Cancer Registry Services RFI.docx

National VA Cancer Registry Services Request for Information

Department of Veterans Affairs (VA) Office of Health Informatics (OHI) National Oncology Program Office (NOPO) VA Cancer Registry System (VACRS)

Request for Information

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY (as defined in FAR 15.201(e)), this is not a solicitation, a solicitation is not available at this time. Requests for a solicitation will not receive a response. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received, provide feedback to respondents with respect to any information submitted, or respond to any questions or comments that may be submitted in response to this RFI. This notice does not constitute a commitment by the United States Government and does not obligate the Government to award a contract or otherwise pay for the information provided in response. Responders are solely responsible for all expenses associated with responding to this RFI.

The purpose of this RFI is to conduct market research to obtain information on potential market capability to support cancer registry capability to support Veterans Affairs operations at various Veterans Integrated Service Networks (VISNs).

The solicitation, if published, is expected to be a multi-award, indefinite quantity, indefinite delivery acquisition.

The details of this requirement can be found in Attachment A: Draft Performance Work Statement (PWS). Responses to this request for information may influence the chosen acquisition strategy (including Veteran-owned, Service-disabled Veteran-owned, and other small business participation, and vehicles and methods to acquire the services).

1. VA is requesting input from all vendors, with all socioeconomic statuses; however, Service-Disabled Veteran-Owned Small Business (SDVOSB) and Veteran-Owned Small Business (VOSB) are encouraged to respond. VA is requesting vendor capability to deliver all required support, along with experience/past work providing cancer registry services. The Government requests that vendors respond using the INSTRUCTIONS provided in this Request for Information. Responses should “demonstrate” capability, not just “confirm” the company’s belief that the capability exists or could exist.

2. The VA does not intend to award a contract as a result of this RFI, but rather gather capabilities and market information pertinent for acquisition planning. The responses to this RFI will be captured as market research and may contribute to the development of an acquisition strategy. All submissions become Government property and will not be returned. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate.

The information provided in the RFI is subject to change and is not binding on the Government.

INSTRUCTIONS FOR RESPONDING TO THIS RFI

CONFIDENTIALITY: No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).

Response Format/Page Limitations:

The overall total page limit for responses to this RFI is five (5) pages, do not restate the PWS content. Responses should be submitted in Microsoft Word format with a 12 pt. or greater font size. Interested parties should limit marketing material in order to allow sufficient space for adequately, directly, and substantively responding with the information of most interest to the Government. Responses may also optionally include the provision of resumes of qualified personnel that demonstrate expertise in the domains, and resumes will not count towards the page limit.

In all correspondence relevant to this RFI please identify it as a response to the “National VA Cancer Registry Services” (on response and in Subject Line of email).

Any organization responding to this notice should ensure that its response is complete and sufficiently detailed. Respondents are requested to limit responses to the information, and in the format provided below.

A - GENERAL INFORMATION

A1. Organization Name.

A2. Company ownership (public, private, joint venture).

A3. What is your business size designation in accordance with Small Business Administration (SBA) standards for the recommended NAICS code (621999, All Other Miscellaneous Ambulatory Health Care Services)?

B – CAPABILITY AND EXPERIENCE INFORMATION

Interested firms are requested to provide Capability Statements addressing the following data/information, by the closing date.

a. Company name:

b. Company address:

c. Company Point-of-Contact (POC)

d. Company phone, fax, and email address:

e. Company Tax ID Number (TIN):

f. Company CAGE Code and SAM Unique Entity ID:

g. Type/Size of Business relative to NAICS Code 621999. If you suggest a more accurate NAICS, as it relates to the services noted herein, please provide it as well.

h. Federal Supply Schedule Number (if applicable), meaning your FSS pertains to Human Factors Engineering and Clinical Informatics.

i. Statement of Capability that demonstrates your business’s capability and past performance in providing the type of service(s) requirement; to include data and information stated herein.

In addition to providing your company’s capability statement as it pertains to the requirements of this RFI, interested and capable firms are also required to provide answers to the following questions.

