COMBINED SOLICITATION DERMATOLOGY.docx

1. This is a combined synopsis/solicitation for commercial supplies prepared in accordance with the format in FAR Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation for this action. Quotes are being requested, and a separate written solicitation will not be issued. The Government reserves the right to make no award from this solicitation.

1. This solicitation is issued as a Request for Quote (RFQ). Submit written quotes referencing RFQ 36C24622Q0398.

1. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular- 2022-04 dated 01/30/2022.

1. The Network Contracting Office (NCO) 6 – Regional Procurement Office (RPO) EAST intends to award a small business firm-fixed price contract for dermatology tissue testing.

1. The North American Industrial Classification System (NAICS) code for this procurement is 621511 with a business size standard of $35M. This procurement is a small business set-aside and for all eligible offerors may submit quotes.

1. If your firm is a Service-Disabled Veteran Owned or Veteran Owned Small Business, you must be CERTIFIED in VetBiz (see internet site: http://vip.vetbiz.gov).

1. Quotes are due by 10:00AM EST on Tuesday, March 23, 2022. Quotes received after this date and time will be considered late in accordance with 52.212-1(f) and may not be evaluated. Quotes shall be submitted via email to Gordon.burns@va.gov

1. All questions pertaining to this RFQ, are due by 11:00AM EST on Monday, March 28, 2022; and must be submitted via emailed to gordon.burns@va.gov

1. This combined solicitation/synopsis is for the purchase of the following dermatology tissue testing. All interested companies shall fill out the highlighted section of the attached spreadsheet along with company quote. Do not delete any sections of attached spreadsheet.

ITEM INFORMATION

See attached spreadsheet for item description Columns: K/L/O/BY/CG must be completed – insert NA if a column do not apply.

STATEMENT OF WORK

Dermatology Tissue Processing

I. Introduction Central Virginia VA Health Care System Department of Pathology and Laboratory Medicine Services has a need to process the technical component of skin tissues of Dermatology on a contractual basis for 5 years. The processing of these specimens will be used to diagnose a patient’s skin tissue for cancer and treatment of identified disease. Currently, CVVHCS performs approximately 5,000 cases annually.

The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. This solicitation includes options under FAR 52.217-8, Option to Extend Services. Evaluation of options under FAR 52.217-8 will be accomplished by using the prices offered for the last option period to determine the price for a 6-month option period. Evaluation of option will not obligate the Government to exercise the options(s).

II. Contractor Responsibilities

(a) Provide all supplies necessary via courier to transport the specimens to include:

(1) Lab test request forms

(b) Transport samples in such a manner as to ensure the integrity of the specimen. Contractor will supply any special preservatives required for specimen preservation. All specimens shall be shipped in containers provided by contractor.

(c) Contractor shall process the client’s skin biopsy specimens in the usual manner and then deliver the prepared slides and any appropriate paperwork to client via medical courier. The contractor shall return the tissue blocks to the Central Virginia VA Healthcare System Dermatology department to be stored in the VA Laboratory.

(d) Contractor shall provide the VA Dermatology department with a means of communication to permit immediate inquiry regarding the status of pending test.

(e) Contractor shall consult with VA Dermatology department on test results by telephone when urgency of situation requires.

(f) The VA Laboratories reserves the right to request the results of any proficiency testing that the contractor subscribes.

(g) Contractor shall provide monthly for the technical services listed according to the proposed fee schedule billing for tests provided by the 20th of each month following the month in which the service was delivered.

III. Reporting of Test Results A report is defined as a printed final copy of laboratory testing results. Each test report shall at a minimum indicate the following information:

IV. Quality Control Contractor shall notify the VA Dermatopathologist (or designee) immediately by phone or email of any testing errors or defective tests. The notification shall be followed up by a written statement with recommended actions to take to remedy or resolve the situation.

V. Testing Changes The Contractor shall advise the VA Dermatopathologist (or designee) of any changes in procedures, and any new tests introduced.

VI. VA Dermatology Laboratory Responsibilities The VA Dermatology Laboratory will provide laboratory specimens prepared in accordance with the contractor’s Laboratory User’s Manual. All specimens will be properly identified and labeled for testing. The VA Dermatology Laboratory will ship clinical specimens to the contractor on the same day of collection, excluding weekends and holidays. All specimens will be properly stored in accordance with the policies and procedures of the reference lab.

VII. Changes to the Statement of Work The government may require additional testing. Any changes to this SOW shall be authorized and approved only through written correspondence from the CO and/or a modification of the contract. A copy of each change will be kept in a project folder along with all other products of the project. Costs incurred by the contractor through the actions of parties other than the CO shall be borne by the contractor.

VIII. CONTRACTOR QUALIFICATIONS AND INFORMATION SECURITY REQUIREMENTS

1. The reference laboratory and any subcontractors thereof must be licensed or accredited by the College of American Pathologists, the Nuclear Regulatory Commission, the Center for Disease Control, Medicare and/or other state regulatory agencies as mandated by federal and state statutes. In addition, the laboratory must be certified as meeting the requirements of the Clinical Laboratory Improvement Act of 1988 and comply with the National Standards to Protect the Privacy of Personal Health Information (HIPPA).

2. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

3. The contracted laboratory must meet HIPPA requirements. The contractor shall be required to be in compliance with the Health Insurance Portability and Accountability Act of 1996 regulations and when needed, will be required to sign a Business Associate Agreement with the VA. The signed agreement will be returned to the contracting officer and a signed copy will be returned to the contractor for their files.

4. The contractor shall ensure the confidentiality of all patient information being faxed, mailed or transported and will be held liable in the event of a breach of confidentiality. The contractor shall comply with the provision of the Federal Privacy Act of 1974 (Public Law 93-579), HIPAA (Public Law 104-191), and the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act of 1972 (Public Law 93-255), as well as any other statutes regarding confidentiality of patient information during and after the execution of the contract. The contractor shall obtain a signed confidentiality certificate from each employee that may have access to medical record information prior to allowing them to work on this contract. Any information about an individual that is maintained by the VA shall be kept confidential. A copy of a signed certificate shall be provided to the CO upon request.

5. The preliminary and final deliverables, and all associated working papers, application source code, and other material deemed relevant by the VA which has been generated by the contractor in performance of this task order, are the exclusive property of the U.S. Government and shall be submitted to the CO at the conclusion of the task order. The CO will be the sole authorized official to release, verbally or in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to this task order, presented to the contractor, shall be submitted to the CO for response. Press releases, marketing material, or any other printed or electronic documentation related to this contract, shall not be publicized without the written approval of the CO.

6. Contractor Personnel Security Requirements: All contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access. If the investigation is not completed prior to the start date of the contract the contractor will be responsible for the actions of those individuals that provide or perform work for the VA.

A. Position Sensitivity – The position sensitivity has been designated as (low) risk.

B. Background Investigation – The level of background investigation commensurate with the required level of access is National Agency Check (NACI) with written inquiries.

C. Contractor Responsibilities

a. The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM), the contractor shall reimburse the VA within 30 days.

The web site which provides information on the cost of the security investigation is: www.opm.gov\extra\investigate – Select Federal Investigations Notices (FIN 01-01)

b. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak, and understand the English language.

c. The contractor will provide to the Contracting Officer prior to award the following: (1) List of names of contract personnel. (2) Social security numbers of contractor personnel. (3) Home address of contractor personnel or the contractor address.

The Contracting Officer will submit the above information to the Office of Security and Law Enforcement, Washington, D.C. The Office of Security and Law Enforcement will provide the necessary investigative forms (these forms are indicated in paragraph 3.d. below) to the contractor’s personnel, coordinate the background investigations with OPM and notify the Contracting Officer and contractor of the results of the investigation.

d. The contractor shall submit or have their employees submit the following required forms to the VA Office of Security and Law Enforcement within 30 days of receipt:

(i) Standard From 85P, Questionnaire for Public Trust Positions

(ii) Standard Form 85P-S, Supplemental Questionnaire for Selected positions

(iii) FD 258, U.S. Department of Justice Fingerprint Applicant Chart

(iv) VA Form 0710, Authority for Release of Information Form

(v) Optional Form 306, Declaration for Federal Employment

(vi) Optional Form 612, Optional Application for Federal Employment

d. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract.

e. Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

IX. SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

X. VA INFORMATION CUSTODIAL LANGUAGE

A. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

B. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

C. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

D. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

E. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

F. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

G. If a VHA contract is terminated for cause, the associated BAA must also be terminated, and appropriate actions taken in accordance with VHA Handbook 1600.1, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

H. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

I. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

J. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

K. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

L. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

XI. SECURITY INCIDENT INVESTIGATION:

A. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

B. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

C. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

D. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

XII. LIQUIDATED DAMAGES FOR DATA BREACH:

A. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. However, it is the policy of the VA to forego collection of liquidated damages in the event the contractor provides payment of actual damages in an amount determined to be adequate by the agency.

B. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

C. Each risk analysis shall address all relevant information concerning the data Beach, including the following:

(b)data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

D. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 for affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

XII. RECORDS MANAGEMENT CONTRACT LANGUAGE

Delivery and install address:

Richmond VA Medical Center, 1201 Broad Rock Blvd., Richmond, VA 23249

FOB Point: Destination Estimated Delivery Date: Within 30 days ARO

IAW FAR 52.252-1/52.252-2 and VAAR 852.1, the following Federal Acquisition Regulation (FAR) and Veterans Affairs Acquisition Regulation (VAAR) clauses and provisions are applicable to this acquisition and are available for view at: https://www.acquisition.gov/content/regulations

The following solicitation provision apply to this acquisition:

52.212-1 Instructions to Offerors- Commercial Items (JUN 2021)

Addendum to 52.212-1 Instructions to Offerors-Commercial Items (JUN 2020)

52.204-24 Representation Regarding Certain Telecom and Video surveillance Services or Equipment (NOV 2021)

52.212-2 Evaluation-Commercial Items (NOV 2021)

(a) VA will compare quotes and select the product/service that represents the best benefit to the Government to fulfill the requirement based on the judgment of the contracting officer and VA users. (a) The Government will award a contract resulting from this solicitation to the responsible Offeror whose offer conforming to the solicitation and will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

Price, delivery, and completeness of spreadsheet submission.

52.212-3 Offeror Representations and Certifications – Commercial Items (NOV 2021)

Offerors must complete annual representations and certifications electronically via the System for Award Management (SAM) website located at https://www.sam.gov/portal in accordance with FAR 52.212-3, “Offerors Representations and Certifications–Commercial Items.” If paragraph (j) of the provision is applicable, a written submission is required.

(End of Provision)

The following contract clauses apply to this acquisition:

FAR 52.212-4, Contract Terms and Conditions – Commercial Items (NOV 2021) applies to this acquisition.

Addendum to FAR clause 52.212-4, Contract Terms and Conditions – Commercial Items (Jan 2017):

FAR 52.212-5 “Contract Terms and Conditions Required to Implement Statutes or Executive Orders” (JUL 2021 DEVIATION)

The following subparagraphs of FAR 52.212-5 are applicable:

52.204-13 System for Award Management (OCT 2018) 52.204-18 Commercial and Government Entity Code Maintenance (AUG 2020)

52.232-33 Payment by Electronic Funds Transfer-System for Award Management (OCT 2018) 52.232-40 Providing Accelerated Payments to Small Business (NOV 2021) 852.211-72 Technical Industry Standards (NOV 2018) 852.212-70 Provisions and Clauses Applicable to VA Acquisition of Commercial Items (APR 2020)

852.219-78 VA Notice of Limitations on Subcontracting – Certificate of Compliance for Supplies and Products (SEP 2021) (DEVIATION) 852.242-71 Administrative Contracting Officer (OCT 2020) 852.247-73 Packing for Domestic Shipment (OCT 2018)

BASIS FOR AWARD: Award will be based upon a comparative evaluation of quotes in accordance with the Simplified Acquisition Procedures of FAR 13. Comparative evaluation is the side by side pairwise comparison of quotes based on factors resulting in a Contracting Officer decision for the quote most favorable to the Government.

The following are the decision factors: Price, delivery, and completeness of spreadsheet submission. The award will be made to the response most advantageous to the Government.