ATTACHMENT B - HCCH I - PWS 9.24.2026 DRAFT.docx

Health Care Clearing House (HCCH) - Electronic Insurance Transactions and Insurance Discovery

The Veteran’s Health Administration (VHA) Office of Community Care (OCC), Revenue Operations (RO), eBusiness Solutions Office

Performance Work Statement for

Health Care Clearing House (HCCH)

Electronic Insurance Transactions and Insurance Discovery

April 16, 2026 Revised: September 24,2026

Table of Contents

PERFORMANCE WORK STATEMENT

1. Scope: The Veteran’s Health Administration (VHA) Office of Community Care (OCC), Revenue Operations (RO), eBusiness Solutions Office is looking to establish a Contract with a second Health Care Clearinghouse (HCCH) to continue to increase connectivity and further decrease processing time for VHA revenue operations. The Contractor shall conduct Health Insurance Portability and Accountability Act (HIPAA) Health Care Eligibility/Benefit Inquiry and Response 270/271 electronic transactions received from our Austin Financial Services Center (FSC) from across the United States and its territories. The Contractor shall conduct customized electronic transactions to search for patient insurance when VHA does not already have information on file. The Contractor shall assist the VHA in continuing its mission to implement electronic transactions. At no time shall the Contractor direct, change, or engage in the formulation of VHA policy. The VHA is solely responsible to review the Contractor’s recommendations and to make decisions concerning the formulation of policy.

*** The Department of Veterans Affairs (VA) is currently undergoing a reorganization that may result in future changes to its organizational structure, processes, responsibilities, and priorities. Such changes could affect the customers, services, or support described in this Performance Work Statement (PWS). Accordingly, the Contractor shall remain adaptable and responsive to evolving VA requirements and work in close coordination with the Government to assess and implement necessary adjustments, as needed. Any resulting changes will be completed by bilateral contract modification.

2. Background: As a Health Care Provider, VHA has initiated several projects to increase the number of transactions that are completed electronically to comply with legislation and to facilitate administrative simplification. The VHA currently utilizes a Contractor to transmit its incoming and outgoing electronic transactions to the national Payer community. Various transaction formats are utilized, such as HIPAA Health Care Claim 837 (X12N-5010) and National Council for Prescription Drug Program (NCPDP) transactions. VHA transactions are completed as batch and real-time transfers. This secondary Contract will transmit only HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271 transactions for various Payers. VHA intends to use this secondary HCCH to expand its access to significant payers not provided by our primary HCCH contract. In January 2018, VHA implemented an insurance coverage discovery process to identify patient insurance information when VA does not already have billable insurance information already on file. This new system provides a standard, automated method for obtaining patient’s third-party insurance information by utilizing customized HIPAA transactions. VHA intends to continue utilizing a secondary HCCH to transmit these customized electronic transactions to identify patient insurance information.

eBusiness Solutions, as a proponent of administrative simplification, currently exchanges transactions from health care entities to third-party carriers. VHA has a fully developed and robust system to generate insurance eligibility inquiries for all places of care throughout VHA and route the transactions through (FSC) prior to transfer to the HCCH. This system and processes are referred to as Veterans Health Information Systems and Technology Architecture (VistA) electronic Insurance Verification (eIV) module.

While required by law, at times VHA finds that patients are sometimes reluctant or remiss in sharing their third-party insurance information with VHA. To comply with federal regulations and to ensure revenue operations are generating health care claims to the maximum extent possible, VHA has engaged in efforts to seek patient’s third-party insurance information from contracted sources. VHA has a fully developed a robust system of data extracts that provide basic patient demographics routed through FSC prior to transfer to the HCCH for which the Contractor can use to search for patient insurance information. This system and processes are referred to as Electronic Insurance Coverage Discovery (EICD).

3. Period of Performance (POP): The POP shall be from the date of award for a five (5) year ordering period.

4. Place of Performance: Work shall take place at the Contractor’s site. Although work is not anticipated at a Government site, work at any Government site shall never take place on Federal holidays or weekends, unless directed by the Contracting Officer (CO).

