Attachment B - SOW.doc

Statement of Work

Pathology & Laboratory Reference Work Reference Laboratory Testing Phoenix Veterans Affairs Health Care System

650 E. Indian School Road Phoenix, AZ 85012

POC: Nicola Hobart Administrative Officer CORII and Jerri Miller-Dykshorn, Send Out Lead Pathology & Laboratory Medicine Service (P&LMS)

REFERENCE LABORATORY

STATEMENT OF WORK

The purpose of this SOW is to procure clinical and anatomic pathology diagnostic testing services from a qualified Reference Laboratory (hereafter Contractor) for the Phoenix Veterans Affairs Heath Care System (hereafter Phoenix VAHCS) on an as-needed basis, for laboratory testing protocols not performed by the in-house laboratory.

Contractor shall provide all labor, supplies, equipment, maintenance, information technology, and supervision necessary to provide reference laboratory services to the Phoenix VAHCS described herein. Reference laboratory services include but are not limited to specimen preparation and storage; transportation of clinical laboratory specimens, microbiology cultures, and stocks; performance of analytical testing; reporting of analytical test results; and consultative services.

The Contractor must be CLIA certified and confirm that they are a covered entity. No Business Associate Agreement is required.

In accordance with Appendix A, Handbook 6500.6 Checklist blocks 6 and 7, the C&A requirements do not apply to this requirement, and that a Security Accreditation Package is not required since the Contractor is a covered entity and therefore protects all sensitive patient information.

I.

Specimen Preparation and Storage for Reference Testing Specimens

A. Contractor shall supply each Government facility with its commercial laboratory reference test manual to ensure that the collection and storage of specimens are in accordance with Contractor’s requirements.

B. Contractor shall provide all materials necessary to collect and preserve specimens that are destined to the commercial reference laboratory for testing. These materials include those items that are dictated by and in compliance with the collection requirements of the commercial reference laboratory.

C. Contractor shall be responsible for storing specimens in such a manner to ensure the integrity of the specimen.

II. Transportation Services for Reference Testing Specimens A. Contractor shall provide and is responsible for transportation of primarily biomedical materials that include patient specimens and microbiology cultures and stocks, originating from Government facilities and destined to the contracted commercial reference laboratory. These items are classified as Hazard Materials Class 6, Division 6.2 and are defined in 49 CFR Part 173.134 as those materials that contain or could contain etiologic agents. Transportation shall be done in accordance with 49 CFR Part 173.199 to ensure the safety and integrity of the biomedical material is maintained.

B. Routine transportation services shall occur once per day from the Phoenix VAHCS, Main Inpatient Laboratory. Specimen pick-up times will be negotiated after contract award.

C. Contractor shall provide all necessary supplies for biomedical materials to be transported from the originating facility to the Contractor’s laboratory. These supplies shall include, but may not be limited to:

1) Shipping and packaging containers. Packing material must be capable of maintaining temperature requirements for specimens until they reach the Contractor’s laboratory.

2) Required labels and packaging materials for shipping specimens via courier that are infectious, or etiologic agents, in accordance with appropriate requirements of 42 CFR Part 72, 49 CFR Parts 171 and 173, and the Dangerous Goods Regulations of the International Air Transport Association (IATA) consistent with current regulatory updates.

3) Test request forms for specialized testing (i.e. Immunohistochemical (IHC)/

In Situ Hybridization (ISH) Stains Request).

D. Contractor or designee shall be responsible for reconciliation of transportation fees.

III. Specimen Testing

A. The Contractor and/or subcontractor shall provide the full range of clinical and anatomic pathology diagnostic testing capabilities to execute all required testing. Contractor shall make available the following test information:

1) Access to ordering portal or manual requisition forms

2) Alphabetized test name list

3) Test order code

4) Specimen collection and preservation requirements

5) Test method employed (indicate if testing performed in duplicate) and interpretations.

6) Test reference intervals adjusted for age, sex or race, when required.

7) Test specific sensitivity, specificity and interferences, when required.