1. How many years of experience has your company had performing cancer registry services?

2. Can you provide case studies or references from similar projects?

3. What is your typical implementation timeline for a project of this scale and complexity?

4. How successful have you been in the recruitment and retention of credentialed oncology data specialists?

5. Do you have a service-level pricing model?

· Casefinding/Case Ascertainment Per Patient,

· Data Curation/Abstraction Per Diagnosis

· Disease Surveillance/Follow-up Per Diagnosis

· Rapid Cancer Reporting System Submissions Monthly Batch

· Minimum Data Set (Backlog cases) Per Diagnosis

· Consultative Services Hourly

· Program Report Update Quarterly

6. How do you ensure employee knowledge and competence?

7. What Key Personnel do you suggest for the vendor to meet the Government’s requirements, with expertise working in Computerized Patient Record System (CPRS), Veterans Health Information Systems Technology Architecture (VistA), and Oracle Health EMR?

8. What unique benefits do you offer to healthcare organizations like the VHA?

The purpose of this RFI is for Market Research and to gather input for use in further defining the requirement only, and to identify interested and potentially capable vendors.

Submission: Responses to this RFI shall be submitted to SAC-F via email to Caitlin.Ruc@va.gov and Tereshia.Burford@va.gov no later than at 10:00AM ET on May 29, 2025.

Questions: No Questions are being accepted at this time. Depending upon the responses received, VA may request additional information, may conduct future question and answer sessions, or may conduct meetings or an industry day.

52.215-3 Request for Information or Solicitation for Planning Purposes (Oct 1997)

(a) The Government does not intend to award a contract on the basis of this solicitation or to otherwise pay for the information solicited except as an allowable cost under other contracts as provided in subsection 31.205-18, Bid and proposal costs, of the Federal Acquisition Regulation.

(b) Although “proposal” and “offeror” are used in this Request for Information, your response will be treated as information only. It shall not be used as a proposal.

(c) This Request is issued for the purpose of: Information.

(End of provision)

Please see Attachment A, Draft National Cancer Registry Services PWS below.

image1.emf

Attachment A - Draft National Cancer Registry Services PWS.docx

National VA Cancer Registry Services

Pre-Decisional

PERFORMANCE WORK STATEMENT (PWS)

VETERANS HEALTH ADMINISTRATION

Health Services - Clinical Services Product Line

National VA Cancer Registry Services

Date: May 2025

PWS Version Number: 2.0

This Document is Pre-Decisional

Contents

1.0 INTRODUCTION 5

1.1 BACKGROUND 5

1.1 SCOPE 6

1.2 AUTHORIZED ORDERING AND ADMINISTRATION 7

1.3 APPLICABLE DOCUMENTS 8

2.0 GENERAL REQUIREMENTS 9

2.1 TYPE OF TASK ORDERS/PERFORMANCE PERIOD 9

2.2 NON-PERSONAL SERVICES 10

2.3 HOURS OF CONTRACTOR OPERATIONS 10

2.4 PLACE OF PERFORMANCE 10

2.5 CONTRACTOR REMOTE REQUIREMENTS 10

2.6 TRAVEL 10

2.7 GOVERNMENT FURNISHED EQUIPMENT (GFE) 11

2.8 MANAGEMENT 11

3.0 GENERAL PERSONNEL REQUIREMENTS 11

3.1 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS 12

3.2 CONTRACTOR RESPONSIBILITIES 13

3.3 CONFIDENTIALITY AND NON-DISCLOSURE 15

4.0 APPLICABLE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE (per VA HANDBOOK 6500.6, APPENDIX C, April 22, 2024) 16

