Attachment A Performance Work Statement Work.docx

PERFORMANCE WORK STATEMENT

VETERAN EXPERIENCE CENTER PROGRAM SUPPORT SERVICES

(Non-Personal Services)

1. BACKGROUND

The U.S. Department of Veterans Affairs (VA) requires nationwide data collection and entry services for the Veteran Experience Center (VEC) (formerly Performance Reporting and Outcomes Measurements to Improve Standards of care at End-of-Life (PROMISE) Center) located at the Corporal Michael J. Crescenz VA Medical Center (CMCVAMC) (Philadelphia) [also known as the Geriatrics and Extended Care (GEC) Resource Center]. The VEC was established in 2009 as part of the Comprehensive End of Life Care Initiative. The goal of the VEC and the Bereaved Family Survey (BFS) is to identify and reduce unwanted variability in end-of-life care throughout the VA and to define and disseminate processes of care that contribute to improved outcomes for Veterans near the end-of-life and their families. Beginning in FY2011, the BFS was one of two Veteran-centric measures in the National Directors’ Performance Plan (NDPP).

The Bereaved Family Survey (BFS) is comprised of 19 items. Sixteen forced-choice items focus on specific aspects of care that the Veteran received at a VA inpatient facility during the last month of life. These items evaluate performance on areas of care including communication, emotional and spiritual support, pain/PTSD management, benefits, and personal care needs.

Two open-ended questions solicit comments about both positive and negative aspects of care (e.g., how could the care be improved, and what else would you like to share about the Veteran's care during the last month of life?). The BFS Performance Measure (BFS-PM) consists of a single item on the BFS that asks respondents to provide a global rating of care during the last month of life. The BFS-PM is dichotomized into “Excellent (9/10)” versus all other responses (0-8) and the facility / organizational level BFS-PM score reflects the percentage of respondents that rate care as “Excellent (9/10).” The BFS-PM is endorsed by the National Quality Forum (http://www.qualityforum.org/ProjectMeasures.aspx?projectID=73867).

BFS is currently being expanded to support VA-paid Community Nursing Home (CNH) hospice deaths throughout the country.

2. GENERAL REQUIREMENTS

Services Required

The Contractor(s) shall provide the Corporal Michael J. Crescenz VA Medical Center (CMCVAMC) (Philadelphia), 3900 Woodland Avenue, Philadelphia, PA 19104 with producing (including both online and print versions of the BFS), printing, mailing (including email), and data collection and data delivery services for the BFS to and from family members of deceased Veterans serviced by the VA Healthcare system as outlined below, but not limited to:

Creation of Mailing Products/Surveys

The VA currently utilizes existing templates for products mailed out to recipients (reference document appendix). The contractor shall make minor changes (modifications >10% of survey) to templates upon VA request at no cost to the VA. If contractor foresees incur costs in modifying the templates, the Contracting Officer’s Representative (COR) shall submit a request to the Contracting Officer to complete a contract modification to add additional funding (contingent upon availability of VA funding). Comment by Gilbert, Dawn K.: Define minor here...maybe <10% of survey doc changed?

Products will be produced in both English and Spanish. Spanish materials will be sent to households where Veterans are serviced within the VA Caribbean Healthcare System, is designated as a Spanish speaking household or where Spanish is the primary language – language preference is identified by the VA to the Contractor.

Fielding of Surveys and Data Collection

Contractor shall provide:

· Survey instruments (including introductory letter, BFS, magnet, prepaid addressed return envelope)

· Envelope Duplication and Printing

· Address File Cleaning

· Addressing

· Matching

· Mailing (both paper and email)

· Data Collection Service (both quantitative and qualitative)

· Transfer of Resultant Survey Data

· White Mail Handling and alerting VA of any disconcerting comments

· Online survey site

Results Reporting

The contractor shall provide all services and materials required to support the analyses of data and report preparation needed to produce the periodic reports from the Bereaved Family Survey (BFS) data, to include, but not limited to:

· Quarterly (4 times a calendar year) VHA Support Service Center (VSSC) reports

· Quarterly (4 times a calendar year) VISN reports

· The contractor shall provide full national, VISN, and facility data (and any data provided by VEC) as required for each BFS Report on a monthly basis according to a strict data delivery schedule.

