Clean and Sober Halfway House - Draft SOW.pdf

DRAFT

VA Central California Health Care System

CLEAN AND SOBER HALFWAY HOUSE CONTRACT

STATEMENT OF WORK

A. PURPOSE.

The Department of Veterans Affairs, Fresno, CA (VA) requires contractors to provide services for a Substance Use Disorder Treatment Program (SUDP) for Veterans. The SUDP aims to place Veterans in a community-based, residential environment.

B. BACKGROUND.

Through the SUDP, VA provides case management services to Veterans and facilitates their access to a broad range of medical, mental health, and rehabilitative services. The purpose of this contract is to identify contractors who can provide clean and sober living to veterans suffering from severe mental illness, including veterans who are in community-based treatment facilities offering a safe and secure environment that supports their rehabilitation goals. Due to Veterans having to participate in Intensive Outpatient Programming (IOP) 3 days a week at VA Central California Health Care System, the Contractor must be from the Fresno/Clovis area. This allows Veterans to be in a structured living environment during their treatment. This model enables Veterans to stay connected to the SUDP and other VA services as our staff work closely with the staff at the Sober Living Environment to provide a whole health approach. Veterans will also be connected to staff and other veterans, which allows them to build healthy relationships and a network of support during their recovery and increases the chance of Veterans staying and remaining sober until they become more nutritious and stable. The Contractor must provide 24/7 monitoring (alcohol and drug testing, curfews, and house rules). Contractor will be required to provide transportation for the Veteran to and from to allow the Veteran to participate in the IOP and any medical appointments the Veteran may have.

C. SERVICES TO BE PROVIDED.

BASIC SERVICES. The contractor shall furnish each referred Veteran for care under this contract with the following basic services:

a. ROOM & BOARD: ADA Accessible Room and Board shall be accessible to the Veteran 7 days a week and 24 hours per day. Accommodations will include a bed and linens (towels and bed sheets) and other furnishings such as a dresser or other means of secure storage. At least three nutritious meals will be provided for Veterans 7 days a week. Suitable alternative meal options must be made available to accommodate those with special, medically required dietary restrictions. In addition, nutritious snacks of nourishing quality (e.g., fruits) should be available between meals and before bedtime for those requiring or desiring additional food, when it is not medically contraindicated.

There will not be more than 14 hours between the evening meal and breakfast of the following day. Food shall be prepared, served, and stored under sanitary conditions.

The facility may provide storage space in an on-site refrigerator for Veterans to store personal food. The facility shall establish and maintain sanitary procedures for washing dishes, cleaning equipment, work areas, and disposing of waste.

b. LAUNDRY: Laundry facilities or service must be available at no cost for residents to tend to their laundry needs.

c. DIRECT SERVICES: The following are the minimum direct services that the Contractor will be expected to furnish to Veterans admitted to the program. The contractor shall provide housing and supportive services in a manner that is free from religious discrimination. Direct services will be monitored as denoted in the QASP on a regular basis.

(1) Medication Management: Medications and narcotics shall be properly stored, controlled, issued and recorded in compliance with physician orders.

Contractor shall submit their plan to ensure safe and effective management of medications within the facility as an element of their proposal in response to this solicitation.

(4) VA Coordination: The Contractor is expected to collaborate daily with the identified VA Liaison and other VA providers as necessary to ensure proper coordination of care, services, and resources for the benefit of individual Veterans, and the program in general.

(5) Transportation: The Contractor shall provide Veteran with daily transportation to VA for close follow-up evaluation from a medical provider.

ADMINISTRATIVE FUNCTION & PROCEDURES

A) COMMUNICATIONS: Contractor is expected to have a reliable, working phone line for VA inquiries. Messages left for the program by VA Staff are expected to be returned as soon as possible during normal business hours Monday through Friday. This includes calls from VA proper or the Liaison to the program. Written correspondence, such as eligibility authorizations, extension requests, incident reports, and discharge reports shall be promptly delivered as denoted in their respective sections below.

1. PERSONNEL

The Contractor will employ sufficient personnel to carry out the facility's policies, responsibilities, and program. At minimum, at least one administrative staff member or designee must be on duty 24/7 on the premises or residing at the house and available for emergencies.

2. REFERRALS

A. The VA is responsible for determining veterans' eligibility before referral to the Contractor for treatment. A written referral (hard copy, fax, or e-mail is acceptable) signed by an authorized VA ordering officer shall be provided to the Contractor for each Veteran referred for services under the contract.

