Attachment A - Draft National Cancer Registry Services PWS.docx

National VA Cancer Registry Services Pre-Decisional

PERFORMANCE WORK STATEMENT (PWS)

VETERANS HEALTH ADMINISTRATION

Health Services - Clinical Services Product Line

National VA Cancer Registry Services

Date: May 2025 PWS Version Number: 2.0

This Document is Pre-Decisional

Contents

INTRODUCTION

The purpose of this acquisition is to support VA Cancer Registry System (VACRS) operations at various Veterans Integrated Service Networks (VISNs) under the U.S. Department of Veterans Affairs (VA), Veterans Health Administration (VHA), National Oncology Program Office (NOPO). The VACRS is responsible for maintaining compliance at all VAMCs in accordance with the National Oncology Program Office, Centers for Disease Control, National Cancer Institute – Surveillance, Epidemiology and End Results (SEER), North American Association of Central Cancer Registries (NAACCR), and Commission on Cancer (CoC). The national standard setters developed requirements for cancer registry for completeness, timeliness, and quality, and under state-specific laws, ensure cancer case reporting is continuous, accurate, and timely. This acquisition will support cancer registry operations at all levels of the Veterans Health Administration (VHA).

The resulting acquisition vehicle will be a multiple award Indefinite Quantity Indefinite Delivery (IDIQ) task order award contract.

It is anticipated that the work will require tasks classified in the following Functional Categories and Capability Areas:

This Performance Work Statement (PWS) establishes the requirements for Contractor provided solutions in support of an enterprise-wide Veterans Health Administration (VA) cancer registry system. This acquisition includes comprehensive support services, any of which can be integrated into a single Task Order (TO) to reduce the risk to the government and ensure complete solutions to complex programs.

0. BACKGROUND

The VHA is America’s most extensive integrated healthcare system, with over 480,000 employees providing care in 1,391 facilities (including 138 medical centers and 1,219 outpatient sites of care of varying complexity), serving 9 million enrolled Veterans each year.

The Veterans Affairs Cancer Registry System is part of this integrated healthcare system and has operated since 2000. The VACRS consists of individual population-based VAMCs reporting to a centralized database for complete population-based cancer registry information on Veteran cancer incidence and outcomes. The VACRS receives and stores information on patient demographics, cancer diagnosis and treatment sent by the local cancer registry staff at 136 Veteran Affairs Medical Centers (VAMCs) that diagnose, treat, and/or manage surveillance for cancer in the enrollment population. The VACRS collects, consolidates, and maintains detailed diagnosis and treatment information for each patient diagnosed with cancer. The VAMC cancer registry staff identifies patients with a diagnosis of cancer, curates a standardized set of data for each diagnosed cancer from all available medical records, performs data quality checks, and updates each diagnosis annually to monitor disease surveillance and vital status. Data from each VAMC population-based cancer registry is transmitted to the Veteran Affairs Central Cancer Registry (VACCR) data management system, which merges the data and performs additional data quality checks.

Data from the VACRS is utilized for clinical care, operations management, and research. Oncology patient data is also shared with state and national central cancer registries to provide more comprehensive data for healthcare providers, public health officials, and researchers. This data exchange assists in measuring cancer occurrence and trends at local and national levels. It also informs and prioritizes cancer educational and screening programs, evaluates the effectiveness of prevention efforts and treatment, determines survival rates, research cancer causes, diagnoses, and treatments, ensures quality and equity in cancer care, and plans for health services.

The capture of cancer data from VA facilities in state cancer registries assists veterans by improving the ability to identify cancer-related disparities in the veteran community and offer strategies for allocating public health funding. This also improves understanding of the cancer-related needs of veterans, which can be incorporated into State Comprehensive Cancer Control planning for screening and treatment programs funded by the Centers for Disease Control and Prevention. Furthermore, this increases opportunities for veterans with cancer to be included in more clinical trials and cancer-related research and analysis being done outside of the VA’s Healthcare System.

The VACRS faces growth in health care demand due to changes in demographics, the care backlog from the COVID-19 pandemic, trends in shifting sites and modalities of care, greater reliance on VHA health care with increased emphasis on access to care, new enrollees, and other factors. The scope of work for this procurement will significantly impact patient care by providing highly complex data for both immediate patient care needs and for longitudinal studies.

Cancer registries and registrars are vital to the surveillance, research, and control of cancer. They systematically collect, store, analyze, and interpret data on cancer patients, contributing to understanding cancer trends and outcomes. This information supports public health initiatives, informs policymaking, and guides clinical practices to reduce the burden of cancer.