· Provide technical training and documentation to VEC as needed to insure maximum practical use at all organizational levels.

The data will contain tagging, so as to link individual surveys to a specific decedent. Each BFS will be personalized to the Veteran and family member of the deceased Veteran (including surname and gender pronouns).

Full patient and question level results (both qualitative and quantitative) are required, including all cumulative data as well as the most recent data.

All results are to be made available to VEC staff.

Data Collection Methodology VEC requires that the surveys are sent via first class mail and/or email (if applicable) using a carefully timed mailing sequence designed to produce the highest possible response rate while keeping postal costs as low as possible. In the event the response rate is below 40%, the contractor shall take steps to remedy the low response rate at no additional cost to VA and provide the COR their plan of action to raise the response rate above 40%. Failure to meet or exceed a 40% response rate could result in poor performance reviews.

Response rate is defined as number of surveys returned by the end of each quarter. Quarter defined as (March 15, June 15, September 15th, and December 15th). Data on monthly response rate will be required to be calculated and reported by the contractor. VEC will calculate quarterly response rate numbers.

The mailing and response cycle requirements are delineated in Appendix A: Mailing and Response Time Schedule.

A web-based option will also be available in English and Spanish for NOKs to complete if they choose. The web-based option is secure and does not allow for multiple completions of the survey online. The web-based option should include a personalized (personalized to both Veteran (name and pronoun) and Veteran’s family member (both name and pronoun)) QR code within the cover letter of the mailing.

Details of Process and Deliverables

Table 2.1 outlines some details regarding the frequency and sample size of each survey project. The estimated total number of Next of Kin of Veterans to be mailed/emailed surveys for all population groups is approximately 25,000/year.

The Survey Preparation phase will involve intense collaboration between VEC and the contractor as questionnaires are changed into a scannable format, cover-letters and envelopes are set-up and proofed, incorrect addresses are eliminated, secondary contacts/addresses replace incorrect addresses, and final sample sizes are determined.

Active data collection and entry, regular reports of progress, and timely delivery of accurate final data sets and related files will be the prime responsibility of the contractor.

The forms to be used, the approximate numbers of patients, and the frequency for each sample are annotated in Table 2.1.

Table 2.1: Survey Type and Projected Numbers by Population

Quantities for All Surveys

VEC annually will target an estimated 25,000 Next of Kin (NOK) who meet selection criteria for all population groups. It is anticipated that the National Change of Address (NCOA) and eligibility processes will reject a percentage of these addresses. For those surveys that are not returned, a second, reminder letter and BFS will be sent to the NOK. It is estimated that 60% of NOK will need a reminder letter and second BFS resulting in approximately 40,000 surveys administered annually.

3. SPECIAL REQUIREMENTS

Services Required

Materials

The materials list, descriptions and specifications are annotated in Table 3.1. Materials are gender specific. For patients serviced through the VA Caribbean Healthcare System or is designated as a Spanish speaking household, all materials will go out with the Spanish language version. Emailed materials will be the same as the website.

Table 3.1: Materials for BFS

Process

VA will provide the vendor the address files in Excel file (compressed if necessary using PKZIP), and must undergo Code 1 mail-streaming and National Change of Address (NCOA) cleaning. The vendor’s systems must be compatible with these methods.

An output file containing the rejected names and addresses must be provided to VEC along with the reject code or some explanation for reason of rejection.

The output containing the names and addresses of those records retained after NCOA cleaning (i.e. cleared for mailing) must be provided to VEC in the layout described in Appendix B: Mailing Output File Format.

Information regarding the NCOA process can be obtained from the Post Office or other survey vendors that provide mailing services. NCOA software is available through a software retailer. NCOA software must be updated monthly, at a minimum, to guarantee accuracy.