B. A list of authorized VA ordering officials for the contract shall be provided to the Contractor upon contract award. Ordering officials may be added or deleted from the list during the contract term at the discretion of the VA Contracting Officer. The Contractor shall be provided an updated list of authorized VA ordering officials whenever such changes are made.

C. It is understood that the Contractor will not be paid for care provided to a referred Veteran beyond the period authorized in the referral, unless the VA offers an extension of the authorization in writing.

D. The initial referral period for a Veteran may be up to 30 days, depending upon the veteran's needs as mutually determined by the Veteran, the Contractor’s staff, and the VA Program Coordinator or designee. If funding is available, the VA program coordinator or designee may authorize an extension of the referral period up to 30-60 days.

3. ABSENCES AND CANCELLATION

A. The contractor shall notify the VA of unauthorized absences by a referred Veteran from the facility. Should a Veteran absent himself/herself from the Contractor’s facility in an unauthorized manner, payment for services for that Veteran shall be continued for a maximum period of two days, provided there is an active outreach attempt on the part of the Contractor’s staff to return the Veteran to the facility. There is a reasonable belief that the Veteran will return. The management of program dropouts will be an element of the quality assurance review of this program. The absence of the Veteran from the facility for more than two days will not be reimbursable unless authorized in advance by the VA Program Coordinator.

B. VA reserves the right to remove any or all Veterans from the facility at any time, without additional cost, when it is determined to be in the VA's or the Veteran's best interest.

The Contractor shall notify the authorizing VA facility immediately when a medical emergency requires a referred Veteran's hospitalization. It is agreed that the Veteran will be admitted to the appropriate VA facility. When such admission is not feasible because of the nature of the emergency, it is decided that hospitalization in a non-federal hospital may be accomplished if VA authorization is obtained. If hospitalization of a non-emergency nature is required, it is agreed that admission to the appropriate VA facility will be performed promptly.

The contractor shall notify the authorizing VA facility immediately of any incidents involving Veterans residing in the residential program. The Contractor shall notify the VA case manager by telephone between 8:00 a.m. and 4:30 p.m. After regular business hours, the contractor should notify the Administrator on Duty (AOD) of all incidents. The Contractor shall provide the SUDP case manager and the Contracting Officer’s Technical Representative (COTR) with a copy of the incident report within 24 hours. The Contractor shall maintain a copy of the incident report in the Veteran’s case record.

4. CONTRACTOR STAFF CONDUCT/COMPLAINTS HANDLING

Contractor personnel shall be expected to treat referred Veterans with dignity and respect and abide by standards of conduct mirroring those prescribed by current federal personnel regulations.

The VA reserves the right to exclude Contractor staff members from providing services to Veterans under this contract based on breaches of conduct, including conduct that jeopardizes patient care or interferes with the regular and ordinary operation of the facility. Violations of conduct include intoxication or debilitation resulting from drug use, theft, patient abuse, dereliction, or negligence in performing directed tasks, or other conduct resulting in formal complaints by Veterans or other staff members to designated Government representatives. The Contractor and COTR shall deal with issues concerning contractor personnel conduct. The Contracting Officer shall be the final arbiter on acceptability questions and validating complaints.

6. FACILITY

A. It is the Contractor's responsibility to maintain its facilities properly, and VA shall have no responsibility for paying or reimbursing the Contractor for such expenses. The contract facility must:

a) Have a current occupancy permit issued by the local and state governments in the jurisdiction where the facility is located.

b) Follow existing standards of State safety codes and local, and/or State health and sanitation codes.

c) Be licensed by the state or local authority.

d) Where applicable, be accredited by the State.

e) Be equipped with operational air conditioning /heating systems

f) Be clean, free of dirt, grime, mold, or other hazardous substances, and damage noticeably detracts from the overall appearance.

g) Be equipped with first aid equipment and an evacuation plan in an emergency.

h) Have windows and doors that can be opened and closed to manufacturer standards.

i) Provide adequate heating and air conditioning.