0. SCOPE

The Veterans Health Administration currently has a shortage of experienced and credentialed Oncology Data Specialists, which significantly impacts patient care by providing healthcare providers with access to real-time comprehensive data on cancer diagnoses, treatments, and outcomes, which allows them to make more informed treatment decisions, monitor patient outcomes, identify trends in cancer care, and ultimately improve the quality of care delivered to cancer patients; this data is also crucial for research and public health initiatives aimed at cancer prevention and early detection. In March 2025, the VA conducted a comprehensive analysis of cancer registry data and carried out a VA-wide Cancer Registry Needs Assessment. This assessment revealed that the VA averages approximately 79,500 new cancer cases each year and currently faces a significant backlog of over 580,000 incomplete cancer registry cases dating back to 2010. Additionally, the analysis found that 93% (126) of the VAMCs require support to effectively maintain their population-based cancer registries.

The VA healthcare system transforms in response to both the changing needs of the Veteran population and changes in the healthcare industry. These shifts create challenges and require collaboration (internal and external partnerships) as well as new and innovative approaches to healthcare and healthcare delivery.

This acquisition is intended to primarily support the needs of VA healthcare facilities as a resource to support cancer registry data requirements and standards. Task Orders for this PWS will require Contractor support for varied cancer registry systems across the VHA enterprise.

This acquisition will require various knowledge and experience in cancer registry system operations. Subject matter expertise is required to be rapidly available to provide national support under potential Task Orders, including, but not limited to, the following areas: cancer registry electronic health records management, healthcare regulatory compliance, cancer program accreditation requirements, and healthcare analytics.

The Contractor shall provide the necessary services to maintain cancer registry requirements to capture and report data on eligible beneficiaries of the VHA. The standard of services shall meet or exceed currently recognized national standards as established by the Centers for Disease Control (CDC), the American College of Surgeons Commission on Cancer (CoC), and the VACRS and National Cancer Institute (NCI).

For each Task Order award, the Contractor shall provide contract personnel, comprehensive management, materials, equipment, facilities, travel, supervision of Contractor resources, and any required deliverables necessary to satisfy the requirement. Each Task Order will specify the scope of the services for which the award is being made. The Contractor shall perform the work in accordance with the resultant Task Order awards.

AUTHORIZED ORDERING AND ADMINISTRATION

This PWS provides the scope of the IDIQ contract and general requirements. Specific requirements will be defined in each Task Order award. Each Task Order award will be managed by the NOPO Contracting Officer’s Representative (COR) with experience in the business requirement on which the TO is focused.

The services within the scope of this PWS can be used by all VHA facilities based on the availability of resources.

APPLICABLE DOCUMENTS

The Contractor shall be subject to the following policies, including any subsequent updates during the period of performance. The Contractor shall follow guidance in the following documents in the performance of this effort:

A. VHA Directive 1412: VA Cancer Registry System, November 15, 2024

B. VHA Directive 1415: VHA Oncology Program, April 9, 2020

C. VHA Directive 1605.01: Privacy and Release of Information, July 24, 2023

D. VHA Directive 1907.01: VHA Health Information Management and Health Records, April 5, 2021

E. VHA Handbook 1100.17: National Practitioner Data Bank (NPDB) Reports Privacy Act of 1974 (5 U.S.C. 552a)

F. FIPS Pub 201-2, Personal Identity Verification of Federal Employees and Contractors, August 2013

G. 5 U.S.C. 552a, as amended, The Privacy Act of 1974 VA Directive 0710.01, Personnel Suitability and Security Program, October 11, 2018

H. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

I. VA Handbook 6500.2, Management of Data Breaches Involving Sensitive Personal Information, June 30, 2023

J. VA Directive 6506, Review and Use of Patient-Generated Health Data Under the Office of Connected Care, 10DH04 - Connected Care, April 19, 2021

K. VA Handbook 6500.6, Contract Security, April 22, 2024

L. National Institute Standards and Technology (NIST) Special Publications (SP)

M. VA Directive 6508, Implementation of Privacy Threshold Analysis and Privacy Impact Assessment, October 15, 2014

N. VA Handbook, 6300.1, Records Management Procedures, October 22, 2018

O. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

P. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 - Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

Q. OMB memorandum M-11-11, Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 - Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

R. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

S. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

T. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

U. NIST SP 800-63-2, Electronic Authentication Guideline, August 2013

V. Draft NIST Special Publication 800-157, Guidelines for Derived PIV Credentials, March 2014

W. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011

X. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006

Y. Public Law 111-275, Veterans' Benefits Act of 2010

Z. 38 CFR Part 74, Veterans Small Business Regulations

GENERAL REQUIREMENTS

This section describes the general requirements for this effort. The following sub-sections provide details of various considerations for this effort.

0. TYPE OF TASK ORDERS/PERFORMANCE PERIOD

Task Orders (TOs) are performance-based. All TO’s will be Firm Fixed Price.

All Contractors will receive a Task Order Proposal Request (TOPR) for each Task Order competition.

PERFORMANCE PERIOD

The period of performance is one base year with four (4), twelve (12) month option periods.

NON-PERSONAL SERVICES

Task Orders will be issued under a non-personal services arrangement. The Government shall neither supervise Contractor personnel nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to or prepare work schedules for individual Contractor personnel under a non-personal services arrangement. The Contractor is responsible for managing its non-personal service employees and guarding against any actions that are of the nature of personal services or give the perception of personal services. If the Contractor believes that any actions constitute, or are perceived to constitute personal services, the Contractor is responsible for notifying the Contracting Officer immediately.

HOURS OF CONTRACTOR OPERATIONS

Hours of work shall be in accordance with individual TO requirements.

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at the Contractor facilities or remotely using secured VA domains and systems.

CONTRACTOR REMOTE REQUIREMENTS

The Contractor shall be responsible for ensuring that all personnel working at the Contractor site have access to:

A. Equipment and supplies necessary to perform the Task Order(s), to include a laptop computer with a compatible camera and microphones.

B. Sufficient bandwidth and network infrastructure to ensure connectivity to the VA network and resources via Citrix Access Gateway (CAG) for remote desktops.

C. Possess the capability to monitor and/or record calls and share recordings with VA in standard audio files.

D. Personal Identification Verification or other current government access card reader.

E. HIPAA compliant workspace to safeguard patient protected and sensitive health information.

TRAVEL

The Government anticipates that no travel will be required under this effort to perform the tasks associated with the effort and attend program-related meetings or conferences throughout the Period of Performance (PoP).

GOVERNMENT FURNISHED EQUIPMENT (GFE)

The Contractor shall utilize Citrix Access Gateway (CAG) for remote access.

The Contractor shall provide all necessary computer equipment for use at the remote site, as applicable for contract personnel.

All VA policies related to networked computer use will apply. Personal identification verification cards shall be required for all Contractor personnel with VA network access/accounts. Contractor personnel shall complete VA’s Privacy and Information Security Awareness and Rules of Behavior training before networked computer access will be granted.

Based upon the Government's assessment of remote access solutions and requirements of this effort, the Government estimates that this effort will not require GFE.

MANAGEMENT

The Contractor shall provide the following management and support:

A. Maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements.

B. Travel required by the Contractor will be at the Contractor’s expense.

C. Provide the infrastructure required to support contract tasks.

D. Provide administrative support to employees in a timely fashion (timekeeping, leave processing, pay, emergency needs).

GENERAL PERSONNEL REQUIREMENTS

Contractor personnel shall have the expertise and level of experience necessary to accomplish the requirements of this PWS. The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with the appropriate combination of education, training, and experience. In addition, Contractor personnel shall be acceptable to the Government in terms of personal and professional conduct and technical knowledge, skills, and abilities. Contractor personnel are expected to have sufficient written and verbal communication skills to support VHA program offices, their customers, and any other VA organizations. Should any Contractor personnel be determined to be unacceptable in terms of technical competency or unacceptable conduct or behavior while working on contract activities, the Contractor shall immediately remove and replace the unacceptable on-site personnel at no additional cost to the Government. Contractor personnel are to serve in a support role; therefore, final decisions regarding inherently governmental functions will always be made by Government personnel.

The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

0. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

In accordance with VA 0710 Handbook, appointees and contract personnel appointed to Low/Moderate/High Risk positions must be subject to a background investigation conducted by OPM and receive a favorable adjudication from the VA Office of Security and Law Enforcement to ensure compliance with such policy. If such investigation has not been completed prior to contract commencement, the Contractor shall be responsible for the actions of those individuals performing under the contract. Should the contract require the Contractor’s personnel to maintain U.S. citizenship, the Contractor shall be responsible for compliance. Regardless of U.S. citizenship requirements, Contractor personnel are required to read, write, speak, and understand the English language unless otherwise specified in this contract or agreed to by the Government.

All Contractor personnel are subject to the same level of investigation as VA employees with access to VA Sensitive Information. The level of background investigation commensurate with the level of access needed to perform the statement of work is Tier 1. This requirement applies to all Contractor personnel.

All Contractor personnel who require access to the Veterans Health Administration computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Officer of Security and Law Enforcement before contract performance. This requirement applies to all Contractor personnel.

Position Sensitivity – The position sensitivity has been designated as Low Risk Background Investigation – The level of background investigation commensurate with the required level of access is a minimum background investigation if required.

