Attachment A - Performance Work Statement VISN 4 Courier Contract v1.0.pdf

Performance Work Statement Veterans Integrated Service Network 4

VISN 04 – Courier Services

Section 1. GENERAL INFORMATION

1.1 DESCRIPTION: Veterans Integrated Service Network (VISN) 04 is has new requirement Courier Services. The new requirement will fill all requirements for each of the VISN 04 VA Medical Centers. The VISN is seeking a fully licensed Contractor for their VA medical centers. The vendor will provide pickup and delivery for various locations within VISN 04, which is represented throughout the Commonwealth of Pennsylvania, State of Ohio, State of Delaware, and State of New Jersey as listed in this document. A 5 (five) year indefinite delivery indefinite quantity (IDIQ) contract is intended for courier services. IDIQ contract will serve as an indefinite delivery vehicle and authorization to proceed will be provided via task orders placed against. This will be contingent upon the availability of VA funding and VA medical centers’ needs.

Contractor shall provide all necessary management, labor, equipment, vehicles, resources, information security (HIPAA), and insurance to provide courier services to and from the Veteran Affairs Medical Centers (VAMCs), Community Based Outpatient Clinics (CBOCs), and various locations cited in the PWS Courier Services Schedule (Attached).

All work is to be performed in accordance with applicable federal, state, and local regulations or ordinances, including any specified regulations for information security (HIPAA), dangerous goods, diagnostic specimens, or bio-hazardous materials. The following training, insurance, licenses, and certifications are required of Contractor.

1.2 Type of Contract

Firm Fixed-Price, Indefinite Delivery Indefinite Quantity. 5-year base contract.

2.0 ACRONYMS AND DEFINITIONS:

2.1. Acronyms. Following are acronyms which may be used in place of full text throughout this Performance Work Statement:

AQL Acceptable Quality Level CAP Corrective Action Plan CBOC Community Based Outpatient Clinic CDC Centers for Disease Control and Prevention CDR Contract Discrepancy Report CLIN Contract Line-Item Number CO Contracting Officer COR Contracting Officer’s Representative CPARS Contractor Performance Assessment Reporting System CPR Contract Performance Report DOT Department of Transportation FAR Federal Acquisition Regulation HIPAA Health Insurance Portability and Accountability Act

IDIQ Indefinite Delivery Indefinite Quantity JCAHO Joint Commission on Accreditation of Health Organization

OSHA Occupational Safety and Health Administration POC Point of Contact POP Period of Performance PRS Performance Requirements Summary PWS Performance Work Statement QASP Quality Assurance Surveillance Plan QCP Quality Control Plan SDS Services Delivery Summary TO Task Order TSO Temporary Storage and Disposal Site UN United Nation U.S.C. United States Codes VA Department of Veterans Affairs VAMC Veterans Affairs Medical Center VAMC POC Veterans Affairs Medical Center’s Point of Contact VHA Veterans Health Administration VISN Veterans Integrated Service Network

2.2. Definitions. Following are definitions for words or phrases used throughout this PWS.

VA Handbook 6500.6 for Contract Security Link:

https://www.va.gov/vapubs/Search_action.cfm?FormNo=6500 Business Days. Monday-Friday excluding the weekends and federal holidays.

Calendar Days. Every consecutive day on the calendar, including federal holidays and weekends.

Contractor. A supplier or vendor having a contract to provide specific supplies or service to the Government. The term used in this PWS refers to the prime Contractor.

Contracting Officer. A person with authority to enter, administer, and terminate contracts and make related determinations and findings on behalf of the Government. The only individual legally authorized to bind the Government.

Contracting Officer’s Representative. A person appointed by the Contracting Officer to take necessary action to ensure Contractor performs in accordance with and adheres to specifications contained in the contract and to protect the interest of the Government. Such appointment must be in writing and must state the COR’s scope of authority and limitations.

This individual does not have authority to change the terms and conditions of the contract.