4.1 GENERAL 16

4.2 VA INFORMATION CUSTODIAL LANGUAGE 16

4.3 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS 19

4.4 TRAINING 21

4.5 SECURITY INCIDENT INVESTIGATION 22

4.6 LIQUIDATED DAMAGES FOR DATA BREACH 23

4.7 ANNUAL OFFICE OF INSPECTOR GENERAL (OIG) STATEMENT 24

4.8 NON EMPLOYEE STATUS 25

4.9 TORT LIABILITY 25

4.10 INDEMNIFICATION 25

4.11 INHERENTLY GOVERNMENTAL FUNCTIONS 26

4.12 PROFESSIONAL DIRECTION 26

4.13 CONFLICT OF INTEREST & ETHICS 26

4.14 EMPLOYEE CREDENTIALING AND EDUCATION 27

4.15 SECURITY AND PRIVACY REQUIREMENTS 27

4.16 MEDICAL RECORDS 27

4.17 AUTHORITIES 27

4.18 HIPPA 27

4.19 DISCLOSURE 28

4.20 RELEASE OF INFORMATION 28

4.21 MANAGEMENT OF MEDICAL RECORDS 29

4.22 CONTINGENCY PLAN 29

4.23 BUSINESS RELATIONS 29

5.0 TASK AND DELIVERABLES 29

5.1 CONTRACT ADMINISTRATION AND MANAGEMENT 29

5.2 SUBCONTRACT MANAGEMENT 30

5.3 REPORTING AND MEETING REQUIREMENTS 30

5.4 MEETING AND REVIEWS 31

5.5 CONTRACTOR PROJECT MANAGEMENT PLAN 31

5.6 MONTHLY NOPO PROGRESS REPORT 32

5.7 KEY PERSONNEL 34

5.8 Project Manager 34

5.9 Oncology Data Project Manager 35

5.10 Project Coordination 35

5.11 TASK ORDER SERVICES 35

5.12 PROGRESS REPORT 35

5.13 KEY TASK ORDER PERSONNEL 36

5.14 MANAGEMENT OF TASK ORDERS 36

5.15 Task Order Project Lead 36

5.16 CANCER REGISTRY SERVICES 36

5.17 Cancer Registry Personnel 37

5.18 Qualifications 38

5.19 Experience 38

5.20 Cancer Registry Data Management 38

5.21 Standards of Practice 39

5.22 Casefinding/Case Ascertainment 39

5.23 Data Curation/Abstraction 40

5.24 National Cancer Database (NCDB) 40

5.25 Disease Surveillance (Annual Follow-up) 41

5.26 Consultative Services (As Requested) 42

5.26.1 Commission on Cancer Activities (CoC Accredited Programs Only) 42

5.26.2 Cancer Committee/Cancer Program Quality Improvement Activities 42

5.26.3 Cancer Registry Data Reports/Requests/Studies 43

5.26.4 American College of Surgeons Commission on Cancer Survey Preparation (CoC Mock Survey) 43

5.27 TASK ORDER PERFORMANCE STANDARDS 44

6.0 RESPONSIBILITIES 45

6.1 CONTRACTOR RESPONSIBILITIES 45

6.2 GOVERNMENT RESPONSIBILITIES 45

6.3 CONTRACT ADMINISTRATION/PERFORMANCE MONITORING 45

6.4 CONTRACTING OFFICER RESPONSIBILITIES 45

6.5 NOPO CONTRACTING OFFICER'S REPRESENTATIVE RESPONSIBILITIES 46

6.6 VISN/VAMC COR RESPONSIBILITIES 47

APPENDIX A: QUALITY ASSURANCE SURVEILLANCE PLAN (QASP) 48

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP) 48

METHOD OF A QA SURVEILLANCE 48

A. Verification and/or Documentation Provided by VISN/VAMC COR 48

B. Verification and/or Documentation Provided by Contractor 49

QASP PERFORMANCE REQUIREMENT STANDARDS 50

1. Casefinding/Case Ascertainment 50

2. Timely Cancer Incidence Reporting 51

3. Qualifications and Availability of Key Personnel 52

4. Rapid Cancer Reporting System 53

5. Privacy, Confidentiality and HIPPA 54

6. Disease Surveillance 54

7. Data Quality Review 55

APPENDIX B: VA NATIONAL ONCOLOGY PROGRAM REPORTING QUALITY AUDIT (QA) CHECKLIST 56

APPENDIX C: INVOICE SAMPLE 57

APPENDIX D: TENTATIVE ROLLOUT SCHEDULE 59

INTRODUCTION

The purpose of this acquisition is to support VA Cancer Registry System (VACRS) operations at various Veterans Integrated Service Networks (VISNs) under the U.S. Department of Veterans Affairs (VA), Veterans Health Administration (VHA), National Oncology Program Office (NOPO). The VACRS is responsible for maintaining compliance at all VAMCs in accordance with the National Oncology Program Office, Centers for Disease Control, National Cancer Institute – Surveillance, Epidemiology and End Results (SEER), North American Association of Central Cancer Registries (NAACCR), and Commission on Cancer (CoC). The national standard setters developed requirements for cancer registry for completeness, timeliness, and quality, and under state-specific laws, ensure cancer case reporting is continuous, accurate, and timely. This acquisition will support cancer registry operations at all levels of the Veterans Health Administration (VHA).

The resulting acquisition vehicle will be a multiple award Indefinite Quantity Indefinite Delivery (IDIQ) task order award contract.

It is anticipated that the work will require tasks classified in the following Functional Categories and Capability Areas:

This Performance Work Statement (PWS) establishes the requirements for Contractor provided solutions in support of an enterprise-wide Veterans Health Administration (VA) cancer registry system. This acquisition includes comprehensive support services, any of which can be integrated into a single Task Order (TO) to reduce the risk to the government and ensure complete solutions to complex programs.

0. BACKGROUND

The VHA is America’s most extensive integrated healthcare system, with over 480,000 employees providing care in 1,391 facilities (including 138 medical centers and 1,219 outpatient sites of care of varying complexity), serving 9 million enrolled Veterans each year.

The Veterans Affairs Cancer Registry System is part of this integrated healthcare system and has operated since 2000. The VACRS consists of individual population-based VAMCs reporting to a centralized database for complete population-based cancer registry information on Veteran cancer incidence and outcomes. The VACRS receives and stores information on patient demographics, cancer diagnosis and treatment sent by the local cancer registry staff at 136 Veteran Affairs Medical Centers (VAMCs) that diagnose, treat, and/or manage surveillance for cancer in the enrollment population. The VACRS collects, consolidates, and maintains detailed diagnosis and treatment information for each patient diagnosed with cancer. The VAMC cancer registry staff identifies patients with a diagnosis of cancer, curates a standardized set of data for each diagnosed cancer from all available medical records, performs data quality checks, and updates each diagnosis annually to monitor disease surveillance and vital status. Data from each VAMC population-based cancer registry is transmitted to the Veteran Affairs Central Cancer Registry (VACCR) data management system, which merges the data and performs additional data quality checks.

Data from the VACRS is utilized for clinical care, operations management, and research. Oncology patient data is also shared with state and national central cancer registries to provide more comprehensive data for healthcare providers, public health officials, and researchers. This data exchange assists in measuring cancer occurrence and trends at local and national levels. It also informs and prioritizes cancer educational and screening programs, evaluates the effectiveness of prevention efforts and treatment, determines survival rates, research cancer causes, diagnoses, and treatments, ensures quality and equity in cancer care, and plans for health services.

The capture of cancer data from VA facilities in state cancer registries assists veterans by improving the ability to identify cancer-related disparities in the veteran community and offer strategies for allocating public health funding. This also improves understanding of the cancer-related needs of veterans, which can be incorporated into State Comprehensive Cancer Control planning for screening and treatment programs funded by the Centers for Disease Control and Prevention. Furthermore, this increases opportunities for veterans with cancer to be included in more clinical trials and cancer-related research and analysis being done outside of the VA’s Healthcare System.

The VACRS faces growth in health care demand due to changes in demographics, the care backlog from the COVID-19 pandemic, trends in shifting sites and modalities of care, greater reliance on VHA health care with increased emphasis on access to care, new enrollees, and other factors. The scope of work for this procurement will significantly impact patient care by providing highly complex data for both immediate patient care needs and for longitudinal studies.

Cancer registries and registrars are vital to the surveillance, research, and control of cancer. They systematically collect, store, analyze, and interpret data on cancer patients, contributing to understanding cancer trends and outcomes. This information supports public health initiatives, informs policymaking, and guides clinical practices to reduce the burden of cancer.

0. SCOPE

The Veterans Health Administration currently has a shortage of experienced and credentialed Oncology Data Specialists, which significantly impacts patient care by providing healthcare providers with access to real-time comprehensive data on cancer diagnoses, treatments, and outcomes, which allows them to make more informed treatment decisions, monitor patient outcomes, identify trends in cancer care, and ultimately improve the quality of care delivered to cancer patients; this data is also crucial for research and public health initiatives aimed at cancer prevention and early detection. In March 2025, the VA conducted a comprehensive analysis of cancer registry data and carried out a VA-wide Cancer Registry Needs Assessment. This assessment revealed that the VA averages approximately 79,500 new cancer cases each year and currently faces a significant backlog of over 580,000 incomplete cancer registry cases dating back to 2010. Additionally, the analysis found that 93% (126) of the VAMCs require support to effectively maintain their population-based cancer registries.

The VA healthcare system transforms in response to both the changing needs of the

Veteran population and changes in the healthcare industry. These shifts create challenges and require collaboration (internal and external partnerships) as well as new and innovative approaches to healthcare and healthcare delivery.

This acquisition is intended to primarily support the needs of VA healthcare facilities as a resource to support cancer registry data requirements and standards. Task Orders for this PWS will require Contractor support for varied cancer registry systems across the VHA enterprise.

This acquisition will require various knowledge and experience in cancer registry system operations. Subject matter expertise is required to be rapidly available to provide national support under potential Task Orders, including, but not limited to, the following areas: cancer registry electronic health records management, healthcare regulatory compliance, cancer program accreditation requirements, and healthcare analytics.

The Contractor shall provide the necessary services to maintain cancer registry requirements to capture and report data on eligible beneficiaries of the VHA. The standard of services shall meet or exceed currently recognized national standards as established by the Centers for Disease Control (CDC), the American College of Surgeons Commission on Cancer (CoC), and the VACRS and National Cancer Institute (NCI).

For each Task Order award, the Contractor shall provide contract personnel, comprehensive management, materials, equipment, facilities, travel, supervision of Contractor resources, and any required deliverables necessary to satisfy the requirement. Each Task Order will specify the scope of the services for which the award is being made. The Contractor shall perform the work in accordance with the resultant Task Order awards.

AUTHORIZED ORDERING AND ADMINISTRATION

This PWS provides the scope of the IDIQ contract and general requirements. Specific requirements will be defined in each Task Order award. Each Task Order award will be managed by the NOPO Contracting Officer’s Representative (COR) with experience in the business requirement on which the TO is focused.

The services within the scope of this PWS can be used by all VHA facilities based on the availability of resources.

APPLICABLE DOCUMENTS

The Contractor shall be subject to the following policies, including any subsequent updates during the period of performance. The Contractor shall follow guidance in the following documents in the performance of this effort:

A. VHA Directive 1412: VA Cancer Registry System, November 15, 2024

B. VHA Directive 1415: VHA Oncology Program, April 9, 2020

C. VHA Directive 1605.01: Privacy and Release of Information, July 24, 2023

D. VHA Directive 1907.01: VHA Health Information Management and Health Records, April 5, 2021

E. VHA Handbook 1100.17: National Practitioner Data Bank (NPDB) Reports Privacy Act of 1974 (5 U.S.C. 552a)

F. FIPS Pub 201-2, Personal Identity Verification of Federal Employees and Contractors, August 2013

G. 5 U.S.C. 552a, as amended, The Privacy Act of 1974

VA Directive 0710.01, Personnel Suitability and Security Program, October 11, 2018

H. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

I. VA Handbook 6500.2, Management of Data Breaches Involving Sensitive Personal Information, June 30, 2023

J. VA Directive 6506, Review and Use of Patient-Generated Health Data Under the Office of Connected Care, 10DH04 - Connected Care, April 19, 2021

K. VA Handbook 6500.6, Contract Security, April 22, 2024

L. National Institute Standards and Technology (NIST) Special Publications (SP)

M. VA Directive 6508, Implementation of Privacy Threshold Analysis and Privacy Impact Assessment, October 15, 2014

N. VA Handbook, 6300.1, Records Management Procedures, October 22, 2018

O. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

P. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 - Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

Q. OMB memorandum M-11-11, Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 - Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

R. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

S. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

T. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

U. NIST SP 800-63-2, Electronic Authentication Guideline, August 2013

V. Draft NIST Special Publication 800-157, Guidelines for Derived PIV Credentials, March 2014

W. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011

X. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006

Y. Public Law 111-275, Veterans' Benefits Act of 2010

Z. 38 CFR Part 74, Veterans Small Business Regulations

GENERAL REQUIREMENTS

This section describes the general requirements for this effort. The following sub-sections provide details of various considerations for this effort.

0. TYPE OF TASK ORDERS/PERFORMANCE PERIOD

Task Orders (TOs) are performance-based. All TO’s will be Firm Fixed Price.

All Contractors will receive a Task Order Proposal Request (TOPR) for each Task Order competition.

PERFORMANCE PERIOD

The period of performance is one base year with four (4), twelve (12) month option periods.

NON-PERSONAL SERVICES

Task Orders will be issued under a non-personal services arrangement. The Government shall neither supervise Contractor personnel nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to or prepare work schedules for individual Contractor personnel under a non-personal services arrangement. The Contractor is responsible for managing its non-personal service employees and guarding against any actions that are of the nature of personal services or give the perception of personal services. If the Contractor believes that any actions constitute, or are perceived to constitute personal services, the Contractor is responsible for notifying the Contracting Officer immediately.

HOURS OF CONTRACTOR OPERATIONS

Hours of work shall be in accordance with individual TO requirements.

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at the Contractor facilities or remotely using secured VA domains and systems.

CONTRACTOR REMOTE REQUIREMENTS

The Contractor shall be responsible for ensuring that all personnel working at the Contractor site have access to:

A. Equipment and supplies necessary to perform the Task Order(s), to include a laptop computer with a compatible camera and microphones.

B. Sufficient bandwidth and network infrastructure to ensure connectivity to the VA network and resources via Citrix Access Gateway (CAG) for remote desktops.

C. Possess the capability to monitor and/or record calls and share recordings with VA in standard audio files.

D. Personal Identification Verification or other current government access card reader.

E. HIPAA compliant workspace to safeguard patient protected and sensitive health information.

TRAVEL

The Government anticipates that no travel will be required under this effort to perform the tasks associated with the effort and attend program-related meetings or conferences throughout the Period of Performance (PoP).

GOVERNMENT FURNISHED EQUIPMENT (GFE)

The Contractor shall utilize Citrix Access Gateway (CAG) for remote access.

The Contractor shall provide all necessary computer equipment for use at the remote site, as applicable for contract personnel.

All VA policies related to networked computer use will apply. Personal identification verification cards shall be required for all Contractor personnel with VA network access/accounts. Contractor personnel shall complete VA’s Privacy and Information Security Awareness and Rules of Behavior training before networked computer access will be granted.

Based upon the Government's assessment of remote access solutions and requirements of this effort, the Government estimates that this effort will not require GFE.

MANAGEMENT

The Contractor shall provide the following management and support:

A. Maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements.

B. Travel required by the Contractor will be at the Contractor’s expense.

C. Provide the infrastructure required to support contract tasks.

D. Provide administrative support to employees in a timely fashion (timekeeping, leave processing, pay, emergency needs).

GENERAL PERSONNEL REQUIREMENTS

Contractor personnel shall have the expertise and level of experience necessary to accomplish the requirements of this PWS. The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with the appropriate combination of education, training, and experience. In addition, Contractor personnel shall be acceptable to the Government in terms of personal and professional conduct and technical knowledge, skills, and abilities. Contractor personnel are expected to have sufficient written and verbal communication skills to support VHA program offices, their customers, and any other VA organizations. Should any Contractor personnel be determined to be unacceptable in terms of technical competency or unacceptable conduct or behavior while working on contract activities, the Contractor shall immediately remove and replace the unacceptable on-site personnel at no additional cost to the Government. Contractor personnel are to serve in a support role; therefore, final decisions regarding inherently governmental functions will always be made by Government personnel.

The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

0. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

In accordance with VA 0710 Handbook, appointees and contract personnel appointed to Low/Moderate/High Risk positions must be subject to a background investigation conducted by OPM and receive a favorable adjudication from the VA Office of Security and Law Enforcement to ensure compliance with such policy. If such investigation has not been completed prior to contract commencement, the Contractor shall be responsible for the actions of those individuals performing under the contract. Should the contract require the Contractor’s personnel to maintain U.S. citizenship, the Contractor shall be responsible for compliance. Regardless of U.S. citizenship requirements, Contractor personnel are required to read, write, speak, and understand the English language unless otherwise specified in this contract or agreed to by the Government.

All Contractor personnel are subject to the same level of investigation as VA employees with access to VA Sensitive Information. The level of background investigation commensurate with the level of access needed to perform the statement of work is Tier 1. This requirement applies to all Contractor personnel.

All Contractor personnel who require access to the Veterans Health Administration computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Officer of Security and Law Enforcement before contract performance. This requirement applies to all Contractor personnel.

Position Sensitivity – The position sensitivity has been designated as Low Risk

Background Investigation – The level of background investigation commensurate with the required level of access is a minimum background investigation if required.