8) Result code

9) Test critical values if any

10) Policy for critical value notification

11) CPT coding

12) Test turnaround times (minimum and maximum times indicated); where the turnaround time is defined as the time between pick-up of specimen by the Contractor and receipt of results by a government facility.

13) Schedule of test performance (specific days of week indicated)

14) Location of test performance by test name (i.e. name of primary laboratory, name of separate branch/division of primary lab, name and address of secondary (sub-contracted) laboratory must be cited)

Contractor shall notify the Contracting Officer and the Phoenix VAHCS Pathology and Laboratory Medicine Service of any test information modifications no later than two weeks prior to the implementation date of the test change.

Any new test(s) must be added to the contract through modification by the Contracting Officer (VA POCs and Government facility representatives do not have this authority) prior to specimen being tested.

B. All reference laboratory testing shall be executed in accordance with standard industry practices. It is preferred that test methods are FDA approved. Any non-FDA approved method being performed shall have a disclaimer and documented validation plan. Upon request, the validation plan and validation results shall be made available to the VA POC or designee.

C. The Contractor shall ensure the accurate and timely performance of laboratory testing services on the biomedical materials.

IV. Specimen Retention

A. Clinical specimens, such as serum, whole blood and raw bone marrow, will be retained by the Reference Lab for a period that they deem necessary.

B. All anatomic pathology materials (e.g., histology blocks, slides or other diagnostic material) generated by the VA shall be returned within 7 days after final diagnosis is reported.

V. Reporting of Results

A. The results of testing shall be reported within the prescribed turnaround times provided by the Contractor as part of the test information.

B. A report of laboratory testing results must be issued either as a printed final copy or through electronic delivery by contractor secure date management system (website). However, in unusual circumstances where electronic delivery by contractor secure website is not possible, the Contractor shall deliver the reports without an additional charge by expedited overnight courier shipping, mailing and/or transportation services by hand within 24 hours, or by telephone facsimile to a protected machine identified to the Contractor by the VA. Delivery by electronic mail i.e., MS Outlook, etc. is prohibited.

C. Each test report shall, at minimum, include the following information:

1) Patient's full name

2) Patient’s identification number, e.g., social security number (SSN)

3) Physician’s name (if supplied)

4) Government laboratory accession number (if supplied)

5) Submitting facility name

6) Submitting facility account number

7) Patient's location (clinic/ward) (if supplied)

8) Test(s) ordered.

9) Date/time of specimen collection (when available)

10) Date/time test completed.

11) Test result

12) Reference intervals (adjusted for age, sex or race, when appropriate)

13) Toxic and therapeutic ranges, if applicable

14) Flagged abnormal results.

15) Reference laboratory accession number

16) Name and address of testing laboratory

17) Any other information the laboratory has that may indicate a questionable validity of test results.

18) Specimen inadequacy shall be reported with documentation supporting its unsuitability for testing.

D. Test results determined by the contractor to be critical, shall be communicated by telephone to a designated Government contact person(s) at the originating Government laboratory facility upon verification of the critical test result. The telephonic report shall be followed by an electronic transmission.

VI. Customer Service

A. Contractor shall provide customer service that is accessible by telephone service from 8:00am to 5:00pm local time or during normal business hours to assist Government staff for tracking and resolving related issues/problems that may arise in the performance under this contract.

B. Upon award, the Contractor shall provide the name(s) and telephone number(s) of contractor employees who will address the following customer services throughout the contract performance period:

1.

Telephone Inquiries – Telephone inquiries are divided into four major categories with additional subcategories defining the type of inquiry and the Government’s minimum time expectation for meeting this service.

a. Specimen Collection

1. Routine inquiries, questions and clarifications regarding collection requirements shall be addressed at the time of the initial call.

2. Esoteric inquiries, questions and clarifications regarding collection requirements that require further research shall be addressed within ½ hour of the initial call.

b. Testing

1. Inquiries regarding the status of pending orders shall be addressed at the time of the initial call.

2. Esoteric inquiries when information is requested regarding methodology, correlation, interferences, reflex tests, etc. shall be addressed within two hours of the initial call.

c.