B. The contractor facility must meet fire safety requirements, as follows:

a) The building must meet the requirements of the applicable residential occupancy chapters of the current version of NFPA 101, National Fire Protection Association's Life Safety Code. The appropriate Veterans Health Administration Veterans Integrated Service Network (VISN) Director must approve any equivalencies or variances.

b) All residents in the facility must be mentally and physically capable of leaving the building, unaided, in the event of an emergency.

c) Fire exit drills must be held at least quarterly. Residents must be instructed in evacuation procedures when the primary and/or secondary exits are blocked. A written fire evacuation plan shall be developed and reviewed annually. The plan shall outline the duties, responsibilities, and actions to be taken by the staff and residents in a fire emergency. This plan shall be implemented during fire exit drills.

d) A written policy regarding tobacco smoking in the facility shall be established and enforced.

e) Portable fire extinguishers shall be installed at the facility. NFPA 10, Portable Fire Extinguishers, provides guidance on selecting and locating extinguishers.

f) Requirements for fire protection equipment and systems shall be by NFPA 101. All fire protection systems and equipment, such as the fire alarm system, smoke detectors, and portable extinguishers, shall be inspected, tested, and maintained in accordance with the applicable NFPA fire codes and the results documented.

g) The annual inspection by a VA team shall include a fire and safety inspection conducted at the facility unless a review of past VA Central California Health Care System inspections or inspections made by the local authorities indicates that a fire and safety inspection would not be necessary, in which case the VA may waive the inspection.

7. INSPECTION OF FACILITY AND PROGRAM

Before the award of a contract and annually during the contract term, a multidisciplinary VA team consisting of a social worker, dietitian, registered nurse, and a Facilities Management Safety Officer, and other subject matter experts as determined necessary by SUDP Coordinator may conduct a survey of the Contractor’s facilities to be used to provide Veteran’s food, and shelter, to assure the facility offers quality care in a safe environment. Inspections may also be carried out at other times as deemed necessary by the VA Central California Health Care System.

The contractor will be advised of the inspection team's findings. If deficiencies are noted during any inspection, the Contractor will be given a reasonable time to take corrective action and to notify the COR that the corrections have been made. A contract will not be awarded until noted deficiencies have been eliminated. Failure by the Contractor to take corrective action within a reasonable time will be reported to the VA Contracting Officer. Suppose corrections are not made to the satisfaction of the VA. In that case, the Contracting Officer will consult with the appropriate officials to make suitable arrangements to discontinue plans to award a contract, discharge or transfer patients, and terminate the existing agreement, as applicable.

The inspection of the Contractor facilities will include inspection for conformity to the current Life Safety Code as described in paragraph 6, and will also include the following:

General observation of residents to determine if they maintain acceptable personal hygiene and grooming.

Assessment of whether the facility meets applicable fire, safety, and sanitation standards.

Determining whether the facility is in attractive surroundings conducive to social interaction and the full development of the resident's rehabilitative potential.

Assess for appropriate heating and air conditioning.

Observation of staff behavior and interaction with residents to determine if they convey an attitude of genuine concern and caring.

Inspecting the types of meals and other nutrition provided to residents to see if appetizing, nutritionally adequate meals are provided in a setting that encourages social interaction, and if nutritious snacks between meals and bedtime are available for those requiring or desiring additional food when it is not medically contraindicated.

Making a spot check of Veterans’ records to ensure accuracy with respect to Veterans’ length of stay and services provided to the Veterans.

8. CONTRACT CHANGES/TECHNICAL DIRECTIONS.

The Contracting Officer is the only person authorized to approve changes or modify any of the requirements of this contract. The Contractor shall communicate with the Contracting Officer on all matters about contract administration. Only the Contracting Officer is authorized to make commitments or issue changes that shall affect the price, quantity, or quality of performance of this contract.

IN THE EVENT THE CONTRACTOR AFFECTS ANY SUCH CHANGE AT THE DIRECTION OF ANY

PERSON OTHER THAN THE CONTRACTING OFFICER WITHOUT AUTHORITY, NO ADJUSTMENT

SHALL BE MADE IN THE CONTRACT PRICE TO COVER AN INCREASE IN COSTS INCURRED AS A

RESULT.

The COR will be responsible for the overall technical administration of this contract as outlined in the COR Delegation of Authority, including monitoring of the Contractor’s performance.

9. Security Requirements:

a. The Service contractor is expected to perform functions requiring access to VA sensitive information. While providing services, it will be necessary for the service Contractor to view and receive protected health information (PHI) and personally identifiable information

(PII).

b. Contracts, in which VA sensitive information is accessed by a VA Contractor/Subcontractor, require the following requirements per 38 U.S.C. § 5723 and 5725:

1) A prohibition on unauthorized disclosure: “Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA’ See VA Handbook 65006, Appendix C, paragraph 3.a.

2) A requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor /Subcontractor has access, the Contractor/Subcontractor shall immediately and simultaneously notify the COTR, the designated ISO, and Privacy Officer for the contract. The term ‘security incident’ means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph Ga.

3) A requirement to pay liquidated damages in the event of a data: “In the event of a data breach or privacy incident involving any SPI the Contractor processes or maintains under this contract, the Contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.” See VA Handbook 6500.6, Appendix C, paragraph 7.a., 7.d.

4) A requirement for annual security/privacy awareness training: ‘Before being granted access to VA information, all Contractor employees and Subcontractor employees requiring such access shall complete yearly either (i) the VA security/privacy awareness training (contains VA’s security/privacy requirements) within 1 week of the initiation of the contract, or (ii) security awareness training provided or arranged by the Contractor that conforms to VA’s security privacy requirements as delineated in the hard copy of the VA security awareness training provided to the Contractor. Suppose the Contractor provides their training that conforms to VA’s requirements. In that case, they will provide the COTR or CC, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in VA’s contract have received their annual security/privacy training that meets VA’s requirements and the total number of employees trained. See VA Handbook 6500.6, Appendix C, paragraph 9.

5) A requirement to sign VA’s Rules of Behavior: “Before being granted access to VA information, all Contractor employees and Subcontractor employees requiring such access shall sign on an annual basis an acknowledgment that they have read, understand, and agree to abide by VA’s Contractor Rules of Behavior which is attached to this contract.” See VA Handbook 6500.6, Appendix C, paragraph 9, Appendix D, Note: If the vendor anticipates that 10 or more individuals will perform the services under the contract, the Contractor Rules of Behavior may be signed by the vendor’s designated representative. By signing the Rules of Behavior on behalf of the vendor, the contract must reflect that the designated representative agrees to ensure that all such individuals review and understand the Contractor Rules of Behavior when accessing VA’s information.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data- General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the Contractors/Subcontractors’ information systems or media storage systems to ensure VA requirements related to data protection and media sanitization can be met. Suppose co-mingling must be allowed to meet the business's requirements. In that case, the Contractor must ensure that VA’s information is returned to the VA or destroyed by VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of Contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures comply with VA directive requirements.

c. Before termination or completion of this contract, the Contractor/Subcontractor must not destroy information received from VA, or gathered/created by the Contractor while performing this contract, without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done by National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose, and dispose of VA information only in compliance with the contract terms and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, rules and guidelines become relevant to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The Contractor/Subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated, and appropriate actions must be taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. There is no business associate relationship without an agreement to use or disclose protected health information.

h. The Contractor/Subcontractor must store, transport, or transmit VA sensitive information in encrypted form using VA-approved encryption tools that are, at minimum, FIPS 140-2 validated.

i. If applicable, the Contractor/Subcontractor’s firewall and Web services security controls shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the agreement, the Contractor/Subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or

(ii) with VA’s prior written approval. The Contractor/Subcontractor must refer all requests for, demands for production of, or inquiries about VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the Contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. Suppose the Contractor/Subcontractor is in receipt of a court order or other requests for the above-mentioned information. In that case, that Contractor/Subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the Contractor/Subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The Contractor/Subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access.

b. To the extent known by the Contractor/Subcontractor, the Contractor/Subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/Subcontractor considers relevant.

c. Concerning unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the Contractor/Subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The Contractor, its employees, Subcontractors, and their employees shall cooperate with VA and any law enforcement authority responsible for investigating and prosecuting any possible criminal law violation(s) associated with any incident. The Contractor/Subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with 38 U.S.C. §5725 requirements, a contract may require access to sensitive personal information. If so, the Contractor is liable to VA for liquidated damages in case of a data breach or privacy incident involving any SPI the Contractor/Subcontractor processes or maintains under this contract.

b. The Contractor/Subcontractor shall notify VA of a “security incident” outlined in the Security Incident Investigation section above. Upon such notification, VA must secure from a non- Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. The Contractor shall fully cooperate with the entity to perform the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence.

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code

(3) Number of individuals affected or potentially affected

(4) Names of individuals or groups affected or potentially affected

(5) Ease of logical data access to the lost, stolen, or improperly accessed data, considering the degree of protection for the data, e.g., unencrypted, plain text

(6) Amount of time the data has been out of VA control

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons).

(8) Known misuses of data containing sensitive personal information, if any

(9) Assessment of the potential harm to the affected individuals.

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate: and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

8. SECURITY CONTROLS COMPLIANCE TESTING

Periodically, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the Contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the Contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in case of a security incident or at any other time.