Contractor Performance Assessment Reporting System (CPARS). The official Government reporting system for Contractor past performance on awards.

Quality Assurance. The Government procedures to verify provided Contractor services are performed according to acceptable standards.

Quality Assurance Surveillance Plan (QASP). A written document specifying the methodology to be used to surveil Contractor performance.

Quality Control. All measures taken by Contractor to assure the quality of services provided meets contract requirements.

Task Order (TO). An order for services placed against the awarded/established contract.

Veteran Affairs Medical Center Point of Contact (VAMC POC). A government employee of the Veteran Affairs Medical Centers. This individual works on site, has authority to provide direction to Contractor if within scope of the contract, does not constitute and change to the contract, and has no funding implications. The VAMC POC shall report any indication of non-compliance to COR/CO and the Contracting Officer will promptly take appropriate action. Such appointment must be in writing and must state the Veteran Affairs Medical Center (VAMC) POC’s scope of https://www.va.gov/vapubs/Search_action.cfm?FormNo=6500 authority and limitations. This individual does not have authority to change the terms and conditions of the contract.

3.0 REQUIREMENTS:

3.1. Courier Service Deliverables.

Contractor must be available for pickups and deliveries twenty-four (24) hours a day and seven (7) days a week. This includes all federal holidays. Contractor’s courier service area consists of Pennsylvania, Delaware, New Jersey, and Ohio. Contractor must be able to service multiple VA Medical Centers and Community Based Outpatient Clinics at different times during each day. Intermittently, there may be instances for items exceeding fifty pounds. The assigned VAMC POC will provide Contractor with a twenty-four (24) hour advanced notice to determine if special handling is required.

There will be trips for cited routes on behalf of each facility or as needed. May be subject to change.

Each VAMC will have their own pickup and delivery time schedule cited in Exhibit A: Courier Services Schedule.

Items to be picked up and delivered include but are not limited to:

(1) Medical Records (other needed documents) - to be transported in a locked mailbag.

(2) Totes for transporting mail, medications, and supplies (i.e. papers, pens, specimen cups, syringes, linens) in a locked container.

(3) X-rays are to be transported and in locked bag.

(4) Blood/Specimens - to be transported in a secure container/cooler.

a. Coolers must be labeled with a biohazard symbol, UN3373 symbol, and have the address/phone number of the location from where it is coming and where it is going.

(5) Currency – to be transported in a locked bag.

(6) Small medical equipment:

a. specimen racks (sizes: 5x10in/4x9.5in)

b. x-ray racks (sizes: 14x17in/19x22in)

c. walkers (size: 30x10x40 in)

d. wheelchairs (size: 42x36x25 in)

(7) Small furniture:

a. chairs (sizes: 23.5 - 34 in)

b. stools (sizes: 23 - 34 in)

c. file cabinets (sizes: 27x14x18in/14x25x18 in)

(8) Pharmaceuticals must be transported in a locked container:

a. container (size: 24x18x24 in)

3.2. Schedule of Performance.

Contractor shall conduct courier services to and from the designated pickup and delivery destinations specified below. Each CLIN represents pickup and delivery of each VAMC/CBOC route. Each trip signifies one way. The estimated monthly trips represent the number of projected trips monthly. The estimated 1-year trips represent the number of projected trips for one year. Each VAMC will have their own pickup and delivery time schedule as described below. If the CLIN is ordered, the exact location and scheduling will be coordinated with VAMC POC. Please refer to Exhibit A: Courier Services Schedule locations and times. All locations and times located within Exhibit A: Courier Services Schedule are based off the current existing need of the VA and VISN4 Hospitals and CBOCS and are subject to variations on location, time or both.

3.3. Additional Courier Requirements.

VAMCs will courier Class B, biological specimens, and exempt human specimens. All specimens are transported in a primary container and leakproof secondary container, and then they are placed into secured/locked transport bags. Patient information and specimens are transported in secured courier bags according to specimen temperature requirements. Laboratory specimen containers for delivery and pickup may vary in size. Laboratory specimens, i.e. body fluids, will be properly packaged by the VA personnel for transportation. All specimens must be transported in accordance with all Department of Transportation (DOT) and OHSA Codes of Federal Regulations (CFR) 49 and 29.