Technical Expertise

1. Test utilization inquiries where information is required as to the most appropriate test to be ordered shall be addressed within two business hours of initial call.

2. Result interpretation inquiries shall be addressed within four business hours of initial call.

3. Consultative services where information is required regarding the clinical significance of tests shall be addressed within twenty-four business hours of the initial call.

d. Account follow-up

1. Information general in nature yet specific to the account, e.g. test pricing, equipment repair, supply ordering, etc. shall be addressed within four hours of the initial call.

C. The Contractor shall notify the originating laboratory by telephone of specimens cancelled due to unacceptability for reasons relating to volume, specimen container, identification, loss of specimen, lack of electronic order etc.

VII. Consultative Services/Utilization Reports A. Contractor shall prove consultative services that are consistent with the services offered to other contracted customers without compensation. These services may include consultations by laboratory professionals or experienced physicians on test or methodology selection or test result interpretation.

B. Contractor shall provide a statistical analysis of the Government facilities’ workload testing volumes to assist in the monitoring of ordering trends and utilization patterns \ as requested by the VA.

C. Contractor shall provide a cumulative workload summary report of tests performed. The summary must include the test name/description, monthly test volume, year-to-date test volume, unit test cost, monthly test expenditures and year-to date test expenditures.

1. A copy of the report shall be delivered electronically to the Contracting Officer, Lead VA POC, and each Government facility POC as requested.

2. All reports shall be submitted in electronic spreadsheet format and have the capability to sort by three (3) different methods:

a. Test names listed alphabetically.

b. Test names listed in order of year-to-date test frequency (highest to lowest)

c. Test names listed in order of year-to-date total test cost (highest to lowest) VIII. Data Management System A.

Contractor shall provide to the Phoenix VAHCS all necessary laboratory test parameters (parameters are required for each test contained in a panel) to insure accurate test result transmission between the Phoenix VAHCS and the Contractor’s database. Required test parameters include:

1) Ordering code

2) LOINC code

3) CPT code

4) Interface code

5) Test cost

6) Reference ranges

7) Units of measurement

8) Test result interpretation or interpretive remarks, if appropriate

9) Testing site (if not performed at the vendor’s main laboratory facility

10) Test methodology

11) Specimen types

12) Specimen collection and handling requirements

13) Indication whether test is a panel/profile test, list of tests included.

The parameters for all tests in the Contractor’s database shall be kept current and be available to the Phoenix VAHCS throughout the performance period of the contract. Updates to the test parameter information must be provided to the Phoenix VAHCS no less than 2 weeks prior to the implementation of any changes. The Contractor shall provide telephone access to a Contractor’s technical representative to respond to any question(s) regarding the laboratory test parameter information.

B. The Contractor shall provide a data management system that meets the following requirements:

1) Test definition, test information and test requirements must be complete, available and easily accessible.

2) Shipping manifest must be generated that identifies the specimens sent to the commercial reference laboratory, transportation conditions, and testing ordered.

3) The status and the results of testing must be available within published timeframes and easily retrievable by the use of varying options. At a minimum the options must include: Sort by patient name; sort by date; sort by test; sort by incomplete test. Incomplete tests must have an indication of the pending time until completion. Alert messages, or other notification, must be generated when testing is delayed beyond published timeframes.

4) Reports of test results must be immediately available upon verification of the test result. Contractor’s computer located at the Phoenix VAHCS must be able to print test results upon request and reprint retrospective test results.

Special Contract Requirements I. Services

A. The services specified herein may be changed by written modification to this contract. The VA Contracting Officer will prepare the modification (reference FAR clause 52.212-4(c), Changes) and, prior to becoming effective, shall be signed by both parties. Only the Contracting Officer is authorized to make commitments or issue changes that affect price, quantity, or quality of performance of this contract. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change shall be considered unauthorized, and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof.

