µm (in tissue)

h. Refractive error adjustment: -20D to +20D

i. Fundus Imaging:

i. Methodology: Line Scanning Laser Ophthalmoscope (LSO)

ii. Optical Source: SLD 750 nm

iii. Field of view (degrees): 36x30

j. Posterior Segment Scans:

i. OCT:

· Cube scan (Macula and Optic Disc)

· HD Raster (1, 5, 21-line, cross and radial); Raster scan length 3-12 mm; image averaging up to 100x

k. Anterior Segment Scans: Cube, HD Cornea, Pachymetry, HD Angle, Wide Angle-to-Angle, Anterior Chamber, 5-line Raster

l. Minimum of four USB 2.0 ports

m. Ethernet port

n. 22” widescreen HD monitor with 1920x1080 resolution.

o. DICOM license to allow connection to modality worklist, sending to FORUM, and sending to the EHR

p. Shall be able to connect to Zeiss FORUM

q. Operating System must be Windows 10 LTSC or newer.

i. Operating System must not be end of life with-in the year of installation.

r. All cabling and peripherals shall be provided

9. Services included:

a. One year manufacturer warranty

b. Installation of equipment, software, network configuration, and integration to FORUM and DICOM VISTA Worklist.

c. Migrate all data from the device to the FORUM/Ophthalmology PACS system.

d. Shall verify functionality of the system as per OEM specifications.

e. End to end testing from worklist, sending to FORUM, viewing in FORUM, and pulling up the completed study in the EHR.

f. 2 days of training to clinical staff.

g. Installation and configuration of the system shall be completed by OEM FSE.

h. Training shall be provided by OEM trained personnel.

B. Project Management Plan:

1. The Contractor shall draft a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The PMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall include the contractor’s plans for managing all subcontractors. Topic areas to be addressed shall include oversight and communications with subcontractors while onsite at VA locations, as well as executing the timely distribution and delivery of all materials to subcontractor personnel. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified. The initial baseline CPMP shall be concurred upon and updated monthly thereafter. The Contractor shall update and maintain the VA POC approved CPMP throughout the period of performance.

2. The CPMP shall include but not limited to:

a. Project Schedule to include Milestones, Deliverables, and Critical Path

b. System Design including network infrastructure and clinical workflow

c. Verification & Validation (V&V) Plan

d. Training Plan

e. Project Closeout Activities/Procedures

3. Reporting Requirements:

a. The Contractor shall provide at a minimal weekly progress reports, to include schedule updates, to the VA POC and shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The reports shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will remain in communication with the VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

b. The Contractor shall provide the POC with weekly Installation Progress Reports in electronic form in Microsoft Word, Project formats or PDF. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month. These reports shall include a summary of the task order deliverables.

4. Verification and Validation Requirement (Testing):

a. The Contractor shall perform testing following installation to ensure all requirements are met.

b. The Contractor shall discuss and confirm suggested workflow for each facility

c. The Contractor shall provide a final test plan that includes facility test sequence and updates addressing any comments provided by the VA.

d. Contractor shall test the integration between the endpoint device, FORUM/Ophthalmology PACS system, Vista DICOM worklist, and VISTA/CPRS/EHR/Vista Imaging. End user will work with the vendor to confirm that they can view the test image in the VISTA/CPRS/EHR and that it properly attached to the correct order.

5. Project Estimate Timeline:

a. Phase I: System Design and schedule. Expected Start Date: As soon as contract Award

b. Phase II: Installation at ECH, SLC, MUS, FHM, CHY, and SHE and their respective clinics. Estimate start date: upon design complete in Phase I

i. Each site will be done individually.

c. Phase III: Validation, Verification, and Monitor of system. Expected Start Date: Upon completing of Phase II

i. Contractor shall confirm all functionality between the endpoint device, FORUM/Opthalmology PACS system, Vista DICOM worklist, and VISTA/CPRS/EHR/Vista Imaging at each site.

ii. Contractor shall monitor system functionality with the sites and confirm no issues from switchover plus 1 month.

d. Phase IV: End User Training: See “Training Requirement” for training detail

i. Offsite training can be accomplished during phase II, or just before phase II commences.

ii. Onsite training can be accomplished during phase II through phase III completed

6. Training Requirements:

a. Training schedule, travel, and duration will be finalized during Phase I of the project design/schedule

b. User/Training Manual shall be in PDF format with detail addressing each facility work flow.

V. Information Security:

NOTE: This clause will undergo official rule making by the Office of Acquisitions and Logistics. The below language will be submitted for public review through the Federal Register. The final wording of the clause may be changed from what is outlined below based on public review and comment. Once approved, the final language in the clause can be obtained from the Office of Acquisitions and Logistics Programs and Policy.

1. SUBPART 839.2 – INFORMATION AND INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

839.201 Contract clause for Information and Information Technology Security:

2. 852.273-75 - SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES (INTERIM- OCTOBER 2008) As prescribed in 839.201, insert the following clause:

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

(END OF CLAUSE)

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE FOR

INCLUSION INTO CONTRACTS, AS APPROPRIATE

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

3. VA INFORMATION CUSTODIAL LANGUAGE

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold

SECURITY INCIDENT INVESTIGATION

1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH

1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

1. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

1. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $42.00 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

TRAINING

1. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

1. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

1. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

1. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.