Small furniture and medical equipment examples would include maximum weight of 50 lbs., can be hand carried, i.e. an office chair and medical rack.

Contractor shall comply with all special handling instructions marked on containers/packages. Some containers/packages may require special handling and will be marked “Fragile” or “This Side Up.”

Intermittently, there may be a requirement for items exceeding fifty pounds. The assigned VAMC POC will provide Contractor with a twenty-four (24) hour advanced notice to determine if special handling is required.

3.4. Government Responsibilities.

VAMCs will provide the bags, totes, coolers, containers, locks, and zip ties. Items will always be secured (locked), while in Contractor’s possession.

3.5. Contractor Responsibilities.

Contractor’s drivers shall be required to maintain a record log of courier pickups and deliveries, dates of pickups and deliveries, tracking arrival and departure times, and number of bags, totes, coolers, containers, locks, and/or loose items. Contractor will submit to VAMC POC within 5 business days of the beginning of each month.

Contractor shall deliver/pick up empty containers for each location and deliver/pickup fully packed container for return trip. Bags, totes, coolers, containers, locks, and test tube racks need to be returned.

Specimens and/or transported items that are lost, broken, or otherwise damaged, Contractor shall be required to submit a preliminary summary incident report to the VAMC POC within twenty-four (24) hours of the incident. Contractor shall provide a written incident report explaining the details of the incident, specifically what caused the incident within seventy-two (72) hours of the incident.

Contractor shall supply their employees with uniforms that will always be worn while performing the services of the contract and while Contractor employees are on government property.

Courier personnel will be trained in the safe transport of infectious/diagnostic specimens in accordance with established guidelines from the College of American Pathologists (CAP), the Joint Commission on Accreditation of Health Organization (JCAHO), and guidelines established and required by federal, state, and local law. Contractor must be trained in the appropriate safety procedures suitable to specimen type and distances transported. This should include issues such as adherence to regulations for transport of biohazards, use of rigid containers supplied by the courier, temperature control notification procedures in case of accident or spills, etc. Contractor will provide the Contracting Officer written documentation that issues related to transport of biohazardous materials have been addressed and keep a copy of the written documentation at the courier’s site. The official timeline is cited under “Reports and Deliverables”. Contractor must ensure mandatory training annually.

3.6. Environmental Controls.

Contractor shall be responsible to maintain a temperature-controlled environment between 68 to 78 degrees Fahrenheit and a relative humidity level between 65 to 72 percent in vehicle or storage areas.

Lab specimens shall be maintained at 2 to 8 degrees Celsius with the use of adequate refrigerant packs (will be supplied by the VA) for all deliveries of laboratory specimens or supplies. Laboratory staff packs specimens in large biohazard bags and place in coolers for couriers. Majority of specimens go in refrigerant cold packs. In addition, there may be specimens such as blood cultures that need to be maintained at room temperature 20 to 25 degrees Celsius.

Items must be kept out of contact with environmental hazards such as dust, snow, and rain. Contractor personnel drivers shall not leave vehicles in extreme heat or cold while specimens, sterile supplies, and pharmaceuticals are being transported. Contractor shall be responsible for failures by Contractor personnel to ensure established environmental controls are maintained, of which results in damage or deterioration of laboratory specimens, supplies, and pharmaceuticals.

3.7. Contractor Vehicles/Personnel.

The Contractor and it’s drivers shall comply with the following:

(1) Obtain and maintain all insurances required by state and federal law for operation in any state applicable to the associated Contract Line Items (CLINs).

(2) Obtain and maintain all bonds required by state and federal law.

(3) Obtain and maintain all licenses required by state and federal law.

(4) Vehicles shall have company name/logo prominently displayed.

(5) Each vehicle used in performance of biohazard pick-up/delivery shall be stocked with at least one (1) up-to-date complete spill kit for biohazard cleanup.

(6) Contractor vehicles must be maintained in sanitary, clean condition.

(7) All vehicles must be in good working condition with all doors and trunks able to fully close and lock. Unattended vehicles with VA contents shall always be locked.

Types of vehicles prohibited from use under this contract:

• Bicycles

• Motorcycles

• Vehicles without secure cargo area.

Smoking is permitted only in designated areas when Vendor personnel are on VA Health Care System or CBOC facilities. Smoking is not allowed within vehicles or when carrying and transporting delivery items.

Contractor’s drivers are required to notify the assigned VAMC POCs during normal business hours of any unusual events that impede drivers in making deliveries as required in contract.

The Contracting Officer, upon discussion with the VAMC POCs reserves the right to exclude Contractor personnel from providing services under the contract or task order based upon breaches of conduct, including conduct that jeopardizes patient care or interferes with the regular and ordinary operation of the facility. Breaches of conduct include intoxication or debilitation resulting from drug use, theft, patient abuse, dereliction, negligence in performing tasks, or other conduct resulting in formal complaints by Veterans or other staff members to designated government representatives. Contractor and COR shall address issues raised concerning vendor personnel conduct. The Contracting Officer shall be the final decision on questions of acceptability and in validating complaints.

3.8. Contingency Plan.

In order to provide the appropriate VA Staff time to notify Veteran patients that laboratory services need to be rescheduled to any delays, such as, but not exclusive to, weather, road closures, route detours etc. The Contractor shall create and provide a contingency plan to all Community Based Outpatient Clinics (CBOCs), VA laboratory staff, and the VAMC POCs for procedures to notify all parties concerned, within 2 hours of delivery/pickup time, of any delays.

Any delays should be communicated via email or phone call to the appropriate VA Staff and/or Contract

POC.

This plan shall be reviewed annually by Contractor, the VAMC POC, and other designated VA lab personnel.

3.9. Billing and Payment.

All correspondence relative to the contract or any task order shall contain contract number, task order, CLIN(s), VAMC, and description of services performed. Pricing is all inclusive (i.e. tolls, gas, etc.) Task orders will be represented according to VAAR Clause 852.232-72. Each contract line-item number (CLIN) represents a VA medical center route cited under “Schedule of Performance”. Additional CLINs may be added for new locations and routes in benefit of VISN 04 VAMCs to utilize in the future.

Contractor shall only bill for services rendered. Contractor is responsible for maintaining a log of all pickups and deliveries. Logs will indicate the time and dates of pick-ups and deliveries, number of specimens/parcels received or delivered, and the appropriate signatures. Logs and reports shall be turned in to VAMC POC monthly for review. Services performed without being recorded on suggested logs will not be charged to VISN 04 and will not be paid by VISN 04.

Payment to the Contractor shall be made monthly, in arrears, upon receipt of a properly prepared invoice. Payment for services will be at the rates specified in the Price/Cost Schedule. All monthly invoices from the Contractor will be electronically submitted through the VA Network within 10 days following the end of the month of services rendered.

Vendor Electronic Invoice Submission Methods: Facsimile, e-mail, and scanned documents are not acceptable forms of submission for payment requests. Electronic form means an automated system transmitting information electronically according to the accepted electronic data transmission methods below.

The information page for the Financial Service Center (FSC) of the Department of Veterans Affairs that includes information regarding electronic invoice submission can be referenced at:

http://www.fsc.va.gov/einvoice.asp Department of Veterans Affairs Financial Services Center PO Box 149971 Austin TX 78714-8971 Customer Support Help Desk (877-353-9791) http://www.fsc.va.gov/einvoice.asp

Invoices must be certified by VAMC POCs prior to payment release. Invoices without the required information will be rejected.

If the VAMC POC refuses an invoice due to incorrect billing, subsequent changes or corrections to the monthly invoice shall be resubmitted by the vendor with a corrected invoice. In addition to information required for submission of a “proper” invoice in accordance with FAR 52.212-4 (g), all invoices must include:

● Name and Address of Contractor

● Invoice Date and Invoice Number

● Contract Number and Obligation Number

● Name, title, and phone number of persons to notify in event of defective invoice

● Total Price

Failure to comply with all terms and conditions of this contract shall result in invoices/claims submitted for reimbursement during that period to be considered incomplete. Interest penalties imposed under the Prompt Payment Act shall not apply to incomplete invoices or invoices received after the established invoice due date.

Contractor Remittance Address: All payments by the Government to the Contractor will be made by Electronic Funds Transfer (EFT).

3.10. Training.

All Contractor employees and Sub-Contractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

(1) The Contractor shall provide to the contracting officer a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 45 days of the initiation of the contract and annually thereafter, as required.

(2) Failure to complete the mandatory annual training below and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

(3) Contractors may use the TMS Managed Self Enrollment method to complete the training in TMS (https://www.tms.va.gov/SecureAuth35/). Signed training documents must be submitted to the VAMC POCs.

(4) Complete “VA Privacy Training for Personnel without Access to VA Computer Systems or Direct Access to or Use to VA Sensitive Information” training by using VA’s TMS system. Or, https://www.tms.va.gov/SecureAuth35/

(5) Complete the hard copy version of “VA Privacy Training for Personnel without Access to VA Computer Systems or Direct Access to or Use to VA Sensitive Information”.

3.11. Contractor Rules of Behavior.

This User Agreement contains rights and authorizations regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the Department of Veterans Affairs (VA). This User Agreement covers my access to all VA data whether electronic or hard copy ("Data"), VA information systems and resources ("Systems"), and VA sites ("Sites"). This User Agreement incorporates Rules of Behavior for using VA, and other information systems and resources under the contract.

(1) GENERAL TERMS AND CONDITIONS FOR ALL ACTIONS AND ACTIVITIES UNDER THE CONTRACT:

a. I understand and agree that I have no reasonable expectation of privacy in accessing or using any VA, or other Federal Government information systems.

b. I consent to reviews and actions by the Office of Information & Technology (OI&T) staff designated and authorized by the VA Chief Information Officer (CIO) and to the VA OIG regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA. These actions may include monitoring, recording, copying, inspecting, restricting access, blocking, tracking, and disclosing to all authorized OI&T, VA, and law enforcement personnel as directed by the VA CIO without my prior consent or notification.

c. I consent to reviews and actions by authorized VA systems administrators and Information Security Officers solely for protection of the VA infrastructure, including, but not limited to monitoring, recording, auditing, inspecting, investigating, restricting access, blocking, tracking, disclosing to authorized personnel, or any other authorized actions by all authorized OI&T, VA, and law enforcement personnel.

d. I understand and accept that unauthorized attempts or acts to access, upload, change, or delete information on Federal Government systems; modify Federal government systems; deny access to Federal government systems; accrue resources for unauthorized use on Federal government systems; or otherwise misuse Federal government systems or resources are prohibited.

e. I understand that such unauthorized attempts or acts are subject to action that may result in criminal, civil, or administrative penalties. This includes penalties for violations of Federal laws including, but not limited to, 18 U.S.C. §1030 (fraud and related activity in connection with computers) and 18 U.S.C. §2701 (unlawful access to stored communications).

f. I agree that OI&T staff, in the course of obtaining access to information or systems on my behalf for performance under the contract, may provide information about me including, but not limited to, appropriate unique personal identifiers such as date of birth and social security number to other system administrators, Information Security Officers (ISOs), or other authorized staff without further notifying me or obtaining additional written or verbal permission from me. g. I understand I must comply with VA’s security and data privacy directives and handbooks. I understand that copies of those directives and handbooks can be obtained from the Contracting Officer's Technical Representative (COTR). If the Contractor believes the policies and guidance provided by the COTR is a material unilateral change to the contract, the Contractor must elevate such concerns to the Contracting Officer for resolution.

g. I will report suspected or identified information security/privacy incidents to the COTR and to the local ISO or Privacy Officer as appropriate.

(2) GENERAL RULES OF BEHAVIOR

a. Rules of Behavior are part of a comprehensive program to provide complete information security. These rules establish standards of behavior in recognition of the fact that knowledgeable users are the foundation of a successful security program.

Users must understand that taking personal responsibility for the security of their computer and the information it contains is an essential part of their job.

b. The following rules apply to all VA Contractors. I agree to:

i. Follow established procedures for requesting, accessing, and closing user accounts and access. I will not request or obtain access beyond what is normally granted to users or by what is outlined in the contract.

ii. Use only systems, software, databases, and data which I am authorized to use, including any copyright restrictions.

iii. I will not use other equipment (OE) (non-Contractor owned) for the storage, transfer, or processing of VA sensitive information without a VA CIO approved waiver, unless it has been reviewed and approved by local management and is included in the language of the contract. If authorized to use OE IT equipment, I must ensure that the system meets all applicable 6500 Handbook requirements for OE.

iv. Not use my position of trust and access rights to exploit system controls or access information for any reason other than in the performance of the contract.

v. Not attempt to override or disable security, technical, or management controls unless expressly permitted to do so as an explicit requirement under the contract or at the direction of the COTR or ISO. If I am allowed or required to have a local administrator account on a government-owned computer, that local administrative account does not confer me unrestricted access or use, nor the authority to bypass security or other controls except as expressly permitted by the VA CIO or CIO's designee.

vi. Contractors’ use of systems, information, or sites is strictly limited to fulfill the terms of the contract. I understand no personal use is authorized. I will only use other Federal government information systems as expressly authorized by the terms of those systems. I accept that the restrictions under ethics regulations and criminal law still apply.

vii. Grant access to systems and information only to those who have an official need to know.

viii. Protect passwords from access by other individuals.

ix. Create and change passwords in accordance with VA Handbook 6500 on systems and any devices protecting VA information as well as the rules of behavior and security settings for the particular system in question.

x. Protect information and systems from unauthorized disclosure, use, modification, or destruction. I will only use encryption that is FIPS 140-2 validated to safeguard VA sensitive information, both safeguarding VA sensitive information in storage and in transit regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA.

xi. Follow VA Handbook 6500.1, Electronic Media Sanitization to protect VA information. I will contact the COTR for policies and guidance on complying with this requirement and will follow the COTR's orders.

xii. Ensure that the COTR has previously approved VA information for public dissemination, including e-mail communications outside of the VA as appropriate. I will not make any unauthorized disclosure of any VA sensitive information through the use of any means of communication including but not limited to e-mail, instant messaging, online chat, and web bulletin boards or logs.

xiii. Not host, set up, administer, or run an Internet server related to my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA unless explicitly authorized under the contract or in writing by the COTR.

xiv. Protect government property from theft, destruction, or misuse. I will follow VA directives and handbooks on handling Federal government IT equipment, information, and systems. I will not take VA sensitive information from the workplace without authorization from the COTR.

xv. Only use anti-virus software, antispyware, and firewall/intrusion detection software authorized by VA. I will contact the COTR for policies and guidance on complying with this requirement and will follow the COTR's orders regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with VA.

xvi. Not disable or degrade the standard anti-virus software, antispyware, and/or firewall/intrusion detection software on the computer I use to access and use information assets or resources associated with my performance of services under the contract terms with VA. I will report anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages to the

COTR.

xvii. Understand that restoration of service of any VA system is a concern of all users of the system.

xviii. Complete required information security and privacy training, and complete required training for the particular systems to which I require access.