B. This is a non-personal services contract as defined in FAR 37.101. There is no employer-employee relationship between the Phoenix VAHCS and the contractor or the contractor’s employee(s). Contractor personnel are not subject to the supervision and control of a Phoenix VAHCS officer or employee. Rather, contractor personnel perform their duties in accordance with the Performance Work Statement. Supervisory functions such as hiring, firing, directing, and counseling of contractor personnel are not performed by the Phoenix VAHCS. The healthcare provider who furnishes services under this contract is subject to Phoenix VAHCS technical oversight of the services. The Phoenix VAHCS retains the right to reject services for contractual non-performance.

C. The Phoenix VAHCS may evaluate the quality of professional and administrative services provided, but retains no control over the medical, professional aspects of services rendered.

D. Contractor is required to maintain medical liability insurance for the duration of this contract. Medical Liability insurance must cover the provider(s) for services in all states where services are rendered by the provider. Contractor must indemnify the Phoenix VAHCS for any liability producing negligent act or omission by the contractor, its employees and agents occurring during contract performance.

E. Contractor shall, in writing, keep the Contracting Officer informed of any unusual circumstances in conjunction with the contract.

II.

Term of Contract

The period of performance for this contract is:1 Year Base + 4 (1) optional years.

III. Federal Holidays Contractor is not required to provide transportation of specimens on federal holidays, except in STAT situations. The 11 holidays observed by the Federal Government are: New Year’s Day (January 1st), Martin Luther King’s Birthday (3rd Monday in January), Presidents’ Day (3rd Monday in February), Memorial Day (last Monday in May), Juneteenth (June 19th), Independence Day (July 4th), Labor Day (1st Monday in September), Columbus Day (2nd Monday in October), Veterans Day (November 11), Thanksgiving Day (4th Thursday in November), Christmas Day (December 25th) and any other day specifically declared by the President of the United States to be a national holiday.

When one of the above designated legal holidays falls on a Sunday, the following Monday will be observed as a legal holiday. When a legal holiday falls on a Saturday, the preceding Friday is observed as a holiday by U.S. Government agencies.

IV.

Qualifications/Requirements of Laboratory & Contractor Personnel

A.

Laboratory

1. The Contractor must continuously hold a Certificate of Compliance or Certificate of Accreditation from the Centers for Medicare & Medicaid Services as meeting the requirements of the Clinical Laboratory Improvement Amendments of 1988 or must demonstrate accreditation by a regulatory agency(s) with deemed status from the Centers for Medicare & Medicaid Services, e.g. The College of American Pathologists, and/or other state regulatory agencies, as appropriate, and as mandated by federal and state statutes. The Contractor must maintain valid certifications during the entire performance period of this contract.

2. Copies of all relevant permits/licenses and certifications inclusive of any sanctions current or pending throughout the United States of America must be supplied in response to this solicitation. In addition, as these documents are reissued or re-awarded, the awarded Contractor must supply a copy to the VA Point of Contact (POC) assigned to each Government facility.

3. Contractor must notify immediately the VA Point of Contact (POC)at each of the Government facilities in writing, upon its loss of any required certification, accreditation, or licensure.

4. Contractor shall maintain safety and health standards consistent with the requirements set forth by the Occupational, Health, and Safety Administration (OSHA), and the Center for Disease Control (CDC) and Prevention.

B.

Personnel

1. Contractor shall ensure all testing and supervisory personnel at the reference laboratory assigned to work under this contract meet and maintain the applicable personnel qualifications set forth under the Clinical Laboratory Improvement Amendments (CLIA) of 1988 regulations, the College of American Pathology (CAP) accreditation standards, or other accrediting organizations and State standards.

2. Contractor shall ensure its employees can perform the applicable duties consistent with their license and certification.

3. Any new requirements for mandatory education and/or competency reassessment, which occur during the contract period, must be completed by the individual contractor employee(s).

4. Contractor couriers entering any Government facility shall prominently display a contractor-issued identification badge.

V.

HIPAA Compliance

Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). As required by HIPAA, the Department of Health, and Human Services (HHS) has promulgated rules governing the security and use and disclosure of protected health information by covered entities, including the Department of Veterans Affairs (VA). The Contractor shall prove to the Phoenix VAHCS that they are identified as healthcare providers and that the PHI is being disclosed and/or used for treatment. Therefore, no BAA is required for Contractor Services.

VI.

Designation of Contract Representatives

The Lead POC will be designated after contract award and represents the Contracting Officer in furnishing guidance and advice regarding the work being performed under this contract. The foregoing is not to be construed as authorization to interpret or furnish advice and information to the Contractor relative to the financial or legal aspects of the contract. Enforcement of these segments is vested in and is the responsibility of the Contracting Officer. The extent and limitations of the POC designation will be provided in the POC Delegation Memo.

VII. Contract Performance Monitoring

A.

Monitoring of contractor’s performance shall be demonstrated through clinical and administrative record reviews. POC will be responsible for verifying contract compliance. POC will designate appropriate VA personnel to monitor services through one or a combination of the following mechanisms:

1. Departments being served will monitor Contractor performance to ensure that services called for in the contract have been received by VA in a timely manner. Any incidents of Contractor noncompliance as evidenced by the monitoring procedures will be forwarded immediately to the Contracting Officer.

2. Documentation of services performed will be reviewed prior to certifying payment. The POC will perform periodic spot checks and document with the using service to ensure records monitoring. VA will pay only for services provided. Contract monitoring and recordkeeping procedures will be sufficient to ensure proper payment and allow audit verification that services were provided.

3. Departments being served, through the POC(s), will provide a written statement annually to the Contracting Officer to include a summary of Contractor actions and a statement that all requirements of the contract have been fulfilled as agreed. This summary evaluation will be submitted 45 days prior to expiration of contract (and/or prior to election of option year renewals, if applicable).

VIII. Quality Assurance Monitoring A. Contractor shall maintain a Quality Assurance Program related to Reference Laboratory services covered under this contract.

B. The VA will perform a quality assurance surveillance program (QASP) with the contractor. This program will minimally address the quality aspects representative to the testing process, i.e. pre-analytical, analytical and post-analytical variables and include a description of monitoring and evaluation activities. There must be a mutually agreed upon procedure for responding to issues, problems and/or concerns identified by the Government with details as to whom and in what timeframe the matters will be reconciled. The issues that may need to be addressed may be general in nature or specific to an incident or event. The contractor will meet or communicate with the Phoenix VAHCS staff for process review and improvement of contract performance on an as needed basis.

C. Copies of licensure/certifications are also required to be submitted upon request by the VA.

D. If the contractor believes there are excusable circumstances, the contractor shall inform the Contracting Officer and the Lead VA POC E. These monitoring procedures and disincentives for contractor’s failure in meeting these tasks are further illustrated in the following Performance Requirements Summary Matrix:

Performance Objective

Task

Method

The results of testing shall be reported within the prescribed turnaround times provided by the Contractor as part of the test information.

Follow-up call if voicemail/message left by VA employee and/or POC.

Contractor shall provide a cumulative workload summary report of tests performed. The summary shall include the test name/description, monthly test volume, year-to-date test volume, unit test cost, monthly test expenditures, year-to date test expenditures and test turnaround times.

The Contractor shall continuously hold a Certificate of Compliance or Certificate of Accreditation from the Centers for Medicare & Medicaid Services as meeting the requirements of the Clinical Laboratory Improvement Amendments of 1988 or shall demonstrate accreditation by a regulatory agency(s) with deemed status from the Centers for Medicare & Medicaid Services, e.g. The College of American Pathologists, and/or other state regulatory agencies, as appropriate, and as mandated by federal and state statutes. The Contractor shall maintain valid certifications during the entire performance period of this contract.

Certificate of Compliance or Certificate of Accreditation from the Centers for Medicare & Medicaid Services

OR

Accreditation by a regulatory agency(s) with deemed status from the Centers for Medicare & Medicaid Services, e.g. The College of American Pathologists, and/or other state regulatory agencies, as appropriate, and as mandated by federal and state statutes Certificate of Compliance or Certificate of Accreditation from the Centers for Medicare & Medicaid Services 100% of the time.

OR

Accreditation by a regulatory agency(s) with deemed status from the Centers for Medicare & Medicaid Services, e.g. The College of American Pathologists, and/or other state regulatory agencies, as appropriate, and as mandated by federal and state statutes 100% of the time.

Certificate of Compliance or Certificate of Accreditation from the Centers for Medicare & Medicaid Services 100% of the time.

OR

Accreditation by a regulatory agency(s) with deemed status from the Centers for Medicare & Medicaid Services, e.g. The College of American Pathologists, and/or other state regulatory agencies, as appropriate, and as mandated by federal and state statutes 100% of the time.

Direct Observation

IX. Required Registration with Contractor Performance Assessment System (CPARS) A. As prescribed in Federal Acquisition Regulation (FAR) Part 42.15, the Department of Veterans Affairs (VA) evaluates contractor past performance on all contracts that exceed the thresholds outlined in FAR Part 42.15 and shares those evaluations with other Federal Government contract specialists and procurement officials through the Past Performance Information Retrieval System (PPIRS). The FAR requires that the contractor be provided an opportunity to comment on past performance evaluations prior to the posting of each report. To fulfill this requirement VA uses an online database, the Contractor Performance Assessment Reporting System (CPARS). The CPARS database information is uploaded to the Past Performance Information Retrieval System (PPIRS) database, which is available to all Federal agencies.

B. Each contractor whose contract award is estimated to exceed the thresholds outlined in FAR Part 42.15 is required to provide to the contracting officer contact information for the contractor’s representative with their response to the solicitation. The contractor is responsible to notify the contracting officer of any change to the contractor’s representative during the contract performance period. Contractor’s representative contact information consists of a name and email address.

C. The Government will register the contract within thirty days after contract award. For contracts with a period of one year or less, the contracting officer will perform a single evaluation when the contract is complete. For contracts exceeding one year, the contracting officer will evaluate the contractor’s performance annually. Intermediate reports will be filed each year until the last year of the contract, when the final report will be completed. Each report shall be forwarded in CPARS to the contractor’s designated representative for comment. The contractor’s representative will have thirty days to submit any comments and return the report to the VA contracting officer. Failure by the contractor to respond within those thirty days will result in the Government’s evaluation being placed on file in PPIRS without contractor’s comments.

CONTRACT SECURITY REQUIREMENTS

I. General

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

II. Contractor Personnel Security Requirements

Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

Contractor shall certify that all its employees and subcontractor employees having access to VA sensitive information (ie. laboratory technicians, administrative personnel) during the performance of this contract have successfully passed a contractor employee background check.

III. Security and Privacy Training Due to the increased emphasis on privacy and information security, the following special contract requirements are established and hereby made part of the contract entered into with the Department of Veterans Affairs. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted to VA information and its systems:

a. Privacy & Information Security Training: Contractor and their sub-contractors assigned work under the contract are required to receive annual training on patient privacy as established by HIPAA statues. Training must meet VHA’s and/or the Department of Health and Human Services Standards for Privacy of Individually identifiable health information. Privacy and HIPPA training required to be equivalent to VA Privacy and Information Security Awareness and Rules of Behavior (TMS 10176), and VA Privacy and HIPP Training (TMS 102023), which COTR must monitor and report to least yearly. Contractor shall provide certification to the VA upon request that all employees and sub-contractor employees assigned work and/or having access to Protected Health Information have received annual training.

As VA routinely reviews and updates policies and procedures covering contractor computer access, security requirements may change during the term of this contract and new policies and procedures may be implemented unilaterally during the term of this contract.

IV. Access to VA Information and VA Information Systems

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

V. Computer Security

a. In performing this agreement, contractor shall be considered a part of VA for purposes of 5 U.S.C. §552a, 38 U.S.C. §§5701 and 7332. Contractor's employees and agents may have access to patient medical records and general files to the extent necessary to perform this contract. Notwithstanding any other provision of this agreement, contractor and/or its employees may not disclose information contained in general files and patient records and or other individually identified patient information, including information and records generated by the contractor in performance of this contract, except pursuant to explicit instructions from the VA. For the purposes of this paragraph, instruction to disclose may be provided by these officials only: Contracting Officer, Contracting Officer Technical Advisor, the Release of Information supervisor, or VA attorneys.

b. Records created by contractor while performing this agreement are the property of the VA and shall not be accessed, released, transferred, or destroyed except in accordance with applicable federal law, regulations, and policy. Access to data will be limited to the minimum necessary for performance of the contract. Contractor will take steps to ensure that access is limited to those employees who need access to the data to perform the contract. Contractor will not copy information contained in the system, either by printing to paper or by copying to another digital format, without the express permission of one of the officials listed in paragraph (b), above, except as is necessary to make single copies in the ordinary course of providing patient care. Contractor will not commingle the data from the system with information from other sources. Contractor shall report any unauthorized disclosure of VA information to the officials listed in paragraph (b).

c. If this agreement is terminated for any reason, contractor will provide the VA with all individually identified VA patient treatment records or other information in its possession, as well as any copies made pursuant to paragraph (c), above within seven (7) days of the termination of the agreement.

d. Certain information available from the database and other records created by the contractor under this Contract are medical quality assurance records protected by 38 U.S.C. §5705; it’s implementing regulations at 38 U.S.C. §§17.500-511; and VHA Directive 98-016,4. b.(1)(d), 4.6(2)(c) and 4.6(4). These records may be disclosed only as authorized by 38 U.S.C. §5705 and the VA regulations. Disclosure of these records in violation of §5705 is a criminal offense under 38 U.S.C. §5705(e).

e. Contractor shall follow all VA policies regarding the retention of records. In the alternative, contractor may deliver the records to VA for retention.

f. Any changes in the law or regulations governing the information covered by this contract during the term of this contract shall be deemed to be incorporated into this contract. Contractor shall educate its employees and subcontractors, if any, of the requirements of this section and shall advise its employees and subcontractors, if any, of any changes as they occur. On contractor's request, VA will provide trainers who can educate contractor's employees and subcontractors, if any, of their obligations under this section.

g. Contractor shall make its internal policies and practices regarding the safeguarding of medical and/or electronic information available to federal agencies with enforcement authority over the maintenance of those records upon request.

VI. VA Information Custodial Language

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor while performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

h. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

i. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

j. Not with-standing the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

k. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the CO and Lead POC.

VII. Information System Hosting, Operation, Maintenance or Use

a. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent to those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the POC and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA’s network involving VA information must be reviewed and approved by VA prior to implementation.

b. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

c. Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the contractor’s systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA OCS Certification Program Office. Government-owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

d. The contractor/subcontractor’s system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the ISO for entry into VA’s POA&M management process. The contractor/subcontractor must use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with contractor/subcontractor activities must also be subject to such assessments. If major changes to the system occur that may affect the privacy or security of the data or the system, the C&A of the system may need to be reviewed, retested and re-authorized per VA Handbook 6500.3. This may require reviewing and updating all of the documentation (PIA, System Security Plan, Contingency Plan). The Certification Program Office can provide guidance on whether a new C&A would be necessary.

e. The contractor/subcontractor must conduct an annual self-assessment on all systems and outsourced services as required. Both hard copy and electronic copies of the assessment must be provided to the CO and the Lead POC. The government reserves the right to conduct such an assessment using government personnel or another contractor/subcontractor. The contractor/subcontractor must take appropriate and timely action (this can be specified in the contract) to correct or mitigate any weaknesses discovered during such testing, generally at no additional cost.

f. VA prohibits the installation and use of personally owned or contractor/subcontractor-owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW, or contract. All the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA-approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned OE.

VIII. Security Incident Investigation

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the VA POC and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident.