Attachment F - CONTRACTOR PERSONNEL SECURITY REQUIREMENTS 042721.docx

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS:

a. All Contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation. This requirement is applicable to all subcontractor personnel requiring the same access. The Department of Veterans Affairs Memorandum dated February 8th, 2007 (10N1-23) provides additional guidance and clarification specific to Contractors’ investigations. In all cases, access (physical and computer) cannot be granted until officially notified by Security Investigations Center (SIC), Little Rock, Arkansas. Access can be granted prior to receiving final adjudication results.

(1) Position Sensitivity – The position sensitivity for each Contractor position is determined by the VA utilizing Position Designation Automated Tool (PDAT). Each position will be designated at the high, moderate, or low risk level, depending on the position’s potential for adverse impact to the integrity and efficiency of the services (CFR 731.106).

NOTE: The Department of Veterans Affairs (VA) PIV Program Office implemented the rollout of the Personal Identity Verification (PIV) program across the enterprise to more than 200 VA sites in 2009. This new policy will most likely require all Contractors to be fingerprinted at a minimum, regardless of their position at the VA.

(2) Background Investigation - The level of background investigation commensurate with the required level of access may be either a Special Agreement Check (SAC), National Agency Check with Written Inquiries (NACI) (low risk), Moderate Background Investigation (MBI) (moderate risk), or Background Investigation (high risk). Non-citizen Contract personnel appointed to low risk positions will be subject to a National Agency Check with Local Agency Check and Credit Check (NACLC).

(3) Contractor Responsibilities:

(a) The Contractor shall bear the expense of the background investigation(s), regardless of the final adjudication determination. A Bill of Collections shall be generated by the VA after final adjudication determination has been received. Final adjudication results may take up to six months but are normally received within 90 days after submission. Level of investigations and associated costs (per person) for on-site paramedics have been determined to be:

___ SAC

_X_ NACI

___ NACLC

___ MBI

___ BI

(b) All fee schedule questions should be directed to the SIC at 512-257-4469 or 4490 or vhalitsiccontracting@va.gov.

(c) The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they are able to read, write, speak, and understand the English language.

(d) The Contractor, when notified of an unfavorable determination by the Government, will withdraw the employee from consideration from working under the Contract.

(e) Failure to comply with the Contractor personnel security requirements shall result in termination of the Contract for default.

(f) Upon Contract award, the Contractor shall furnish the Information Security Office and the Contracting Officer a list of personnel performing work on the Contract. The list will include a brief description of the work to be performed and degree of access to information management systems required. The description of the required degree of access will address if remote access is required. The Contractor will update and submit the list of personnel performing work on the Contract to the Information Security Office every year, throughout the Contract period. Furthermore, it is the Contractor's responsibility to notify the Information Security Office when personnel performing work under this Contract no longer require access to information management systems.

(4) Government Responsibilities:

(a) Upon receipt, the VA Office of Security and Law Enforcement will review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation.

(b) The VA facility will pay for investigations conducted by the Office of Personnel Management (OPM) in advance. In these instances, the Contractor will reimburse the VA facility within 30 days of receiving the Bill of Collections.

(c) The VA Office of Security and Law Enforcement will notify the contracting officer and Contractor after adjudicating the results of the background investigations received from OPM.

(d) The contracting officer will ensure that the Contractor provides evidence that investigations have been completed or are in the process of being requested.

b. Contractor personnel performing work under this Contract shall satisfy all requirements for appropriate security eligibility in dealing with access to sensitive information and information systems belonging to or being used on behalf of the Department of Veterans Affairs. The Contractor will be responsible for the actions of those individuals they provide to perform work for the VA under this Contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this Contract, the Contractor will be responsible for all resources necessary to remedy the incident. Printed output containing sensitive VHA data will be stored in a secured area and disposed of properly by shredding using a NIST-compliant shredder or other VA approved method. Under the provisions of the Privacy Act of 1974 as amended, personnel performing work under this Contract have an obligation to protect VA information indefinitely. Furthermore, it is the Contractor's responsibility to notify the Information Management staff when access to Information Management systems is no longer needed by personnel performing work under this Contract.

c. Contractor employees are required to complete the online training classes entitled “VA Information Security Awareness” and “VHA Privacy Policy.” The necessary link and instructions to gain access are found at https://www.ees-learning.net/librix/loginhtml.asp?v=librix. A certificate of successful completion will be generated for each course. Copies of the certificates shall be faxed to the WBVAMC Information Security Officer (ISO), and to the COR. Completion of these training courses is required on an annual basis based on the VA’s fiscal year.

d. If deemed required under this agreement, the Contractor shall be considered part of the Department of Veterans Affairs (VA) for purposes of 38 U.S.C. §§ 5701 and 7332. Its employees may have access to patient medical records to the extent necessary to perform this Contract. Notwithstanding any other provision of this agreement, the Contractor and its employees may disclose patient records and individually-identified patient information, including information and records generated by the Contractor in performance of this agreement, only pursuant to explicit disclosure authority from VA. The Contractor shall NOT remove any VA sensitive information from VA property.

e. All Contractor personnel and any subcontracted employees, if applicable, accessing the VISTA system will be required to sign and abide by all VA security policies, and applicable VA confidentiality statutes, 38 U.S.C. §5701, 38 U.S.C. §7332, and the Privacy Act, 5 U.S.C. §552a. The VA will provide access applications and security agreements. Contractor shall ensure the confidentiality of all patient information and shall be held liable in the event of the breach of confidentiality. Due to the confidential nature of medical reports, all transcription must be completed in areas that provide reasonable security. All documents are confidential and are protected under the Privacy Act of 1974, as amended. All vendor personnel shall be required to observe the requirements imposed on sensitive data by law, federal regulations, VA statutes and policy, DM&S policy, and the associated requirements to insure appropriate screening of personnel. The Contractor shall NOT remove any VA sensitive information from VA property.

f. If deemed required under this agreement, the database utilized by the Contractor, reports provided to the Contractor by VA, and documents created from analyzing this database, the event reports, and patient medical records are medical quality assurance records protected by 38 U.S.C. § 5705, its implementing regulations at 38 U.S.C. §§ 17.500-.511 and VHA Directive 20028-04377, Quality Management (QM) And Patient Safety Activities That Can Generate Confidential Documents. These records may be disclosed only as authorized by § 5705 and the VA regulations. Disclosure of these records in violation of § 5705 is a criminal offense under 38 U.S.C. § 5705(e). The Contractor shall NOT remove any VA sensitive information from VA property.

g. If deemed required under this agreement, the treatment and administrative patient records created by, or provided to, the Contractor under this agreement are covered by the VA system of records entitled "Patient Medical Records - VA (24VA136).

h. All quality data maintained by the Contractor and/or its employees shall be shared with designated Service Line Staff.

i. No VA data is permitted to be stored on portable media, including but not limited to flash drives, CDs/DVDs, external hard drives, etc.

j. No VA data is permitted to be stored on a desktop or laptop computer hard drive. Use of any portable computer under this Contract must be approved by the ISO and the computer’s hard drive must be encrypted in accordance with FIPS 140-2.

k. Non-VA equipment is not permitted to be connected to the VA network for this Contract. If unapproved equipment is detected, it will be immediately disconnected from the network.

l. Contractor personnel are not permitted to have administrative rights on a VA server for this contract. Contractor personnel must work with the local VA IT staff to perform administrative functions. A waiver will only be granted in cases in which this is not possible or not feasible. The waiver must be approved by the WBVAMC CIO and submitted to the ISO.

VA Information and Information System Security/Privacy (Inserts from VA Handbook 6500.6 – Appendix C, Paragraphs 3, 6, 7 and 9).