CONTRACTOR RESPONSIBILITIES

A. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

B. The Government shall bear the expense of obtaining background investigations. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement, etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, any employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

C. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

D. The Contractor shall ensure the following required forms are submitted to the NOPO COR within five (5) business days after contract award:

1. For Tier 1/Low Risk designation:

0. OF-306

0. DVA Memorandum – Electronic Fingerprints

1. For Tier 2/Moderate or Tier 4/High Risk designation:

1. OF-306

1. VA Form 0710

1. DVA Memorandum – Electronic Fingerprints E. Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

F. Contractor personnel shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the NOPO COR for electronic submission to the SIC. These documents shall be submitted to the NOPO COR within three (3) business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor personnel should notify the NOPO COR within three (3) business days that the documents were signed via eQIP).

G. Contractor personnel may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) fingerprint results, training delineated in VA Handbook 6500.6 (Appendix C), and the signed “Contractor Rules of Behavior.” However, the Contractor shall be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history of Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

H. The Contractor, when notified of an unfavorably adjudicated background investigation on Contractor personnel as determined by the Government, shall withdraw the employee from consideration in working under the contract.

I. Contractor personnel shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the VA computer system.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by the Contractor personnel and/or termination of the contract for default.

CONFIDENTIALITY AND NON-DISCLOSURE

A. The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

B. The VA CO will be the sole authorized official to release in writing any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

C. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers, and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

D. The Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance of this contract, the Contractor has a responsibility to ask the VA CO.

E. The Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture, or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

F. The Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities, according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data comply with published procedures to protect the privacy and confidentiality of such information as required by the VA.

G. The Contractor must adhere to the following:

· The use of “thumb drives” or any other medium for the transport of information is expressly prohibited.

· Controlled access to system and security software and documentation.

· Recording, monitoring, and control of passwords and privileges.

· All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment, and systems.

· VA, as well as any Contractor systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

· Contractor, VA CO, and NOPR COR are informed within twenty-four (24) hours of any employee termination.

· Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

· Contractor does not require access to classified data.

H. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

APPLICABLE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE (per VA HANDBOOK 6500.6, APPENDIX C, April 22, 2024)

GENERAL

The Contractor’s personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

VA INFORMATION CUSTODIAL LANGUAGE

A. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this Contractor or order) is FAR 52.227-19, Commercial Computer Software License.

B. Information made available to the Contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The Contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

C. VA information will not be co-mingled with any other data on the Contractor’s information systems or media storage systems. The Contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements, and media sanitization.

D. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of Contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The Contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to Contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

E. The Contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

F. The Contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

G. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the Contractor.

H. The Contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The Contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

I. The Contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

J. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The Contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

K. Notwithstanding the provision above, the Contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain C-3 medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the Contractor is in receipt of a court order or other requests for the above-mentioned information, the Contractor shall immediately refer such court order or other requests to the VA CO for response.

L. Information made available to the Contractor by VA for the performance or administration of this contract or information developed by the Contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

M. Any data destruction done on behalf of VA by a Contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

N. The Contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization, prior to termination or completion of this contract. If directed by the COR/CO, the Contractor shall return all Federal Records to VA for disposition.

O. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The Contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the Contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the Contractor that the data destruction requirements above have been met shall be sent to the COR/CO within thirty (30) business days of termination of the contract.

P. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the Contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

A. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of Contractor/Subcontractor and agent of Contractor/Subcontractor.

B. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems. The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

C. All Contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

D. All Contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All Contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the Contractor must state where all non-U.S. services are provided. The Contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the NOP COR/CO in writing prior to access being granted.

E. The Contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/Subcontractor personnel no longer have a need for access to VA information or VA information systems.

(2) Contractor/Subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to Contractor/Subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/Subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which Contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for Contractor personnel.

F. In such cases of contract fulfillment, termination, or other causes; the Contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by Contractor/Subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

G. Contractors/subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, Contractors shall notify the appropriate VA COR/CO.

TRAINING

A. All Contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role-based information security training].

B. The Contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five (5) business days of the initiation of the contract and annually thereafter, as required.

C. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

SECURITY INCIDENT INVESTIGATION

A. The Contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security/privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the Contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

B. To the extent known by the Contractor/Subcontractor, the Contractor/Subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the Contractor is taking to ensure no future incidents of a similar nature.

C. After the Contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The Contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

D. VA IT Contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

E. In instances of theft or break-in or other criminal activity, the Contractor/Subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The Contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/Subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

F. The Contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

G. With respect to unsecured Protected Health Information (PHI), the Contractor is deemed to have discovered a data breach when the Contractor knew or should have known of a breach of such information.