(3) ADDITIONAL CONDITIONS FOR USE OF NON- VA INFORMATION TECHNOLOGY RESOURCES

a. When required to complete work under the contract, I will directly connect to the VA network whenever possible. If a direct connection to the VA network is not possible, then I will use VA approved remote access software and services.

b. Remote access to non-public VA information technology resources is prohibited from publicly available IT computers, such as remotely connecting to the internal VA network from computers in a public library.

c. I will not have both a VA network line and any kind of non-VA network line including a wireless network card, modem with phone line, or other network device physically connected to my computer at the same time, unless the dual connection is explicitly authorized by the COTR.

d. I understand that I may not obviate or evade my responsibility to adhere to VA security requirements by subcontracting any work under any given contract or agreement with VA, and that any Sub-Contractor(s) I engage shall likewise be bound by the same security requirements and penalties for violating the same.

(4) STATEMENT ON LITIGATION

a. This User Agreement does not and should not be relied upon to create any other right or benefit, substantive or procedural, enforceable by law, by a party to litigation with the United States Government.

(5) ACKNOWLEDGEMENT AND ACCEPTANCE

a. Contractor will acknowledge receipt of this User Agreement. Contractor understands and accepts all terms and conditions of this User Agreement and will comply with the terms and conditions of this agreement and any additional VA warning banners, directives, handbooks, notices, or directions regarding access to or use of information systems or information. The terms and conditions of this document do not supersede the terms and conditions of the signatory’s employer and VA.

3.12. Bloodborne Pathogens Compliance.

Contractor personnel shall comply with the effective VA Medical Center Policy (and Occupational Health requirements in accordance with OSHA Blood Borne Pathogens (BBP) Law and the OSHA Tuberculosis Compliance Directive, enforceable under OSHA’s General Duty Clause) governing healthcare workers infected with a bloodborne pathogen.

3.13. HIPAA Compliance.

Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). In addition, all VA security policies and applicable confidentiality statues such as 38 U.S.C. §5701 (VA Claims Confidentiality), 38 U.S.C. §5705 (Confidentiality of Healthcare Quality Assurance Review Records), 38 U.S.C. §7332 (Confidentiality of certain medical records), as well as 45 C.F.R. Parts 160, 162, and 164 (Health Insurance Portability and Accountability Act) should be followed.

3.14. Privacy and Confidentiality.

Contractors to the Department of Veteran Affairs may be unintentionally exposed to sensitive information that could potentially violate the privacy and confidentiality of our Veterans, employees, volunteers, and their families. Regulations such as, but not limited to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Freedom of Information Act (FOIA) and Privacy Act of 1974 have been enacted to protect sensitive information from being improperly disclosed. Information should not be divulged or released to anyone unless specifically authorized by this contract or its attached documents in accordance with the contracted services. Failure to comply with applicable statutes and regulation can result in the termination of this contract and civil and criminal penalties, including fines and imprisonment. All suspected or actual breaches of privacy and confidentiality should be reported immediately to the Contracting Officer, VAMC Contracting Officer's Representative (VAMC POC) or the Facility Privacy Officer. If confidential information is incidentally disclosed in the performance of this contract, destruction of such material is required by an acceptable process such as incineration to ensure that any Protected Health Information (PHI) is fully destroyed making it unreadable and unable to be reconstructed. If there is reasonable cause to believe there has been incidental disclosure, Contractor will promptly investigate and report to the Contracting Officer the Contractor's determinations regarding any alleged or actual unauthorized use or disclosure, promptly resolve any problems identified by the investigation and if requested, submit a formal response to an allegation of unauthorized disclosure. Submission of a quote constitutes acknowledgement that containers, coolers, and totes will not be opened in performance of contract and all Privacy and Confidentiality requirements will be enforced.

3.15. Access to VA Information and VA Information Systems.

(1) A Contractor/Sub-Contractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Sub-Contractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

(2) All Contractors, Sub-Contractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

(3) Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

(4) Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the Contractor/Sub-Contractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

(5) The Contractor or Sub-Contractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Sub-Contractor’s employ. The Contracting Officer must also be notified immediately by the Contractor or Sub-Contractor prior to an unfriendly termination.

3.16. VA Information Custodial Language.

Information made available to the Contractor or Sub-Contractor by VA for the performance or administration of this contract or information developed by the Contractor/Sub-Contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the Contractor/Sub-Contractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) 1.

VA information should not be co-mingled, if possible, with any other data on the Contractors/Sub- Contractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of Contractor and Sub-Contractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

Prior to termination or completion of this contract, Contractor/Sub-Contractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a Contractor/Sub-Contractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1 https://www.va.gov/vapubs/Search_action.cfm?FormNo=6500, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

The Contractor/Sub-Contractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

The Contractor/Sub-Contractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Sub-Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Sub-Contractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold VA HANDBOOK

6500.6 MARCH 12, 2010 APPENDIX C C-4 payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

The Contractor/Sub-Contractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

The Contractor/Sub-Contractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Sub-Contractor may use and disclose VA information only in two other situations:

a. in response to a qualifying order of a court of competent jurisdiction, or

b. with VA’s prior written approval. The Contractor/Sub-Contractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

Notwithstanding the provision above, the Contractor/Sub-Contractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the Contractor/Sub- Contractor is in receipt of a court order or other requests for the above-mentioned information, that Contractor/Sub-Contractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

https://www.va.gov/vapubs/Search_action.cfm?FormNo=6500

For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the Contractor/Sub-Contractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the

COTR.

3.17. Security Incident Investigation.

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures.

The Contractor/Sub-Contractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Sub-Contractor has access.

To the extent known by the Contractor/Sub-Contractor, the Contractor/Sub-Contractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/Sub-Contractor considers relevant.

3.18. Liquidated Damages for Data Breach.

Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the Contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the Contractor/Sub-Contractor processes or maintains under this contract.

The Contractor/Sub-Contractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non- Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access)

(2) Description of the event, including:

a. date of occurrence;

b. data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy

Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to the VA liquidated damages in the amount of $______ per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

3.19. Special Contract Requirements.

(1) REPORTS/DELIVERABLES

Contractor shall be responsible for complying with all reporting and deliverable requirements established. Contractor shall be responsible for assuring the accuracy and completeness of all reports and other documents as well as the timely submission of each. Contractor shall comply with the requirements regarding the appropriate reporting formats, instructions, submission timetables, and technical assistance as required. All reports and deliverables are to be sent by electronic mail unless otherwise specified by the CO or VAMC POCs.

What Submit as Noted Submit To Task 3.7 Licenses/Bonds/Insurances/ Certificates

Will need for solicitation; upon award and annually

CO/COR/ Designee

Task 3.2 Delivery Routes Within 5 business days of award and effective date of proposed change

COR/Designee

Task 3.5 Monthly Logs Within 5 business days in beginning of each month

COR/ Designee

Task 3.6; 3.7; 3.8 Emergencies Notify after incidents occur COR/ Designee Task 3.6 Specimens and/or transported items that are broken, damaged, lost, or missing

Required to submit a preliminary summary incident report within twenty-four (24) hours of the incident.

Contractor shall provide a written incident report explaining the details of the incident, specifically what caused the incident within seventy-two (72) hours of the incident

COR/Designee

Task 3.8 Contingency Plan Within 5 business days of award and annually thereafter

COR/Designee

Task 3.9 Billing and Payment Within 10 business days in beginning of each month

COR/ Designee

Task 3.10 Training Certifications within 45 calendar days of award and annually

COR/ Designee

Task 3.11 Rules, Policies, and Procedures

Documents must be reviewed and approved within 10 business days of award. They are also provided upon intake, upon request, and when changed/updated.

COR/Designee

(2) SERVICE DELIVERY SUMMARY

The Services Delivery Summary (SDS) represents the most important contract objectives that, when met, will likely indicate contract performance is satisfactory.