Attachment A - Lebanon PWS Transportation Services.docx

Lebanon Veterans Affairs (VA) Medical Center Transportation Services Performance Work Statement (PWS)

1. SCOPE OF WORK

Lebanon Veterans Affairs (VA) Medical Center is seeking a five-year Indefinite Delivery- Indefinite Quantity (IDIQ) contract for transportation services for eligible beneficiaries (and escort, if applicable) throughout the Pennsylvania area. Services will require transporting eligible beneficiaries to and from the Lebanon VA Medical Center or associated VA Community Clinic (VACC) and their home/lodging residences, or designated location. Contractor will provide ground transportation services, 24 hours/7 days/week (to include off business hours and all federal holidays) for locations up to 90 miles away from the main campus or clinic (one-way):

Lebanon VA Medical Center (Main Campus) 1700 South Lincoln Avenue Lebanon, PA 17042 Berks County VA Clinic 2762 Century Boulevard Ridgeview Professional Center, Suite 120 Wyomissing, PA 19610

Cumberland County VA Clinic 5070 Ritter Road Rossmoyne Business Park Mechanicsburg, PA 17055 Lancaster County VA Clinic 212 Willow Valley Drive, Suite 208 Willow Street, PA 17584

Schuylkill County VA Clinic 1410 Laurel Boulevard, Suite 2 Pottsville, PA 17901 York County VA Clinic 2251 Eastern Boulevard, Suite 101 York, PA 17402

2. BACKGROUND

Lebanon VA Medical Center has a need for safe and dependable transportation services, 24 hours/7 days/week (to include off business hours and all federal holidays) for eligible beneficiaries. Travel needs may be one-way or round trip as advised by Lebanon VA Medical Center.

3. PERIOD OF PERFORMANCE

August 1, 2023 – July 31, 2028

4. CONTRACT TYPE

5-year IDIQ, Firm-fixed Price

5. CONTRACT DEFINITIONS

5.1 Administrative Officer of the Day (AOD) – Lebanon VA Medical Center official that work in the admissions area during evenings and nights, and monitors hospital activities during other than normal working hours. This person is located at the site of the Lebanon VA Medical Center and acts as hospital administrator during off-hours.

5.2 Beneficiary - Veterans and other members determined to be eligible for benefits by Lebanon VA Medical Center.

5.3 Booking Fee – Fee to place the transportation request.

5.4 Business Hours/Days - Business hours/days are defined as the time of 8:00AM to 4:30PM, Monday through Friday, except Federal holidays. Federal holidays include, but not limited to, New Year’s Day, Martin Luther King Day, President’s Day, Memorial Day, Juneteenth Day, Independence Day, Labor Day, Columbus Day, Veterans’ Day, Thanksgiving Day, Christmas Day, and other specifically designated days by the President of the United States to be a federal holiday. Off business hours/days are defined as the time of 4:31PM to 7:59AM, Monday through Friday, all day Saturday and Sunday and Federal holidays.

5.5 Cancellation Fee – Fee to cancel the trip.

5.6 Contract – Contract awarded as a result of this solicitation.

5.7 Contracting Officer (CO) – VA official with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings, and is a member of the vehicle inspection team.

5.8 Contractor – The term “Contractor” as used herein refers to both the prime Contractor and their employees, and any subcontractors and their employees. The Contractor shall be responsible for assuring that his subcontractors comply with the provisions of this Contract. The Government has a contracting relationship with the Prime Contractor only.

5.9 Escort – Such as a relative of the beneficiary or a Lebanon VA Medical Center employee accompanying the Beneficiary when Lebanon VA Medical Center has determined such an escort is in the best interest of the beneficiary.

5.10 Financial Services Center VA (FSC) – Payment is made through electronic funds transfer - Department of Veterans Affairs, Financial Services Center, PO Box #149971, Austin, TX 78714-9971; FAX: 512-460-5540 (services).

5.11 Pick-up Fee – The flat rate the Contractor charges for each authorized trip.

5.12 Program Point of Contact (POC) – Lebanon VA Medical Center official responsible for providing Contract oversight and technical guidance to the CO. Responsibilities include certifying invoices, placing orders for service, providing technical guidance, and overseeing technical aspects of the Contract. Also acts as member of the vehicle inspection team. All contacting authority remains with the CO. Program POC information shall be provided at time of award.

5.13 Protected Health Information (PHI) – Individually identifiable health information, held or maintained by a covered entity or its business associates acting for the covered entity, that is transmitted or maintained in any form or medium (including the individually identifiable health information of non-U.S. citizens).

5.14 Quality Assurance – Those actions taken by the Government to assure services meet the requirements of this Contract.

5.15 Quality Assurance Surveillance Plan – An organized written document used for quality assurance surveillance. The document contains specific methods for performing surveillance of the Contractor’s continuous performance.

5.16 Quality Control – Those actions taken by the Contractor to control the production of goods or services, so they will meet the requirements of a contract.

5.17 Scheduled Trip(s) – The term “Scheduled Trip” as used in this Contract refers to those trips in which the Contractor has been given advance notice (advance notice is defined as notice given by 4:30PM the prior business day) of required services and a specific pick-up time.

5.18 Travel Assistance Team – Individuals employed in Lebanon VA Medical Center Travel Section who are authorized to request services from the Contractor.

5.19 Trip – One way transportation.

5.20 Trip Sheet – A document that specifies the date, Beneficiary name and last four digits of Social Security number, time of pickup, destination, time of drop off, mileage if outside the Contract Mileage Threshold, and any notes regarding issues particular to the specific transport or condition, including recording oxygen, cardiac monitoring, and any other items provided.

5.21 Unscheduled Trip(s) – The term “Unscheduled Trip” as used in this Contract refers to those trips required on an as needed basis and advance notice is not given. Same day request.

6. PLACE OF PERFORMANCE AND HOURS

Transportation services shall be provided twenty-four (24) hours a day, seven (7) days a week, three hundred and sixty-five (365) days a year, including Federal holidays. Service shall include transportation to points dictated by the Lebanon VA Medical, for beneficiaries located within catchment areas of the facility.

7. BENEFICIARY TRANSPORTATION REQUIREMENTS

Contractor shall provide transportation services seven (7) days per week (including holidays and off business hours), twenty-four (24) hours per day, three hundred sixty-five (365) days per year, for the term of this contract. The following holidays are observed by the Federal Government, but not limited to: New Year’s Day, Martin Luther King’s Birthday, President’s Day, Memorial Day, Juneteenth Day, Independence Day, Labor Day, Columbus Day, Veterans’ Day, Thanksgiving Day, Christmas Day, and any other day specifically declared to be a national holiday by the President of the United States. The majority of trips will be between 6:00 a.m. and 6:00 p.m. Monday through Friday.

Contractor shall provide the Lebanon VA Medical Center with the communication method of contacting the Contractor on a twenty-four (24) hour per day basis. The Program POC (POC) shall notify the Contractor if the proposed method of communication is not acceptable.

Historically, Lebanon VA Medical Center average four trips per weekday during normal business hours. Needs will vary based on demand and the number of trips can exceed 10 per day. Additionally, averages four trips per week outside of normal business hours, including nights, weekends, and holidays. Most trips average 10 – 25 miles, with an average of two trips per week between 25 and 75 miles when transporting beneficiaries between Lebanon VA Medical Center main campus and the VACCs.

Contractor shall ensure that beneficiary pick-ups and drop-offs are scheduled so that the total distance traveled will result in the most economical charge to Lebanon VA Medical Center.

Contractor shall provide beneficiary hand-off service for all beneficiaries to and from their designated appointments. The Contractor shall transfer or “hand-off” the beneficiary to the next person responsible for their care. Beneficiaries shall be picked up on the ward, in their homes, in the clinics, or at other areas designated by Lebanon VA Medical Center and taken to the authorized destination or appointment.

Minor assistance in maneuvering stairs and other barriers shall be provided by the driver, when necessary, outside of the residence.

Contractor’s driver shall observe beneficiaries during transport. Any indication of a significant change in a beneficiary’s condition (i.e., sudden onset of rapid or labored respiration, complaints of chest pains, etc.) In the event of an emergency, the driver shall call 911. The Contractor will notify Lebanon VA Medical Center at the as soon as possible to provide details of the incident.

Should the Contractor’s driver encounter any problems when transporting beneficiaries, the driver shall contact the Contractor, from 5:00 AM to 7:00 PM. During irregular tour of duty (7:00 PM to 5:00 AM), weekends or holidays, the driver shall contact the AOD at the Admissions Desk. Lebanon VA Medical Center will provide a list of individuals (other than the Program POC) authorized to contact the Contractor. This notification is merely for information purposes. It does not replace internal Contractor communications needed to solve the problem.

Contractor shall notify the Program POC, of any unusual events, including but not limited to accidents, safety problems, beneficiary complaints, and other such incidents that may occur during transport. The Program POC shall be notified within one (1) hour of the occurrence of the incident(s) by telephone and, if requested by the Program POC, a written report of the incident(s) will be provided by close of business the next business day. This notification is merely for information purposes and does not replace normal Contractor communications needed to solve issues.

8. TRAVEL / TRANSPORTATION ORDERS

Requests for services shall be recorded on the daily travel manifest and furnished to the Contractor via e-mail or telephone, by the Lebanon VA Medical Center Travel Assistance Team no later than 4:00 PM prior to the day the transportation is needed. The Contractor shall respond by 4:30 PM the same day and provide the Lebanon VA Medical Center Travel Assistance Team with a confirmation number for each trip on the manifest. In the event that the Contractor does not anticipate being able to meet Lebanon VA Medical Center tractor shall immediately notify the Travel Assistance Team during normal business hours, and the AOD outside of normal business hours. If the Contractor accepts the manifest and fails to furnish services the Lebanon VA Medical Center reserves the right to re-procure services which cannot be performed by the Contractor, in accordance with the terms, conditions, and schedule of this Contract. The following information shall be provided by Lebanon VA Medical Center to the Contractor:

· Beneficiary name (first and last)

· Pick up point (include address, telephone #, city, state, bldg. and/or room number if applicable)

· Destination

· Time of pick up

· Any specific instructions

Contractor shall provide email confirmation to the Lebanon VA Medical Center Travel Assistance Team or AOD within 10 minutes after the end of each trip. Confirmation notification shall list the trip confirmation number in the subject line and will be recorded by the Lebanon VA Medical Center Travel Assistance Team or Administrative Officer of the Day (AOD) to determine if the Contractor is meeting the scheduled pick-up and delivery requirements. No other method of delivery confirmation shall be accepted.

In the event that a beneficiary misses their scheduled appointment due to a pickup delay, Lebanon VA Medical Center shall reschedule the trip at no cost to Lebanon VA Medical Center. If additional charges are incurred by Lebanon VA Medical Center for the rescheduled trip, the additional charges shall be the responsibility of the Contractor. Lebanon VA Medical Center shall notify the Contractor when these types of incidents are identified.

8.1 For transports originating at Lebanon VA Medical Center:

Lebanon VA Medical Center Travel Assistance Team are authorized to request beneficiary transport and shall provide the Contractor with the destination and the beneficiary’s first and last name. During off-peak hours, Lebanon VA Medical Center AOD has authorization to request beneficiary transport.

For trips originating at either Lebanon VA Medical Center main campus or VACCs, the Contractor shall dispatch the trip to a driver who can respond within 45 minutes.

8.2 For transports not originating at Lebanon VA Medical Center main campus or VACCs:

Lebanon VA Medical Center Travel Assistance Team, or the AOD outside of regular business hours, shall contact the Contractor’s dispatch office to request transports.

Requests for unscheduled trips (orders placed for same day service) not initially recorded on the manifest shall be made by the Lebanon VA Medical Center main campus. If the Contractor fails to furnish services within a reasonable time (established as 45 minutes) after receiving an unscheduled request for an order, the Lebanon VA Medical Center reserves the right to obtain the services from another source and to charge the Contractor with an excess cost which may result. In instances where unscheduled trips are over 90 miles, Lebanon VA Medical Center shall allow a reasonable amount of additional response time. Lebanon VA Medical Center will consider weather, distance and other factors when granting additional response time. The decision to use an alternate source for transport is at Lebanon VA Medical Center’s discretion.

In case of inclement weather, the decision as to whether or not a beneficiary shall be transported shall be made mutually by Lebanon VA Medical Center and the Contractor.

Contractor shall notify the Program POC / Lebanon VA Medical Center Travel Assistance Team, upon the Program POC / Lebanon VA Medical Center Travel Assistance Team or AOD’s request, of the estimated time of arrival for any vehicle in-route to pick-up a beneficiary or any Lebanon VA Medical Center loaded vehicle enroute to a specific destination. The Contractor shall also notify the Program POC, by telephone, at least one-hour in advance in the event that the Contractor is unable to provide the scheduled or unscheduled trips within the time frame necessary for the beneficiary to make their scheduled appointment time.

If the Program POC or AOD, authorizes the Contractor to transport more than one beneficiary on a trip to the same destination or separate destinations, reimbursement will be made at the rate not exceeding the cost of transporting a single beneficiary. However, the longest distance over which a beneficiary is transported may be claimed when more than one beneficiary is transported concurrently. The Contractor shall ensure that the pick-ups and drop-offs are scheduled so that the total distance traveled will result in the most economical cost to Lebanon VA Medical Center.

9. TASK STATEMENT

Tasks performed shall be of a non-personal nature. VA organizations will not provide supervision of contractor personnel. Contractor personnel shall at no time allow an employer-employee relationship to develop with VA organizations or their staff. VA organizations will refrain from any activities that create the appearance of such a relationship.

Contractors shall not perform inherently governmental functions including decision-making, supervision of Government employees, supervision of other contractors on other contracts, and activities that create the appearance of performing such functions.

9.1. Transportation Scheduling Services:

Contractor may provide transportation scheduling services with rideshare companies such as Uber and Lyft.

9.1.1. Contractor shall establish (1) account for Lebanon VA Medical Center.

9.1.2. Government will send a list to the contractor via encrypted e-mail to include the rider names (first name, last initial), phone number, pick-up locations, pick-up times, drop-off locations, and drop-off times.

9.1.3. Contractor shall schedule all rides in accordance with Section 8 and provide the confirmation of scheduled rides to the Lebanon VA Medical Center travel assistance team within 24 hours.

9.1.4. Contractor shall have the ability to request travel immediately upon emergency request.

It is expected that the Contractor shall maintain communication with Lebanon VA Medical Center accordingly so that any arising issues are transparent to both parties to prevent escalation of outstanding issues.

9.2. Invoicing Instructions:

Trip Sheet - The Contractor shall provide a detailed trips report, in Excel format, no later than the 5th day of each month for the previous month’s trips. This report shall be in Excel format and shall emailed to the Program POC. Trip logs must include the following:

· Report header to include funding period, contract number, task order number and purchase order number

· Trip date

· Beneficiary’s name

· Trip number

· Scheduled or Unscheduled trip

· Beneficiary’s DOB

· Beneficiary’s last 4

· Origin address

· Destination address

· Time call received

· Appointment time

· Pick up – arrival time

· Pick up – departure time

· Drop off – arrival time

· Trip mileage

· Individual trip cost

· Total trips cost

Failure to provide the required billing documents on time and in the required format may result in late payment to the Contractor.

Payment to the Contractor shall be made monthly, in arrears, upon receipt of a properly prepared invoice. Payment for services will be at the rates specified in the Price/Cost Schedule. All monthly invoices from the contractor will be electronically submitted through the Tungsten Network within 15 days following the end of the month of services rendered.

Vendor Electronic Invoice Submission Methods: Facsimile, e-mail, and scanned documents are not acceptable forms of submission for payment requests. Electronic form means an automated system transmitting information electronically according to the accepted electronic data transmission methods below.

The information page for the Financial Service Center (FSC) of the Department of Veterans Affairs that includes information regarding electronic invoice submission can be referenced at:

http://www.fsc.va.gov/einvoice.asp

Department of Veterans Affairs Financial Services Center PO Box 149971 Austin TX 78714-8971 Customer Support Help Desk (877-353-9791)

Invoices must be approved by the Program POC prior to payment release. Invoices without the required information will be rejected.

If the Program POC refuses an invoice due to incorrect billing, subsequent changes or corrections to the monthly invoice shall be resubmitted by the vendor with a corrected invoice. In addition to information required for submission of a “proper” invoice in accordance with FAR 52.212-4 (g), all invoices must include:

· Name and Address of Contractor

· Invoice Date and Invoice Number

· Contract Number and Obligation Number

· Name of Veteran

· Total Price

Failure to comply with all terms and conditions of this contract shall result in invoices/claims submitted for reimbursement during that period to be considered incomplete. Interest penalties imposed under the Prompt Payment Act shall not apply to incomplete invoices or invoices received after the established invoice due date.

Contractor Remittance Address: All payments by the Government to the Contractor will be made by Electronic Funds Transfer (EFT).

The contractor shall be responsible for scheduling rides and settling the accounts with the rideshare services. The Government will pay the contractor in accordance with the Price / Cost Schedule.

10. DELIVERY SCHEDULE

Submit to SharePoint / Program POC Email Home - Privacy Officer (sharepoint.com)

11. SPECIAL CONTRACT REQUIREMENTS

11.1. Reports/Deliverables: Contractor shall be responsible for complying with all reporting requirements established by the Contract. Contractor shall be responsible for assuring the accuracy and completeness of all reports and other documents as well as the timely submission of each. Contractor shall comply with contract requirements regarding the appropriate reporting formats, instructions, submission timetables, and technical assistance as required.

11.2. The following are brief descriptions of required documents that must be submitted by Contractor: weekly; monthly; quarterly; annually, etc. identified throughout the PWS and is provided here as a guide for Contractor convenience. If an item is within the PWS and not listed here, the Contractor remains responsible for the delivery of the item.

12. QUALITY ASSURANCE SURVEILLANCE PLAN

Performance Standards define required performance for specific tasks. The Government performs surveillance to determine if the contractor exceeds, meets, or does not meet these standards.

12.1. METHODS OF SURVEILLANCE

Various methods exist to monitor performance. The Program POC or designee shall use any or several of the surveillance methods listed below in the administration of this QASP.

· 100% Inspection (evaluates all outcomes) - Each month, the Program POC / Designee shall review all of the contractor’s performance/generated documentation and document results accordingly. This assessment shall be placed in the Program POC’s QA file.

· Random Sample - The Program POC / Designee shall review a random sampling of the contractor’s performance/generated documentation and document your results accordingly. This assessment shall be placed in the Program POC’s/Designee QA file.

· Validated Customer Complaint or Validated Below Average Acceptable Performance Level (APL) in a Specific Area - Each month, the Program POC shall review the contractor’s performance/generated documentation corresponding to a validated customer complaint or validated inability to perform in accordance with the APL in a specific area and document your results accordingly. This assessment shall be placed in the Program POC’s/Designee QA file.

12.2. FREQUENCY OF MEASUREMENT Customer Feedback and Complaints based on interactions with the contractor

During task order performance, the Program POC will periodically analyze whether the negotiated frequency of surveillance is appropriate for the work being performed, and at a minimum shall be reviewed quarterly.

12.3. ACCEPTABLE PERFORMANCE LEVELS (APLS)

Standard Surveillance Method Outcome

Customer problems are resolved within the same business day; no more than 2 incidents spent by Government personnel in providing corrective feedback on unacceptable customer service/ professionalism

interactions to receive and fill purchase order deliverables and in providing order status.

Customer (VA) support satisfaction, having no more than 2 incidents of dissatisfaction.

Customer Feedback and Complaints based on interactions with the contractor Customer problems are resolved within the same business day; no more than 2 incidents spent by Government personnel in providing corrective feedback on unacceptable customer service/professionalism

All required information included in Trip Sheet 100% of the time

12.4. DOCUMENTING PERFORMANCE

Acceptable Performance The Government shall document acceptable performance in accordance with the chart above. Any report may become a part of the supporting documentation for any contractual action.

Unacceptable Performance When unacceptable performance occurs, the Program POC shall inform the CO. This will always be in writing although when circumstances necessitate immediate verbal communication, that communication will be followed in writing. The Program POC shall document the discussion and place it in the Program POC file.

When the CO determines formal written communication is required, the Program POC shall prepare a Contract Discrepancy Report (CDR) and present it to the contractor's program manager.

The contractor shall acknowledge receipt of the CDR in writing to the CO. The CDR will state how long after receipt the contractor must take corrective action. The CDR will also specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CO shall review the contractor's corrective action plan to determine acceptability.

Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO.

13. RECORDS MANAGEMENT LANGUAGE

When Federal agencies acquire goods or services, they need to determine what Federal records management requirements should be included in the contract. Federal contractors often create, send, or receive Federal records. Federal contracts should provide clear legal obligations describing how the contract employees must handle Federal records.

Agency records officers, procurement counsel, and acquisitions officers must discuss how to integrate records management obligations into their existing procurement processes. NARA has developed the following language to be included as an agency-specific term and condition in Federal contracts for a variety of services and products. The majority of contracts should include language on records management obligations, but each contract should be evaluated individually. For example, the data-rights paragraph (Paragraph 10 below) may not be appropriate for all contracts. Instead, agencies may be better served by one of the established data-rights clauses in the Federal Acquisition Regulations.

This language should not replace specific records management requirements included within Federal information system contracts.

13.1 RECORDS MANAGEMENT OBLIGATIONS

A. Applicability

This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes [Agency] records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their [Agency] contract.

4. may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. [Agency] and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of [Agency] or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to [Agency]. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to [Agency] control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and [Agency] guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with [Agency] policy.

8. The Contractor shall not create or maintain any records containing any non-public [Agency] information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The [Agency] owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which [Agency] shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take [Agency]-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

14. BUSINESS ASSOCIATE AGREEMENT

14.1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

14.2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

14.3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data- General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

14.4. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

(1) Vendor must accept the system without the drive;

(2) VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

(3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

14.5. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

14.6. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete image1.jpg