5. Type of Contract: Firm Fixed Price (FFP) Indefinite Delivery/Indefinite Quantity (IDIQ)

6. Minimum and Maximum Orders: The minimum order for the life of the IDIQ shall be one thousand dollars ($1,000). The maximum ceiling for the life of the IDIQ shall be no more than Twenty-Five Million dollars ($25,000,000.00).

7. Tasks: The Prime Contractor shall:

***Note: All tasks and deliverables that mention, outline or utilize the word(s) “payer” or “payers” throughout the entire PWS shall include, but are not limited to participating and non-participating payers, authorized agents and/or representatives. For the purposes of this document, “payer” is defined as any insurance carriers whose enrollees are also Veterans. ***

7.1. The Contractor will provide an Activation Transition Plan, to include proposed areas and tasks to cover during the Phase-In, and how many days they would anticipate would be required to complete the transition period activities (not to exceed 30 days). The incumbent Contractor agrees to work with the new contractor during the actual Transition Plan period as much as pertinent to make it as seamless as possible.

7.1.1. Deliverable: Activation Transition Plan

7.2. Ability to perform testing or certification mechanism for validation of real-time transactions in the current HIPAA X12 version within (30) business days of award date and/or by contract effective date; whichever comes first.

7.2.1. Deliverable: Confirmation of successful communication(s)

7.3. Receive, process, and transmit CAQH CORE Operating Rules compliant HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271 transactions via batch and/or real- time transfer and translate proprietary formats to and from HIPAA compliant transactions on behalf of VHA and support any future industry standards that may be released (i.e. such as HL7 and/or HIPAA X12 version 7030).

7.3.1. Deliverable: Real-time HIPAA 270/271 transactions for standard payers

7.3.2. Deliverable: Real-time HIPAA 270/271 transactions for participating payers

7.3.3. Deliverable: Real-time HIPAA 270/271 transactions for non-participating payers

7.4. Ability to perform testing or certification mechanisms for validation of coverage discovery transactions within thirty (30) business days of award date and/or by contract effective date; whichever comes first.

7.4.1. Deliverable: Confirmation of successful communication(s)

7.5. Receive, process, and transmit customized X12 270/271 transactions via batch and real-time transfer for insurance coverage discovery.

7.5.1. Deliverable: Customized insurance coverage discovery transactions for found insurance per patient requested

7.5.2. Deliverable: Customized insurance coverage discovery transactions for not-found insurance per patient requested

7.6. Receive, process and transmit electronic acknowledgements for HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271 and standard conformance for HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271 transactions to and from VHA or its submitters billed as included service.

7.6.1. Deliverable: Electronic transaction acknowledgements as per HIPAA standard

7.7. Provide minimum connectivity to health care payers on day one of the contract effective date to maintain the current level of HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271 business. Essential payer connections are listed in Attachment D.

7.7.1. Deliverable: Minimum payer connectivity for transactions

7.7.2. Deliverable: HIPAA X12 270/271 Payer List

7.8. Provide minimum connectivity to health care payers on day one of the contract effective date to maintain the current level of insurance coverage discovery business. Essential insurance coverage discovery payer connections are listed in Attachment J.

7.8.1. Deliverable: Minimum payer connectivity for transactions

7.8.2. Deliverable: Insurance Coverage Discovery Payer List

7.9. The Contractor will provide a Closure Transition Plan, to include proposed areas and tasks to cover during the Phase-Out and how many days they would anticipate would be required to complete the transition period activities (not to exceed 30 days). The incumbent Contractor agrees to work with the new contractor during the actual Transition Plan period as much as pertinent to make it as seamless as possible.

7.9.1. Deliverable: Closure Transition Plan

8. Deliverables Specific to this Order:

The following transaction deliverables shall be billed by transaction processed. Note: The term “processed” shall mean “Only transactions that have made it to the contractor processing system (exclude those that were received but failed to go through validation)”.

Electronic transaction acknowledgements as per HIPAA standard

(PWS 7.6)

9. Schedule of Services:

10. Governance and Key General Requirements:

The Prime Contractor and all sub-contractor(s) shall:

10.1. Be a fully “Accredited Healthcare Network” (HNAP-EHN) by the Electronic Healthcare Network Accreditation Commission (EHNAC) (www.ehnac.org) at the time of Contract Award and/or Contract Effective date whichever comes first; and maintain accreditation for the duration of the Contract. Further discussion is provided in Attachment M.

10.1.1. Alternately, adherence to all VA security and data privacy requirements as outlined in Section C – General Security Requirements must be met at the time of Contract Award and/or Contract Effective date whichever comes first; and maintain VA Authority to Operate (ATO) for the duration of the Contract.

10.2. Be certified by the Council for Affordable and Quality Healthcare (CAQH) (https://www.caqh.org/core/operating-rules), as a CORE Phase II Certified trading partner for both batch and real-time HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271at the time of Contract Award and/or Contract Effective date whichever comes first; and maintain certification for the duration of the Contract. Further discussion is provided in Attachment M.

10.3. Work towards future Committee of Operating Rules and Information Exchange and any other future phase certifications required by law within a mutually specified timeframe and/or by the implantation date specified by law.

10.4. Indicate their existing connectivity to Payers and provide a list of targeted Payers they are working with for future connectivity. Upon request of the COR, provide any other relevant report(s) on an as needed basis within five (5) business days unless otherwise negotiated with COR.

10.5. Provide VHA technical points of contact, as well as back-ups, for the coordination of activities associated with the transition, development, implementation and sustainment (production) phases.

10.6. Provide transaction transmission and processing service at a mutually agreed upon level which will include at a minimum; data transmission, timeliness, accuracy and system availability metrics.

10.7. Ensure connectivity between VHA and the Contractor will be a site-to-site Virtual Private Network (VPN) that meets VA security requirements. Ensure data is encrypted to FIPS 140.2 standards prior to entry into the VPN Tunnel.

10.8. Ensure to work with appropriate VA/VHA personnel to complete and sign a VA Interconnection Security Agreement and Memorandum of Understanding (ISA-MOU) and Business Associate Agreement (BAA) upon contract award.

10.9. Work with the Financial Services Center (FSC) and Austin Information Technology Center (AITC) on connectivity requirements.

10.10. Meet all HIPAA and Patient Protection and Affordable Care Act (PPACA) standards for HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271and will not impose non-standard transaction options for standard transactions.

10.11. Understand that an “on line” eligibility and enrollment check performed via a web site, web portal, or web scrape is not a compliant HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271 and is not considered a HIPAA transaction and is thus non-compliant for this effort and will not be considered.

10.12. VA shall be charged only once for each successful HIPAA Health Care Eligibility/Benefit Inquiry 270 transaction (i.e. not charged for any transaction that times out, fails validation, rejects during processing, or are duplicates due to re-submission).

10.13. VA shall NOT be charged separately for any HIPAA Health Care Eligibility/Benefit Response 271transaction as they are considered answers to a successful submission of a HIPAA Health Care Eligibility/Benefit Inquiry 270 transaction.

10.14. VA shall be charged only once for each successful insurance coverage discovery transaction cycle even if the transaction contains multiple insurance policies found (i.e. charged per patient, not per insurance policy found). Transaction formatting is available in Attachment L.

10.15. VA shall not be charged separately for any intermediary transaction sent to the clearinghouse to attempt to retrieve a successful insurance coverage discovery transaction where the insurance policies are not yet found and sent to VHA (i.e. not charged for a status check message that results in a ‘results not ready, try again later’). Transaction formatting is available in Attachment L.

10.16. Contractor shall support any new industry standards and transaction types by the compliance date specified in Regulations or other controlling documents or legislation.

10.17. When PII/PHI data is transferred from VA/VHA to the Health Care Clearing House (HCCH), it immediately becomes HCCH data, and the HCCH is responsible for obeying all applicable Federal Information Security Management Act (FISMA) and HIPAA rules and regulations. As a covered entity under HIPAA, HCCHs are bound by and must comply with all HIPAA requirements, including requisite Security and Health Information Technology for Economic and Clinical Health Act (HITECH) reporting requirements.

10.18. The services outlined in the PWS are considered essential to the revenue operations cycle process. Should the contractor not be able to process transactions for any reason as outlined in the PWS; contractor shall provide a backup means of processing transactions until they can resolve any connectivity issue(s). Failure to provide a backup means so as not to interrupt operations, shall result in monetary penalties calculated for each day service is inoperable up to but not exceeding the contract award. At the end of the contract period of performance, should the incumbent not be awarded any potential follow-on contract award; contractor shall provide continuity of services as outlined by the contracting officer in Section C of this contract referenced under clause 52.237-3 “Continuity of Service”.

10.19. To support continued operations, the contractor should have data reporting in place to ensure transaction volume, errors, and data is available to research transaction issues. Attachment A provides references to material VA and the Contractor utilize for operational support and transaction monitoring.

10.20. An Interconnection Security Agreement (ISA)/Memorandum of Understanding (MOU) (ISA/MOU) and Business Associate Agreement (BAA) are required and contractor agrees to work with the necessary VA staff) to complete these documents upon contract award and support the approval process for the ISA – MOU.

10.21. Transaction volume projections do not consider changes in Veteran demographics, impact of the economy or impact of new and/or removal of legislative initiatives or mandates imposed on VHA.

10.22. The Contractor should support VHA efforts to inform Payers of non-compliant transactions and/or data content received in HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271 transactions and assist VHA in ensuring Payers become compliant. The contractor must have staff with extensive knowledge of 270/271 Eligibility & Benefit Information transaction and familiarity with CAQH CORE operating Rules required in X12, and HIPAA Compliance standards. The incumbent may be required to work with non-compliant Payers without the assistance of VA/FSC staff. Ideal incumbent staff should belong to the X12 Eligibility and Benefit Info (270/271 transaction) workgroups. They must be in good standing with documented regular attendance or participation in the workgroup.

10.23. Coordinate with VA/VHA any changes to system, applications, network, security, privacy, procedure, policies, or any other item that may impact the services provided as indicated by this PWS. At least a thirty (30) day notification prior to any change shall be provided to VA/VHA. VA/VHA must concur before the change is implemented.

10.24. Cooperate and participate as necessary in FSC/VHA’s Disaster Recovery planning and testing when necessary to ensure failover operations can be maintained in the event of localized disaster affecting transaction services.

11. Section 508 Compliance: In December 2000, the Architectural and Transportation Barriers Compliance Board (Access Board), pursuant to Section 508(2) (A) of the Rehabilitation Act Amendments of 1998, established Information Technology accessibility standards for the Federal Government.

11.1. Section 508(a)(1) requires that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they shall ensure that the EIT allows individuals with disabilities who are Federal employees to have access to and use of information and data that is comparable to the access to and use of the information and data by Federal employees who are not individuals with disabilities; and individuals with disabilities who are members of the public seeking information or services from a Federal department or agency to have access to and use of information and data that is comparable to the access to and use of the information and data by such members of the public who are not individuals with disabilities.

11.2. The Contractor shall comply with the following technical standards:

11.3. 1194.21 - Software Applications and Operating Systems

11.4. 1194.22 - Web Based Intranet and Internet Information and Applications

11.5. 1194.23 - Telecommunication Products

11.6. 1194.24 - Video and Multimedia Products

11.7. 1194.25 - Self Contained Closed products

11.8. 1194.26 - Desktop and Portable Computers

11.9. 1194.31 - Functional Performance Criteria

11.10. 1194.41 - Information, Documentation and Support

11.11. To validate conformance to the above standards the COR shall complete the VA’s Section 508 Determination and Findings Document.

11.12. The VA’s Section 508 Program Office has developed a Conformance Validation Statement (CVS).

11.13. The CVS shall be completed by the responsible requiring/procurement official as part of their market research to validate the conformance of the EIT project ((See Section ten (10) in the Section 508 Determination and Findings Document)).

11.14. If at any time the responsible requiring/procurement official finds that an exception shall apply, the Contractor shall complete and have the Section 508 EIT Exceptions Certification Document signed by the VA Section 508 Coordinator. Once the EIT is determined to meet all applicable Section 508 standards, the EIT is validated by the VA’s Section 508 PO in the Department’s Section 508 Testing and Training Center using the information provided by the CVS.

11.15. In case the VA decides to purchase an application, product or service that cannot be validated for Section 508 prior to purchase, the Contractor agrees to accept all costs for ensuring conformance working with the VA Section 508 Program Office (PO). For future releases or upgrades all steps using the CVS are required and upon validation a signed approval shall be given to the VA Point of Contact (POC) from the VA Section 508 Coordinator.

11.16. Section 508 information is available at https://www.section508.gov/

11.17. The VA Directive and Handbook 6221, Accessible Electronic and Information Technology are posted at: VA Handbook 6221: https://www.va.gov/vapubs/search_action.cfm?dType=2

12. Communication Standards: The Contractor shall:

12.1. Provide an as needed summary to the COR if and when processing inconsistencies and irregularities that impact ongoing deliverables occur.

12.2. Propose modifications to the reporting requirements to the COR.

12.3. Explain, in writing, to the COR (if for any reason a deliverable cannot be met within the scheduled time frame or adherence to the established schedules cannot be met) the following:

12.4. Reasons for the delay

12.5. Modified delivery date

12.6. Impact on the overall project

12.7. A revised project plan with all adjusted dates

12.8. The COR shall brief the incident to the CO, who shall issue a response pursuant to applicable regulations.

13. General Security Requirements: The Contractor shall:

13.1. Not divulge or disclose information received and/or discussed regarding data considered proprietary to other Contractors collaborating on or with this effort.

13.2. Be required to complete mandated VA privacy and security training.

13.3. Be required to negotiate agreements with commercial system Contractor’s relating to non-disclosure of Contractor-proprietary information.

13.4. If the Contractor uses copyright or otherwise licensed software in any deliverable under this order, the Contractor shall secure unlimited use rights for the Government.

13.5. Forward all software licenses on to the Government within thirty (30) business days after completion of the tasks.

13.6. Limit access to the minimum number of employees necessary to perform tasks that are considered sensitive or proprietary in nature.

13.7. Contact the COR, if the Contractor is uncertain of the sensitivity of any information obtained.

13.8. Indoctrinate all personnel employed by the Contractor and any Sub-Contractors involved on their roles and responsibilities for proper handling and nondisclosure of sensitive Government or proprietary information.

13.9. Not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information.

13.10. Comply with VA and VHA Security requirements.

13.11. Currently, the Contractor does not have access to each site's VistA system. VA executes appropriate internal code to gather patient names and demographic information which is then transmitted to the Contractor via customized HIPAA transaction. The Contractor shall respond to inquiries with found insurance information via customized HIPAA transaction.

14. Information System Hosting, Operation, Maintenance or Use: Government-owned (facility or equipment) Contractor-operated systems, third-party or business partner networks require memorandums of understanding and interconnection agreements (ISA-MOU) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

15. Contract Award Meeting: The Contractor shall not commence performance on the tasks described in the PWS until the CO has conducted a kick off meeting or has advised the Contractor that a kick off meeting has been waived. The Government shall not reimburse the Contractor for any expenses associated with preparing for or executing a kick-off meeting.

16. Changes to the PWS: Any changes to this PWS shall be authorized and approved only through written correspondence from the CO. A copy of each change shall be kept in a project folder along with any other products of the project. Costs incurred by the Contractor, through the actions of parties other than the CO, shall be borne by the Contractor alone.

17. Security and Privacy - Information and Records: The Contractor shall:

17.1. Return all information and records provided to Contractor by the VA, in whatever medium, as well as all information and documents, including drafts, emails, back-up copies, hand-written notes and copies that contain such information and records gathered or created by Contractor (collectively referred to as “VA information”) in the performance of this Contract, regardless of storage media, are the exclusive property of the VA. The Contractor shall not retain any property interest in these materials and shall not use them for any purpose other than performance of this Contract.

17.2. Provide, upon completion or termination of the Contract, all copies of any VA information that it used during work it performed of the contract or certify that it any/all information it obtained has destroyed. Where immediate return or destruction of the information is not practicable, the Contractor shall return and/or destroy the information within thirty (30) business days of completion or termination of the Contract. All provisions of this Contract concerning the security and protection of VA information that is the subject to this Contract shall continue to apply to the VA information for as long as the Contractor retains it, regardless of whether the Contract has been completed or terminated.

17.3. Do Not Destroy, any VA information received from the VA gathered and /or created in the performance of or prior to termination or completion of this contract without prior written approval by the VA .

17.4. Receive, gather, store, backup, maintain, use, disclose and/or dispose of VA information only in accordance with the terms of the contract and any applicable federal, VA, confidentiality, security laws, regulations or policies.

17.5. Not make copies of VA information except as necessary to perform duties required of the contract or to preserve electronic information stored on Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor needs to be restored to an operating state.

17.6. Provide access only to VA information to employees, Sub-Contractors, and affiliates to:

17.7. The extent necessary to perform the services specified of the contract

17.8. Perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the contract.

17.9. Individuals who first satisfy the same conditions, requirements and restrictions that are comparable to VA employees shall meet to have access to the same VA information.

17.10. Restrictions include the same level of Background Investigations, where applicable.

17.11. Store, transport or transmit VA information only in an encrypted form, using an encryption application that meets the requirements of Federal Information Processing Standards (FIPS) 140-2 or is approved for use by the VA.

17.12. Only use or disclose, except for uses and disclosures of VA information authorized by this Contract for performance of the Contract in response to an order of a court of competent jurisdiction, or with VA’s prior written authorization. The Contractor shall refer all requests for, demands for production of, or inquiries about, VA information to the VA for response.

17.13. Include the statement, “Contractor shall not release information protected by either 38 USC 5705 or 7332 in response to a court order and shall immediately refer such court orders to VA for response,” if VA information subject to the contract includes information protected by 38 USC 7332 or 5705.

17.14. Promptly notify the VA, prior to any disclosure pursuant to a court order, of a court order upon its receipt by the Contractor.

17.15. Notify the COR by phone and provide the VA a copy of the court order by fax or e-mail within one (1) business day.

17.16. If the Contractor cannot notify the VA before being compelled to produce the information under court order, the Contractor shall notify the VA of the disclosure as soon as practical and provide a copy of the court order, a description of the records provided pursuant to the court order, and to whom the Contractor provided the records to under the court order.

17.17. The notice shall include the following information to the extent that the Contractor knows it, if it does not show on the face of the court order: the records disclosed pursuant to the order, to whom, where, when, and for what purpose, and any other information that the Contractor reasonably believes is relevant to the disclosure.

17.18. If the VA determines that it is appropriate to seek retrieval of information released pursuant to a court order before Contractor notified the VA of the court order, Contractor shall assist the VA in attempting to retrieve VA information involved.

17.19. Inform the VA, by the most expeditious method available to Contractor, of any incident of suspected or actual access to, or disclosure, disposition, alteration or destruction of, VA information not authorized under this Contract (“incident”) within one (1) hour of learning of the incident.

17.20. An incident includes the transmission, storage or access of VA information by Contractor or Sub-Contractor employees in violation of applicable VA confidentiality and security requirements.

17.21. To the extent known by the Contractor, the Contractor’s notice to the VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information was placed at risk or compromised), and any other information that the Contractor considers relevant.

17.22. Simultaneously report the incident to the appropriate law enforcement entities or jurisdiction. The Contractor, its employees, and its Sub-Contractors and their employees shall cooperate with the VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violations associated with any incident.

17.23. Cooperate with the VA in any civil litigation to recover VA information, to obtain monetary or other compensation from a third-party for damages arising from any incident, or to obtain injunctive relief against any third-party arising from, or related to, the incident.

17.24. In addition to notifying the COR, the VA shall provide the Contractor with the name, title, telephone number, fax number and email address of the VA official to whom the Contractor shall provide all notices required by this contract.

17.25. The VA has the right during normal business hours to inspect the Contractor’s facility, information technology systems and storage and transmission equipment, and software utilized to perform the Contract to ensure that the Contractor is providing for the security of VA data and computer systems in accordance with the terms of this Contract.

17.26. Receive, gather, store, backup, maintain, use, disclose and/or dispose of VA information only in compliance with all applicable FIPS and Special Publications (SP) issued by the National Institute of Standards and Technology (NIST) concerning VA information that is the subject of this Contract. If NIST issues or updates an applicable FIPS or SP after execution of this Contract, the parties agree to negotiate in good faith to implement the FIPS or SP in this Contract.

17.27. Provide appropriate administrative, technical, and physical safeguards to ensure the confidentiality and security of the Veteran’s data and to prevent unauthorized use or access to it.

17.28. Sensitive VA information shall not be transmitted by remote access unless VA approved protection mechanisms are used.

17.29. All encryption modules used to protect VA data shall be validated by NIST to meet the current version of FIPS 140 (See https://csrc.nist.gov/Projects/cryptographic-module-validation-program/publications for a complete list of validated cryptographic modules).

17.30. Only approved encryption solutions using validated modules shall be used when protecting data during transmission.

17.31. Additional security controls are required to guard VA sensitive information stored on computers used outside VA facilities.

17.32. All VA data shall be stored in an encrypted partition on the hard drive and shall be encrypted with FIPS 140 or later validated software.

17.33. The application shall be capable of key recovery and a copy of the encryption keys shall be stored in multiple secure locations.

17.34. The Contractor agrees that the data shall not be physically moved or transmitted in any way from the site without first being encrypted and obtaining prior written approval from the VA data owner.

17.35. A determination by VA that the Contractor has violated any of the information confidentiality and security provisions of this Contract, including a violation of any applicable FIPS or SP, shall be a basis for VA to terminate the Contract for cause.

17.36. If anyone performing this Contract, including employees of Sub-Contractors, accesses VA computer systems or data in the performance of the Contract, the VA shall monitor and record all such access activity.

17.37. If VA monitoring reveals any information of suspected or potential criminal law violations; the VA shall refer the matter to the appropriate law enforcement authorities for investigation.

17.38. Inform its employees and other individuals performing any part of this Contract that VA shall monitor their actions in accessing or attempting to access VA computer systems and the possible consequences to them for improper access, whether successful or not.

17.39. Ensure that any Sub-Contractors or others acting on behalf of or for the Contractor in performing any part of this Contract inform their employees, associates or others acting on their behalf that VA shall monitor their access activities. Execution of this Contract, Sub- Contractor agreement that constitutes consent to VA monitoring applies.

17.40. Ensure that all individuals who shall access VA data or systems in performing the Contract are appropriately trained in the applicable VA confidentiality and security requirements. The Contractor shall document those who have completed the VA training. The Contractor shall contact the COR regarding access to the required VA training.

17.41. Mitigate, to the extent practicable, any harmful effect on individuals whose VA information was accessed or disclosed in an incident.

17.42. Require Sub-Contractors, agents, affiliates or others to whom Contractor provides access to VA information for the performance of this Contract to agree to the same VA information confidentiality and security restrictions and conditions that apply to the Contractor before providing access.

18. Protection of Individual Privacy: The Contractor shall:

18.1. Not publish or disclose in any manner, without the CO’s written consent, the details of any safeguards either designed or developed by the Contractor under this Contract or otherwise provided by the Government.

18.2. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

18.3. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party

18.4. Utilize only employees, Sub-Contractors or agents who are physically located within a jurisdiction subject to the laws of the U.S.

18.5. Ensure that it does not use or disclose Personal Health Information (PHI) received from a Covered Entity in any way that shall remove the PHI from such jurisdiction.

18.6. Ensure that its employees, Sub-Contractors and agents do not use or disclose PHI received from Covered Entity in any way that shall remove the PHI from such jurisdiction.

18.7. Ensure, if the work of the Contractor is deemed to meet the definition of research from the HHS Office of Human Research Protections (OHRP) as well as the Common Rule (38 CFR 16), then the Contractor as well as any Sub-Contractors or collaborating institutions shall be covered under Federal Wide Assurances (FWA) or other assurances acceptable to the VA, and the research protocol shall be reviewed and approved by the Contractor’s Institutional Review Board (IRB) of record as well as by IRBs of the collaborating institutions.

18.8. Sub-Contractors engaged in research shall also hold FWA’s or be covered by the Contractor’s FWA. If all the entities engaged in research are covered under one FWA with a common IRB of record, then it would not be necessary to involve more than one IRB.

18.9. At its discretion the VA shall submit the research protocol prior to its initiation for review to a VA ad-hoc peer-review committee. This review shall be conducted to ensure that the research incorporates or takes into consideration all VA and Veteran specific concerns and issues that shall impact on the scientific rigor of the study.

18.10. All subjects enrolled in the research shall receive protections equivalent or greater as those required by VHA policies including VHA Handbook 1200.5 including appendixes and other applicable VHA 1200 series handbooks. If vulnerable subjects shall be entered the research, appropriate safeguards shall be in place.

18.11. If the research project is eligible for a Certificate of Confidentiality, one shall be obtained from National Institute of Health (NIH) https://grants.nih.gov/policy-and-compliance .

18.12. Recruitment of Veteran’s into research projects shall follow the recruitment plan as approved by the IRB.

18.13. The plan shall require that initial contact with the Veteran be in person or by letter prior to any telephone contact.

18.14. If a letter is sent to the Veteran, it shall provide a telephone number of other means that the Veteran can use to verity the validity of the contact and the study. Social security numbers shall not be requested during a phone contact.

18.15. All investigators and research staff interacting with research subjects or working with identifiable health information shall receive training in the ethical conduct of human subject’s research that is equivalent to or exceeds the requirement for VA investigators and research staff. (See handbook VHA 1200.5(4) for the Requirements for Protections of Human Subjects in Research that is available at https://www.my.sites.va.gov/policy/results

19. Information System Security: The Contractor shall:

19.1. Ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard Contract language, conditions laws, and regulations.

19.2. Firewall and web servers shall meet or exceed the Government minimum requirements for security.

19.3. All Government data shall be protected behind an approved firewall.

19.4. Any security violations or attempted violations shall be reported to the VA project manager and the VHA Headquarters Information Security Officer as soon as possible.

19.5. Follow all applicable VA policies and procedures governing information security, especially those that pertain to certification accreditation.

20. Information System Design and Development: Information systems are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA policies developed in accordance with the Federal Information Security Management Act (FISMA), HIPAA, NIST, and related VA security and privacy control requirements for Federal Information Systems. This includes standards for the protection of electronic PHI, outlines in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 System Security Categorization (reference Appendix A of VA Handbook 6500, VA information Security Program https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1255). During the development cycle, a privacy impact assessment shall be completed, provided the COR, and approved by the VA Privacy Service in accordance with VA Privacy Impact Assessment Handbook 6500. The security controls shall be designated, developed, approved by the VA, and implemented in accordance with the provisions of the VA Security System development life cycle as outlined in NIST Special Publication 800-37 and VA Handbook 6500. The Contractor shall be required to design, develop, and operate a System of Records or individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

21. a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Impact Assessment (PIA) must be completed, provided to the COTR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the COTR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default “program files” directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework toFederal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f. The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

g. The contractor/subcontractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

(a) The Systems of Records (SOR); and (b) The design, development, or operation work that the contractor/subcontractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a SOR on individuals that is subject to the Privacy Act; and C-6

(3) Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a SOR.

h. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/subcontractor is considered to be an employee of the agency.

(1) “Operation of a System of Records” means performance of…