The VEC is currently using SAS 9.3 and Microsoft Office 2016 on a Windows 7 Enterprise operating system. The vendor must have compatible systems in order to work with all VA systems and must adhere to Secure Socket Layer (SSL) Protocols and Public Key Infrastructure (PKI), as appropriate, in the transference of any sensitive patient identifiable data. All data transfers must be completed via PKI encrypted email through the VA virtual private network (VPN) access that will be provided.

Personalization of Survey Materials

Four versions of the survey, male and female specific, each in English and Spanish, will be mailed according to the gender of the deceased Veteran and facility of death (VA Caribbean Healthcare System decedents or other identified by the VA will receive the gender specific Spanish language version of the survey).

The addressing for the survey cover letter will, at a minimum, contain the name and address of the Veteran’s Next of Kin (NOK), the name of the Veteran, and his/her unique identification number (provided by the VEC). The purpose of the patient unique identification number serves as a way of tracking respondents so that their names will not appear directly on the questionnaire. The VEC guarantees survey respondents’ anonymity.

The identification numbering system used to track surveys specifies a unique number to each individual in the sample. This number will be used during data analysis to link survey respondents to their demographic data. The numbering system will be provided by the VEC to the vendor.

Data Collection

Data collection for the surveys will be done using optical scanning or digital image capture techniques backed up by direct double entry keypunching where necessary for damaged surveys.

Data shall be reported back to VEC based on the schedule detailed in Attachment A: Mailing and Response Time Schedule and in the format provided in Attachment C: Data File to VEC Format.

· The Bereaved Family Survey contains two questions that are open-ended to allow additional feedback from families. All these responses shall be provided in full as digital images and transcribed with the responses linked to the unique identifier for correct identification by the VEC. These responses shall be transmitted to VEC on a monthly basis with the raw, quantitative survey data in the format provided by VEC. If content in the transcribed responses is disconcerting, the contractor will alert VEC right away. The contractor will also alert VEC if family members ask to be contacted by VA within the qualitative responses.

Timestamping

The Contractor shall implement a comprehensive mail tracking system for all outgoing and incoming mail related to the Bereaved Family Survey (BFS) distribution and collection process. This system must include the following specific requirements:

Outgoing Mail Timestamping: Each piece of outgoing mail, including surveys, introductory letters, and any additional mailed materials, must be timestamped to document the date and time of dispatch. This record must be maintained in an auditable format and made available to the VEC on a monthly basis or upon request.

Incoming Mail Timestamping: Upon receipt of completed surveys and any other incoming mail, the Contractor shall timestamp these items to log their arrival date and time. This timestamp must accurately reflect the actual moment of receipt by the Contractor's mail handling facility.

The Contractor is responsible for ensuring the integrity and accessibility of the timestamping records throughout the contract period and shall provide monthly reports to the VEC detailing the outgoing and incoming mail volumes along with their respective timestamps.

Data Entry Timing

In addition to the previously defined tasks, the Contractor shall adhere to the following data entry timeline:

Survey Data Entry and Timeliness: The Contractor is required to ensure that all data from completed surveys are entered into the designated database no later than forty-eight (48) hours prior to the scheduled delivery date of any data reports. This advance entry is critical to allow sufficient time for data validation and quality checks before the data is utilized in any reporting or analysis.

The Contractor must establish and maintain an effective data management process that guarantees compliance with this timeline and shall immediately notify the VEC of any potential delays or issues that may impede adherence to the specified data entry schedule. A record of date of data entry must be maintained in an auditable format and made available to the VEC on a monthly basis or upon request.

Mail Timing

The Contractor shall comply with the following dispatch timeline for survey mailings:

Post-Approval Mailing Commitment: Once the proofs for the mailing products/surveys have been reviewed and formally approved by the VEC, the Contractor shall ensure that all surveys are dispatched within one (1) business day following such approval.

The Contractor must establish a process that supports this rapid turnaround time and must provide confirmation to the VEC that the surveys have been mailed within the stipulated timeframe.

QR Code and Mobile Friendly Survey

The Contractor shall also provide an online version of the Bereaved Family Survey (BFS) with the following specifications:

QR Code Generation: For each survey distributed, the Contractor shall generate a unique QR code that allows family members to access the survey directly. The QR code must be printed on the survey materials and tested for accuracy and ease of use prior to distribution.

Shortened URL Creation: Alongside the QR code, the Contractor must provide a shortened, easy-to-type URL for survey access. This URL shall follow a simple format (e.g., http://survey.va/[lastname][last4SSN]) where [lastname] is the family member's last name and [last4SSN] is the last four digits of the Veteran's Social Security Number.

Mobile-Friendly Survey Interface: The online survey must be optimized for mobile access, ensuring that family members can easily complete the survey on a smartphone or tablet device.

The Contractor is responsible for the security and privacy of the survey access system, ensuring that only authorized family members can access the survey for their relative. The Contractor will provide detailed instructions to the VEC on how the QR codes and shortened URLs are generated and distributed, as well as measures taken to protect the respondents' information.

VA-Compatible Server

The Contractor must establish a secure and reliable electronic file transfer solution to facilitate the exchange of data between the Contractor and the Department of Veterans Affairs (VA):

FTP Server Provision: The Contractor shall provide and maintain an FTP server, such as a Wing FTP Server, for the purpose of secure and efficient file uploads and downloads by both the Contractor and the VA. This FTP server shall serve as the primary means for the electronic transmission of mailing lists, survey data, and other relevant documents.

Compatibility and Security: The chosen FTP server solution must be compatible with VA systems and not be subject to any restrictions or blockages by VA's internet security protocols. The Contractor is responsible for ensuring that the FTP server meets all applicable VA security requirements to safeguard sensitive data.

Data Exchange Process: The VEC will upload mailing lists to the FTP server for the Contractor’s access. Conversely, the Contractor will upload completed survey data and other deliverables to the server for the VA's retrieval. All data transfers must be logged and timestamped, with records maintained for the duration of the contract.

Technical Support and Accessibility: The Contractor is required to provide technical support for the FTP server and ensure its accessibility to authorized VEC personnel 24 hours a day, 7 days a week. Any downtime or maintenance of the server must be communicated to the VEC in advance with minimal disruption to service.

The Contractor shall include detailed protocols for the use of the FTP server in their operations manual, ensuring clarity on procedures for data uploads, downloads, security, and maintenance.

Morning, Email Reponses

The Contractor shall expand the survey outreach methods to include electronic communications as detailed below:

Email Notification to Next of Kin: The Contractor is required to send out emails to the next of kin for each Veteran (if applicable), providing a direct link to the online version of the Bereaved Family Survey (BFS). The email should contain a clear and concise message that includes an expression of gratitude for their participation, instructions for how to complete the survey, and contact information for technical support (similar to the information provided in the paper version of the survey).

Personalized Email Content: Each email must be personalized to address the recipient by name and ensure that the survey link is unique and secure. The email must also contain a privacy statement and reassurance that all shared information will be kept confidential.

Email Delivery Tracking: The Contractor shall implement a system to track the delivery and, where possible, the opening of the emails to gauge the effectiveness of this communication channel. Bounced or undeliverable emails must be reported, and alternative follow-up methods should be deployed as necessary.

The Contractor is responsible for the creation, distribution, and management of the email notifications, adhering to all applicable regulations regarding electronic communications and privacy. A protocol for email communications, including templates, tracking, and follow-up procedures, must be submitted to the Contracting Officer’s Representative (COR) for approval prior to the initiation of the survey campaign.

Survey Identification System

The Contractor must incorporate a clear identification system for all surveys to facilitate tracking and analysis:

Survey Identification System: Each survey distributed must include an identifier that denotes the specific month of the mailing and indicates whether it was part of the first, second, or third wave of mailings. For example, an identifier might be structured as MMYY-W#, where MM represents the month, YY represents the year, and W# indicates the wave number (e.g., W1 for the first wave).

Identifier Visibility: This identifier must be prominently displayed on the survey document in a location that is easily visible to ensure proper sorting and tracking upon return.

Reporting and Tracking: The Contractor shall use this identifier in all tracking reports and databases to enable the VEC to monitor the response rates and follow-up efforts associated with each month’s mailing and corresponding wave.

The Contractor is responsible for the generation, application, and management of these identifiers to ensure accurate tracking throughout the survey lifecycle. Detailed procedures on the application and management of the survey identifiers must be included in the operations manual and submitted to the COR for approval.

Survey Costs

The Contractor must adhere to the following cost framework for survey costs:

Fixed Cost of Surveys: The per-death unit cost of producing and distributing surveys shall remain unchanged, regardless of number of first, second or third wave surveys sent. Cost is per Veteran, not the number of surveys sent. This encourages the Contractor to report as many responses as possible within the first wave mailing and alleviates the need to send follow-up (second and third wave) surveys.

Cost for Survey Revisions: In the event of changes (modifications >10% of survey) to the survey design, such as major revisions to question wording, the Contractor is authorized to charge a one-time start-up fee to cover the costs associated with implementing the design change. This fee shall be agreed upon in advance and shall not recur for subsequent batches of the revised survey, ensuring that the VA is not subject to escalating costs for the standard production of surveys. Comment by Gilbert, Dawn K.: How to define "changes"

Notification and Approval of Costs: Any proposed start-up costs associated with survey revisions must be submitted to the Contracting Officer’s Representative (COR) in writing, detailing the scope of the change and an itemized list of associated costs. Approval from the COR must be obtained before the Contractor proceeds with the changes.

The Contractor's detailed pricing structure, inclusive of the one-time start-up fee for survey revisions and the fixed production costs, must be outlined in the contract's pricing section and subject to the COR's approval.

White Mail Processing

Additional materials and comments that NOKs enclose on attached sheets of paper, recorded audiocassettes, photographs, etc. are commonly called “white mail”. The vendor will be required to screen all white mail for NOKs in distress or in need of critical assistance. These conditions include but, are not limited to: language consistent with threats of suicide, homicide or other threats to self or others, threats of lawsuit, and indications of depression and or desperation, or complaints being brought to the President, members of Congress or the local media.

Any instance of a critical alert in white mail must be brought to the attention of VEC immediately for review and response via telephone or fax, depending on the urgency, and follow up next day mailing of any original correspondence to VEC.

All contractor staff screening white mail will be required to complete available suicide and depressions training courses available through the VA’s Talent Management System (TMS).

Non-critical white mail must be returned to VEC for processing, at a minimum, once a week as some of the material may be time sensitive. If the material includes additional information detailing the care given, the information must be transcribed with the responses linked to the unique identifier in Attachment C: data File to VEC Format. Each piece of white mail sent to VEC must have the patient’s ID code to allow rapid follow-up in critical situations. Special care must be taken to ensure the security of these identified documents in transit and to ensure that items received by VEC are in the form it was received by the Vendor.

Return to Sender (Undeliverable) (RTS) and Deceased NOKs The file containing the mailing list of NOK of deceased Veterans provided by VEC will only include Veterans that were known to have died as an inpatient in a VA Medical Center and deceased Veterans known to have died in a VA-paid CNH with hospice at time of the eligibility pull. Although VEC requires the vendor to run the mailing list through NCOA and Code 1 mail streaming to remove any incorrect addresses, some Veteran’s Next of Kin pass away or move before the surveys reach them. Any survey returned to the vendor as undeliverable will be coded in the data set as “undeliverable” or “deceased” according to the reason noted on the envelope. This information is important for statistical purposes to compute our true and adjusted response rates.

Any white mail forwarded to VEC from returned surveys marked as deceased must have some indicator written on them by the vendor that the accompanying survey has been coded as deceased in the data file. Additionally, any emails “bounced back” to the Contractor must be coded as “undeliverable”. Comment by Gilbert, Dawn K.: Do we want to code these as a 4? Or have a new code?

Mailing

The business reply envelopes must have the name of the VEC and the Corporal Michael J. Crescenz VAMC as the recipient of the returned piece along with the address of the data processing facility of the vendor.

The mailing of all components must be done via first class mail, taking advantage of all available sorting and bulk mail discounts. At the completion of each mailing segment (reference Attachment A: Mailing and Response Time Schedule), a postal summary of all activity that can be individually identified, including postage dates and costs incurred, will be supplied to the VA by the vendor.

Definitions

CONTRACTOR. A supplier or vendor awarded a Contract to provide specific supplies or services to the government. The term used in this Contract refers to the prime Contractor.

CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate Contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

CONTRACTING OFFICER’S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the Contracting Officer to administer the Contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the Contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the Contract.

KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a Contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

SUBCONTRACTOR. One that enters into Contract with a prime Contractor. The Government does not have privity of Contract with the subcontractor.

Acronyms

BAA – Business Associate Agreement BFS – Bereaved Family Survey CMCVAMC – Corporal Michael J. Crescenz VA Medical Center CNH – Community Nursing Home CO – Contracting Officer COR – Contracting Officer’s Representative FAR – Federal Acquisition Regulation FIPS – Federal Information Processing Standards FISMA – Federal Information Security Management Act of 2002 HIPAA – Health Insurance Portability and Accountability Act of 1996 ISO – Information Security Officer NCOA – National Change of Address NDPP – National Directors’ Performance Plan NIST – National Institute of Standards and Technology NOK – Next of Kin PROMISE – Performance Reporting and Outcomes Measurements to Improve Standard of care at End-of-Life QA – Quality Assurance QASP – Quality Assurance Surveillance Plan TJC – The Joint Commission TMS – Talent Management System VA – Veterans Administration VEC – Veteran Experience Center VHA – Veterans Health Administration VISN – Veterans Integrated Service Network VSSC – VHA Support Service Center

Contractor Staff

Conflict of Interest

The Contractor will ensure services performed by the Contractor personnel will be performed in accordance with VA policies and procedures and the regulations of the Medical Staff Bylaws of the VA facility. Section D, VHA Handbook 1660-3, Conflict of Interest Aspects of Contracting for Scarce Medical Specialist Services, Enhanced Use Leases, Health Care Resource Sharing, Fee Basis and Intergovernmental Personnel Act Agreements (IPAs).

VHA Handbook 1660.3, “Conflict of Interest Aspects of Contracting for Scarce Medical Specialist Services, Enhanced Use Leases, Health Care Resource Sharing, Fee Basis and Intergovernmental Personnel Act Agreements (IPAs),” dated September 22, 2008, is incorporated into this Contract by reference. Any VA employee who is employed by the Contractor is prohibited from participating, on behalf of the Government, in a VA Contract with the Contractor.

Citizenship Related Requirements

Contractor Certification (Immigration)

The Contractor shall comply with all applicable immigration laws, rules and regulations, including but not limited to the Immigration and Nationality Act of 1952, as amended and shall prior to performance under this Contract execute the Contractor Certification incorporated herein.

Office of Inspector General (OIG) Statement

HEALTH AND HUMAN SERVICES (HHS)/OFFICE OF INSPECTOR GENERAL (OIG): To ensure that the individuals providing services under the Contract have not engaged in fraud or abuse regarding Sections 1128 and 1128A of the Social Security Act regarding federal health care programs, the Contractor is required to check the HHS - OIG, List of excluded individuals/entities on the OIG Website www.hhs.gov/oig for each person providing services under this Contract. Further, the Contractor is required to certify in its proposal that all persons listed in the Contractor’s proposal have been compared against the OIG list and are not listed. During the performance of this Contract, the Contractor is prohibited from using any individual or business listed on the List of Excluded Individuals/Entities.

Information Security Officer (ISO) Statement

VA Information Custodial Language

Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data- General, FAR 52.227-14(d) (1).

VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA COR and the Contracting Officer within 30 days of termination of the contract.

The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if National Institute of Standards and Technology (NIST( issues or updates applicable Federal Information Processing Standards (FIPS) or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the COR for response.

Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

Security Incident Investigation

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

Liquidated Damages for Data Breach

Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

Each risk analysis shall address all relevant information concerning the data breach, including the following: (1) Nature of the event (loss, theft, unauthorized access); (2) Description of the event, including: (a) date of occurrence; (b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code; (3) Number of individuals affected or potentially affected; (4) Names of individuals or groups affected or potentially affected; (5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; (6) Amount of time the data has been out of VA control; (7) The likelihood that the sensitive personal information will or has been compromised (8) Known misuses of data containing sensitive personal information, if any; (9) Assessment of the potential harm to the affected individuals; (10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and (11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Training

All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems: (1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems; (2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training; (3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and (4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the COR and the Contracting Officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

The contractor shall provide to the COR and the Contracting Officer a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

Non-Personal Services

No Employee Status

The parties agree that the Contractor, its employees, agents, and subcontractor shall not be considered VA employees for any purpose.

Personnel Policy: The Contractor shall be responsible for protecting the personnel furnishing services under the Contract. To carry out the responsibility, the Contractor shall provide the following for these personnel:

· Worker’s compensation

· Professional liability insurance

· Health examination

· Income tax withholding

· Social security payments

In performance of this contract, the Contractor shall provide non-personal health care services as required by program offices to support management of their overall mission. This will be based upon the order's performance work statement for the specific effort.

The services required under the order constitute professional and management services within the definition provided by FAR 37.401. Under this contract the Government will obtain professional services, which are essential to the Department of Veterans Affairs mission but not otherwise available within Department of Veterans Affairs.

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage their employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the Contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor’s further responsibility to notify the COR and the Contracting Officer immediately.

These services shall not be used to perform work of a policy/decision making or management nature. All decisions relative to programs supported by the Contractor will be the sole responsibility of the Government. Support services will not be ordered to circumvent personnel ceilings, pay limitations, or competitive employment procedures.

Tort

The Federal Tort Claims Act does not cover contractors or their staff. When a contractor or a member of its staff has been identified as a provider in a tort claim, the contractor is responsible for notifying their legal counsel and/or insurance carrier. Any settlement or judgement arising from a contractor’s (or contractor’s staff) action or non-action is the responsibility of the contractor and/or insurance carrier. The contractor shall be liable for, and shall indemnify and hold harmless the Government against, all actions or claims for loss of or damage to property or the injury of persons, arising out of or resulting from the fault, negligence, or wrongful act or omission of the contractor, its agents, or employees/staff.

Medical Liability

The Government may evaluate the quality of services provided, but retains no control over the medical, professional aspects of services rendered (e.g., professional judgments, diagnosis for specific medical treatment), in accordance with FAR 37.401(b) (Non-personal Health Care Services).

Medical Liability: See VAAR Clause 852.237-7 – The contractor is required to ensure that his/her sub-contractors provisions of health care services contain the requirement of the VAAR Clause 852.237-7, including the maintenance of medical liability insurance.

Key Personnel and Emergency Substitutions

The services to be performed by the Contractor will be monitored by the COR currently designated as Francis Nelson (Primary) (Administrative Officer), Department of Nursing/Patient Care Services or Dawn Gilbert (Alternate) (VEC Director of Operations), Department of Nursing/Patient Care Services.

Key Personnel and Temporary Emergency Substitutions

Key Personnel are those Contractor personnel whom are essential to performance of the Contract requirements and/or were considered or included by the Contractor in development of solicitation response, including individuals in key management, staffing, and related positions. The Contractor shall assign to this Contract the following key personnel:

During the first ninety (90) days of performance, the Contractor shall make NO substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment. The Contractor shall notify the COR and the Contracting Officer, in writing, within fifteen (15) calendar days after the occurrence of any of these events and provide the information required by paragraph (c) below. After the initial 90-day period of the Contract, the Contractor shall submit the information required to the COR and the Contracting Officer at least fifteen (15) days prior to making any permanent substitutions.

The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitution and complete resume for the proposed substitute. Proposed substitute shall have comparable qualifications to those of the person being replaced. The COR shall notify the Contractor within fifteen (15) calendar days after receipt of all required information of the decision on the proposed substitution. When changes in key personnel are approved, the Contract prices may be adjusted accordingly to reflect the salary and benefits of the personnel actually providing the services.

For temporary substitutions where the key person will not be reporting to work for three (3) consecutive work days or more, the Contractor will provide a qualified…