Position Sensitivity

Background Investigation (in accordance with Veterans Health Administration 0710 Handbook, “Personnel Suitability and Security Program,” Appendix A)

Low/ Tier 1

Tier 1/ National Agency Check with Written Inquiries (NACI) A Tier 1/NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), Federal Bureau of Investigation (FBI) name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA, it is used for Non-sensitive or Low Risk positions.

Moderate/ Tier 2

Tier 2/ Moderate Background Investigation (MBI) A Tier 2/MBI is conducted by OPM and covers a 5-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and an FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, law enforcement check; and a verification of the educational degree.

High/ Tier 4

Tier 4/ Background Investigation (BI) A Tier 4/BI is conducted by OPM and covers a 10-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and an FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and verification of the educational degree.

CONTRACTOR RESPONSIBILITIES

A. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

B. The Government shall bear the expense of obtaining background investigations. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement, etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, any employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

C. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

D. The Contractor shall ensure the following required forms are submitted to the NOPO COR within five (5) business days after contract award:

1. For Tier 1/Low Risk designation:

0. OF-306

0. DVA Memorandum – Electronic Fingerprints

1. For Tier 2/Moderate or Tier 4/High Risk designation:

1. OF-306

1. VA Form 0710

1. DVA Memorandum – Electronic Fingerprints

E. Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

F. Contractor personnel shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the NOPO COR for electronic submission to the SIC. These documents shall be submitted to the NOPO COR within three (3) business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor personnel should notify the NOPO COR within three (3) business days that the documents were signed via eQIP).

G. Contractor personnel may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) fingerprint results, training delineated in VA Handbook 6500.6 (Appendix C), and the signed “Contractor Rules of Behavior.” However, the Contractor shall be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history of Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

H. The Contractor, when notified of an unfavorably adjudicated background investigation on Contractor personnel as determined by the Government, shall withdraw the employee from consideration in working under the contract.

I. Contractor personnel shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the VA computer system.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by the Contractor personnel and/or termination of the contract for default.

CONFIDENTIALITY AND NON-DISCLOSURE

A. The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

B. The VA CO will be the sole authorized official to release in writing any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

C. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers, and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

D. The Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance of this contract, the Contractor has a responsibility to ask the VA CO.

E. The Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture, or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

F. The Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities, according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data comply with published procedures to protect the privacy and confidentiality of such information as required by the VA.

G. The Contractor must adhere to the following:

· The use of “thumb drives” or any other medium for the transport of information is expressly prohibited.

· Controlled access to system and security software and documentation.

· Recording, monitoring, and control of passwords and privileges.

· All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment, and systems.

· VA, as well as any Contractor systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

· Contractor, VA CO, and NOPR COR are informed within twenty-four (24) hours of any employee termination.

· Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

· Contractor does not require access to classified data.

H. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

APPLICABLE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE (per VA HANDBOOK 6500.6, APPENDIX C, April 22, 2024)

GENERAL

The Contractor’s personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

VA INFORMATION CUSTODIAL LANGUAGE

A. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this Contractor or order) is FAR 52.227-19, Commercial Computer Software License.

B. Information made available to the Contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The Contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

C. VA information will not be co-mingled with any other data on the Contractor’s information systems or media storage systems. The Contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements, and media sanitization.

D. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of Contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The Contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to Contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

E. The Contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

F. The Contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

G. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the Contractor.

H. The Contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The Contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

I. The Contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

J. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The Contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

K. Notwithstanding the provision above, the Contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain C-3 medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the Contractor is in receipt of a court order or other requests for the above-mentioned information, the Contractor shall immediately refer such court order or other requests to the VA CO for response.

L. Information made available to the Contractor by VA for the performance or administration of this contract or information developed by the Contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

M. Any data destruction done on behalf of VA by a Contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

N. The Contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization, prior to termination or completion of this contract. If directed by the COR/CO, the Contractor shall return all Federal Records to VA for disposition.

O. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The Contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the Contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the Contractor that the data destruction requirements above have been met shall be sent to the COR/CO within thirty (30) business days of termination of the contract.

P. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the Contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

A. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of Contractor/Subcontractor and agent of Contractor/Subcontractor.

B. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems. The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

C. All Contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

D. All Contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor…