Combined Synopsis_Solicitation.pdf

Solicitation Number: 36C26321Q0225

1a. DESCRIPTION OF SOLICITATION

In accordance with FAR Part 13 this a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued.

This Solicitation issued as a Request for Quotation (RFQ) for the following Commercial Items:

MRI Mobile Trailer Rental, BRAND NAME OR EQUAL (BNOE): PHILIPS, Quantity One (1)

NOTE: Responses shall be on an all or none basis, no partial submission. The Government reserves the right to make no award at all.

Respond by: 2:00 P.M. CDT on 2/16/2021 to timothy.kimmel@va.gov with a valid submission of quote. Please see additional INSTRUCTIONS TO OFFERORS below.

Small Business Set-Aside:

This solicitation is Set-aside 100% for Service-Disabled Veteran-Owned Small Businesses.

Quotations from Large Business offerors will be considered non-responsive, will not be evaluated and will not be eligible for award.

Brand-Name Only solicitation:

This is a Brand-Name or Equal (BNOE) solicitation for PHILPS.

NAICS code/Size Standard/PSC or FSC:

NAICS code (North American Industrial Classification system): 621512 Size Standard for this NAICS code: $16.5 Million PSC/FSC (Product Service Code/Federal Supply Code): 6525

Type of Contract/Award:

The type of contract/award the government intends to make/enter into for this solicitation is a s ingle award, firm-fixed price purchase order.

Delivery: FOB Destination, ARO by 3/1/2021. See Delivery below.

Contract Period: Delivery Date ARO by 3/1/2021.

Method of Payment:

Payment will be made electronically to:

Department of Veterans Affairs FMS-VA-2(101), Financial Services Center, PO Box 149971, Austin TX 78714-9971 through the Tungsten Network Client Services. For help call: 1-866-340-4980, E-mail: v a.registration@tungsten-network.com.

Provisions and Clauses:

All provisions and clauses applicable to this solicitation can be viewed in full text using the following web addresses: h ttps://www.acquisition.gov/browsefar -or-h ttps://www.va.gov/oal/library/vaar/ mailto:timothy.kimmel@va.gov mailto:a.registration@tungsten-network.com http://www.acquisition.gov/browsefar-or-http://www.va.gov/oal/library/vaar/

1b. DESCRIPTION OF SUPPLIES/SERVICES being solicited:

SPECIFICATIONS: MOBILE MRI SERVICES @ FARGO NORTH DAKOTA VA

Contractor shall provide installation, equipment, hook up, including venting (if needed), training, and in-service on use, maintenance and service (repair) of all Contractor furnished equipment (including a mobile trailer/unit) necessary to perform mobile Magnetic Resonance Imaging Services (MRI) at the Fargo VA Health Care System (FVAHCS). Service response time with two hours of notification. The period of performance will be 6 Months with one (1) one-month options. The estimated/target start date is March 1, 2021 but dependent upon the activation of Construction at the facility. Services shall be performed a minimum of 8 (8) hours per day, Monday thru Friday. If additional days of scanning are needed in order to catch up with scheduling backlog, down time, Holiday delays, etc. the contractor will work with the POC to establish dates and times of operation. Hard drive will need to be removed after the service is no longer needed per VHA regulations. Instructional in service on operation of the trailer and any training must occur upon start-up.

Lease payments will not begin until VA can utilize trailer. FOB:

Destination

CONTRACTOR FURNISHED EQUIPMENT:

All equipment to be used during the performance of the contract must be FDA approved imaging equipment; proof of this is a deliverable item at the time of the solicitation response and at award.

Contractor will be required to make whatever adaptations are necessary to include shimming the magnet, IT systems/ phones, etc. so that the Contractor’s equipment is compatible with the VA.

Contractor shall be responsible to maintain all equipment in good working order at all times and shall reimburse the VA for loss time resulting from defective workmanship or equipment failure.

A. Mobile Trailer: Mobile Trailer where studies will be performed on equipment furnished by the Contractor. The entire offering of an MRI Mobile Trailer service shall meet all local, state, federal, industry, Joint Commission NEC, NFPA, VA, OSHA, and other regulatory standards internal or external applicable to the FVAHCS. The MRI trailer shall provide the space enough for conducting CPR and code, if needed. The Mobile Trailer shall also have an intercom system between the control room and scanning room, and CD-R burning capabilities as a backup to network transfer of data, the patient data is the property of the FVAHCS. The Mobile MRI Trailer shall maintain a temperature to assure proper operation of the scanner without frequent calibration and provide for patient comfort.

Mobile MRI Specifications: -Contractor to provide documentation with quote that demonstrates their submission includes these requirements:

• Mobile MRI general configuration that is common to Philips, Mobile MRI trailer.

Philips Achieva 1.5 T with software release level of 5.4.1

• Full compatibility with hospital PACS system DICOM 3.0

• Patient intercom system between control room and scanning room

• Safety and Warning Systems Visual and Audible

• Alarms Smoke Detectors, Fire Extinguishers

• Emergency Lighting Battery backup

• Lighted sign indicating “Magnet is always on”

• Phone and data

• Data ports

• 480v 50’ power cable

• Hydraulic patient lift, Stairs and railings

• MRI compatible patient cart

• Patient Dressing area on mobile trailer

• On Board Generator to power HVAC in the event of shore power interruption HVAC system to maintain trailer environmental systems

• Operators and Technical support Manuals

Full System Service (Monday – Friday 8am to 5pm local time excluding Federal

Holidays) 24 Hour telephone technical support toll free line, response

MRI Scanner System: Contractor shall furnish a Philips 1.5 T ACHIEVA Scanner. Contractor equipment shall include minimum of 8 & 16 channel imaging capabilities, not less than Quantum Gradient package (33MT/100 slew rate) Contractor to submit documentation with quote demonstrating how quote meets these the technical requirements as stated herein:

Operator Console

• Exam Cards, Smart Exam

• MR Workstation with viewing, processing and filming

• DICOM Workflow, Send/ Receive, Query, Print, Media, IHE Integration profiles

• Achieva 1.5T magnet- Software Release 5.0

• 1.57m (5.15 ft) in length

• Wide patient opening has a 110 cm (43 inch) flare

• Patient bore diameter is 60 cm (23.6 inch), length 60cm

• Comfortable patient support- patients weighing up to 250 kg (550 lbs.) to be comfortably positioned

• Friendly patient environment

• Achieva ScanTools

• Pulsar Gradient System

• 33mTm peak on axis 80

• mT/m/ms slew rate

• Scalable 32 RF

• 18KW power amplifier

• Windows 10 Host Computer or highest level for scanner

• 2.8 GHz Dual Intel Xeon processors

• 3 GB internal memory

• 36 GB system disk

• 36 GB data storage disk (for approx. 250,000 256256 images)

• MOD Image Storage Device

• Rapid View Reconstructor

• Scan tools R1

• Scan Tools Clinical

• Spin Echo

• Fast Field Echo

• Turbo Field Echo

• Turbo Spin Echo

• Echo Planar Imaging

• Time of Flight

• Contrast Enhanced

• Phase Contrast

• Quantitative flow

• CLEAR

• Cardiac gated breath-hold

• Single-slice multi-phase

• 3D k-space shutter

• Dixon

• Query/Retrieve

• Import/Export Store Images

• Secondary Capture

• Grayscale Softcopy Presentation State

• Storage Commitment

• Grayscale Print

• DICOM Media Interchange

• DICOM Conformance Statement

• DICOM standard

Applications Suites to include (Neuro, Angio, Body, Oncology, and Ortho), DICOM compatibility, i.e.: Work list and Storage. The Contractor’s mobile scanner system must be able to connect to the VA Commercial PACS system for images and VISTA Imaging Network.

Patient lists must be compatible with DICOM 3 imaging standards.

Rapid View re-constructor SofTone gradient acoustic noise reduction Scan Tools clinical application software Body

Minimum coils supplied by contractor shall include: 16 channel Head Matrix, Neurovascular coil, Torso coil, Spine coil, Small Flex, Large Flex & interface, 8 channel Foot/Ankle, 16 channel Shoulder coils for large and small patients, Phased Array Wrist, 16 channel Knee coils.

Complete listing of coils needed

• Synergy spine Coil 1.5T

• Body Coil 1.5T

• Head coil 1.5T

• Performance Package COILS:

• Torso coil, & interface, 16 channel Knee coils

• 16 Channel neurovascular coil

• Quadrature Body Coil

• Quadrature Head Coil:

• 16 Channel Wrist coil

• 16 channel Shoulder coils for large and small patients,

• 8 channel Foot/Ankle

• 16 channel Head Matrix

• Synergy Flex Small-

• Synergy Flex Medium-

• Synergy Flex Large-

• Quadrature Knee Coil: -16 channel coil

• Neuoro-vascular coil 16 channel

• Coil: SENSE Body Coil: 16 channel coils

• Synergy Spine Coil:

• SENSE, Philips revolutionary parallel imaging technology, increases imaging speed of all

• applications by a factor of two. SENSE can be combined with the CLEAR coil uniformity correction technique, optimizing image quality when imaging with multi-channel SENSE coils Advanced Methods:

• Balanced FFE:

• DRIVE: CENTRA: ProSet: SPAIR: Black Blood:

• Scan Tools Clinical Application Packages

• NeuroPlus: Body Plus: Ortho Plus: Cardiac Plus: Angio Plus: Onco Plus

• Body Performance:

• Keyhole Imaging

• Dixon

• Bolus Tracking

Scan Planning and Setup

• Exam Cards complete clinical studies that are selectable at a single touch. For example, users can select angio study, and an entire exam – including planning, Bolus Trak and scan protocols is ready to be executed.

• Flex Plan: an automatic planning method based on flexibility to choose three anatomical landmarks.

• The system automatically defines and displays the scan plane through these landmarks, making it an excellent planning method for irregular shaped anatomies e.g. MRCP.

• Time Save: increases patient throughput by automatic reduction and skipping of preparation phases.

• Auto Survey accelerates the setup procedure.

• Repeat Scan: enables copying of all examination parameters from any previous scan to a new acquisition.

Imaging Techniques:

• Spin Echo (SE) single echo and asymmetric multiple echoes

• Fast Field Echo (FFE): T1 and T2 weighting including steady state (Balanced FFE) and spoiling techniques.

• Turbo Field Echo (TFE), rapid FFE acquisition methods including user-controlled pre-pulses for enhanced contrast manipulation and flip angle sweep for increased SNR.

• Turbo Spin Echo (TSE): Turbo factors up to 32 with T1, PD and T2 contrast with single and dual echoes, Includes DRIVE for improved scan times. Single Shot ((SS) TSE provides turbo factors up to 256 for imaging with long echo times and high T2 contrast.

• Echo Planar Imaging (EPI) both Multi-Shot (MS) and Single Shot (SS) EPI readout methods are available for FFE and SE imaging.

• Inversion Recovery (IR) application of single and dual RF inversion pulses with control of Inversion times for flexible contrast control and tissue nulling.

• Time of Flight (ToF) ToF or Inflow uses optimized short echo time FFE and TFE imaging techniques

• Contrast Enhanced (CE) utilizes ultra-short TE, TR, FFE and TFE techniques.

• Optimization for 3D includes CENTRA

• Phase Contrast (PC)

• Quantitative flow

• CLEAR (Contrast Level AppeaRance) Cardiac gated breath-hold

• TFE Pre-pulses:

• Pre-saturation

• Magnetization Transfer Contrast (MTC)

• Fast Saturation

Scan Tools:

• Patient Study Query/Retrieve (SCU)

• Study Root Query/ Retrieve (SCU)

• MR Image Storage (SCU & SCP) Import/Export

• Secondary Capture Storage (SCU & SCP) Import/Export

• Greyscale Softcopy Print Management (SCU)

Accessory Equipment:

Contractor shall provide:

• a pulse oximeter

• Approved ACR QC phantom,

• Physiological synchronization for Peripheral pulse Respiratory triggering VCG

• Integrated 2-way patient –operator communication, with call button

• Positioning wedges, pads, sand bags, headrest and knee support

• MedRad Power Injector- Spectris Solaris -Programmable Power injector with pressure monitor, having the following capabilities: scan delay, Multiphase option, protocol storing, and pause hold functionality.

D. Telecommunications: The mobile scanner system shall be equipped with an outlet connection capable of transmitting data and voice through a Government provided category five (5) cable. The Government will provide the connection required for the transmission of images, data and voice. The Contractor’s mobile scanner system must be able to connect to the commercial PACS system and VISTA Imaging Network and to transmit all images to both systems and be compatible with DICOM imaging standards.

GOVERNMENT FURNISHED UTILITIES/SERVICES:

The Government will provide the following utilities/services to the Contractor if required for the operation of the mobile MRI unit.

1. Water

2. Electricity*

3. Telephone Line(s) **

4. Data Port

5. Housekeeping ***

* In accordance to the Original Equipment Manufacturers’ (OEM) electrical specifications.

** Cabling for three (3) voice and three (4) data connections to mobile MRI trailer with weatherproof RJ-45 connectors. Use of telephone extension while mobile unit is on site in order to permit personnel of the unit to make and receive telephone call and to facilitate the movement of patients to and from the unit. Telephone calls placed and received by personnel on the extension shall be restricted to the appropriate free dialing areas and long distance without charge to the FVAHCS.

*** VA shall be held responsible for areas within the hospital facility prior to entrance of the Mobile Trailer. FVAHCS MRI Staff shall be responsible for all housekeeping duties.

SPECIAL CONTRACT REQUIREMENTS

1. SERVICES

a. The services specified herein may be changed by written modification to this contract. Only the

Contracting Officer is authorized to make commitments or issue changes that affect price, quantity, or quality of performance of this contract. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change shall be considered unauthorized and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof.

b. The Government may evaluate the quality of professional and administrative services provided, but retains no control over the medical, professional aspects of services rendered.

c. Contractor is required to maintain medical liability insurance for the duration of this contract.

Medical Liability insurance must cover the provider(s) for services in all states where services are rendered by the provider. Contractor must indemnify the Government for any liability producing act or omission by the contractor, its employees and agents occurring during contract performance.

d. Contractor shall provide the required services listed herein throughout the contract period. Other necessary personnel for the operation of the services contracted for at the VA will be provided by the VA at levels mutually agreed upon which are compatible with the safety of the patient and personnel and with quality medical care programming.

e. Contractor shall, in writing, keep the Contracting Officer informed of any unusual circumstances in conjunction with the contract.

2. TERM OF CONTRACT

This contract is effective for a base period of 6 Months, with one-month options available. The contract is subject to the availability of VA funds. The contractor shall perform no services after options have expired until the contracting officer authorizes such services in writing.

3. FEDERAL HOLIDAYS

The 10 holidays observed by the Federal Government are: New Year’s Day (January 1st), Martin Luther

King’s Birthday (3rd Monday in January), Presidents’ Day (3rd Monday in February), Memorial Day (last Monday in May), Independence Day (July 4th), Labor Day (1st Monday in September), Columbus Day (2nd Monday in October), Veterans Day (November 11), Thanksgiving Day (4th Thursday in November), Christmas Day (December 25th) and any other day specifically declared by the President of the United States to be a national holiday.

When one of the above designated legal holidays falls on a Sunday, the following Monday will be observed as a legal holiday. When a legal holiday falls on a Saturday, the preceding Friday is observed as a holiday by U.S. Government agencies.

4. QUALIFICATIONS OF PERSONNEL

FVAHCS will provide personnel to operate the Mobile MRI and schedule appointments.

5. HHS/OIG

To ensure that the individuals providing services under the contract have not engaged in fraud or abuse regarding Sections 1128 and 1128A of the Social Security Act regarding federal health care programs, the contractor is required to check the Health and Human Services - Office of Inspector General (HHS/OIG), List of Excluded Individuals/Entities on the OIG Website (www.hhs.gov/oig) for each person providing services under this contract. The listed parties and entities may not receive Federal Health Care program payments due to fraud and/or abuse of the Medicare and Medicaid programs. During the performance of this contract the contractor is prohibited from using any individual or business listed on the List of Excluded Individuals/Entities. Any healthcare provider or entity that employ or enter into contracts with excluded individuals or entities may have a Civil Monetary Penalty (CMP) imposed against them. By signing this offer, the Contractor certifies that all persons or entities listed in the contractor’s proposal have been compared against the OIG list and are NOT listed as of the date the offer was signed.

6. JOINT COMMISSION STANDARDS

Although Joint Commission accreditation is not required, the contractor shall perform the required work in compliance with Joint Commission Standards. A copy of these standards may be obtained from Joint Commission, One Renaissance Blvd., Oakbrook Terrace, IL 60181.

The Contractor will be responsible to ensure the subcontractors providing work on this contract are fully trained and completely competent to perform the required work. The contractor is required to develop and maintain the following documents for each subcontractor employee working on the contract:

credentials and qualifications for the job; a current competence assessment checklist (an assessment of knowledge, skills, abilities and behaviors to perform a job correctly and skillfully; includes knowledge and skills required to provide care for certain patient populations, as appropriate); a current performance evaluation supporting ability of the contractor employee to successfully perform the work required in this solicitation and the listing of relevant continuing education for the last two years. The contractor will provide current copies of these records at the time of contract award and annually on the anniversary date of contract award to the VA POC, or upon request, for each contractor or subcontractor employee working on the contract.

7. PERSONNEL POLICY

http://www.hhs.gov/oig)

a. The contractor shall be responsible for protecting the personnel furnishing services under this contract. To carry out this responsibility, the contractor shall provide the following for these personnel:

• Workers compensation

• Professional liability insurance

• Health examinations including:

Annual TB Skin Test and recent (within the last year) chest X-ray if there is a history of positive TB skin test, Evidence of Hepatitis B immunity (hepatitis immune titer, if provider has had the series of shots; if no immunity, evidence that provider has started the Hepatitis B vaccination series.), Evidence of a Hepatitis C titer, Varicella titer if provider has not had chicken pox.

• Income tax withholding, and

• Social security payments.

b. The parties agree that the contractor, its employees, agents and subcontractors shall not be considered VA employees for any purpose.

c. The VA shall notify the Contractor of any significant communicable disease exposure as appropriate. The Contractor shall adhere to current CDC/HICPAC Guideline for Infection Control in health care personnel (AIJC 1998: 26:2890354) for disease control. The Contractor shall provide follow up documentation of clearance to return to the workplace prior to contractor’s or subcontractor’s employee(s) return.

8. MEDICAL RECORDS

Clinical or other medical records of VA veteran patients treated by Contractor under this contract are VA records. Clinical or other medical records of VA beneficiaries that are released to the Contractor shall be returned to the VA after review with normal film deliveries, as outlined above.

The VA will provide the Contractor(s) with the patient’s medical records when necessary. The Contractor shall be responsible for the safekeeping of both the electronic and paper medical records (whichever is applicable). Patient Privacy Provisions and HIPAA regulations are applicable to the release of patient Information.

9. CONFIDENTIALITY OF PATIENT RECORDS

a. The Contractor is a VA contractor and will assist in the provision of health care to patients seeking such care from or through VA. As such, the Contractor is considered as being part of the Department health care activity. Contractor is a VA contractor for purposes of the Privacy Act, Title 5 U.S.C. 552a. Further, for the purpose of VA records access and patient confidentiality, Contractor is a VA contractor for the following provisions: Title 38 U.S.C. 5701, 5705, and 7332.

Therefore, Contractor may have access, as would other appropriate components of VA, to patient medical records including patient treatment records pertaining to drug and alcohol abuse, HIV, and sickle cell anemia, to the extent necessary to perform its contractual responsibilities.

However, like other components of the Department, and not withstanding any other provisions of the sharing agreement, the Contractor is restricted from making disclosures of VA records, or information contained in such records, to which it may have access, except to the extent that explicit disclosure authority from VA has been received. The Contractor is subject to the same penalties and liabilities for unauthorized disclosures of such records as VA.

b. The records referred to above shall be and remain the property of VA and shall not be removed or transferred from VA except in accordance with U.S.C.551a (Privacy Act), 38 U.S.C. 5701 (Confidentiality of claimants’ records), 5 U.S.C. 552 (FOIA), 38 U.S.C. 5705 (Confidentiality of Medical Quality Assurance Records) 38 U.S.C. 7332 (Confidentiality of certain medical records) and federal laws, rules and regulations. Subject to applicable federal confidentiality or privacy laws, the Contractor, or their designated representatives, and designated representatives of federal regulatory agencies having jurisdiction over Contractor, may have access to VA ‘s records, at VA’s place of business on request during normal business hours, to inspect and review and make copies of such records.

10. HIPAA COMPLIANCE

Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). As required by HIPAA, the Department of Health and Human Services (HHS) has promulgated rules governing the security and use and disclosure of protected health information by covered entities, including the Department of Veterans Affairs (VA). Contractor is conducting health care, Mobile MRI services, on VA’s behalf - therefore, no BAA is required.

11. CONTRACT PERFORMANCE MONITORING

1. Departments being served will monitor Contractor performance to ensure that services called for in the contract have been received by VA in a timely manner. Any incidents of Contractor noncompliance as evidenced by the monitoring procedures will be forwarded immediately to the Contracting Officer.

2. Documentation of services performed will be reviewed prior to certifying payment. The

POC will perform periodic spot checks and document with the using service to ensure records monitoring. VA will pay only for services provided, and in strict accordance with the Price Schedule. Contract monitoring and recordkeeping procedures will be enough to ensure proper payment and allow audit verification that services were provided.

3. Monthly invoices are generated in arrears. Invoices must be submitted through OB10.

Here are the instructions for OB10:: http://www.tungsten-network.com/us/en/veterans-affairs/ . Only after verification are invoices certified for payment.

4. The using service, through the POC, will provide a written statement to the Contracting

Officer to include a summary of Contractor actions and a statement that all requirements of the contract have been fulfilled as agreed. This summary evaluation will be submitted 45 days prior to expiration of contract (and/or prior to election of option year renewals, if applicable). Contractor's employee(s) may not certify bills for payment.

5. FVAHCS Points of Contact (POC): Ryan Weiser, 701-239-3700 x 3209 and Ladine Cruff, 701-239-3700 x 93209

12. QUALITY ASSURANCE MONITORING

a. Contractor shall have in place and maintain a Quality Control Program related to the Mobile

MRI services covered under this contract. As issues arise with QA testing (ACR) American College of Radiology. the contractor would be responsible for any replacement or fixing of equipment needed to maintain routine operation. Contractor would be responsible for Physics Acceptance Testing prior to use on Veterans.

Contractor would be responsible for loading scanning protocols on the MRI scanner for the

FVAHCS.

13. PROHIBITION OF CONTRACT PERFORMANCE OUTSIDE THE U.S.

The entire performance of the contract shall be within the borders of the United States of America, the District of Columbia and/or Puerto Rico. The Contractor shall not access any VA data/information (for example, by remote computer access) from locations that are outside the above-stated borders. Furthermore, the Contractor shall not send, transfer, mail or otherwise transmit any VA data/information to locations outside the above-stated borders.

14. REQUIRED REGISTRATION WITH CONTRACTOR PERFORMANCE

ASSESSMENT SYSTEM (CPARS)

a. As prescribed in Federal Acquisition Regulation (FAR) Part 42.15, the Department of Veterans Affairs (VA) evaluates contractor past performance on all contracts that exceed the thresholds outlined in FAR Part 42.15 and shares those evaluations with other Federal Government contract specialists and procurement officials through the Past Performance Information Retrieval System (PPIRS). The FAR requires that the contractor be provided an opportunity to comment on past performance evaluations prior to the posting of each report. To fulfill this requirement VA uses an online database, the Contractor Performance Assessment Reporting System (CPARS). The CPARS database information is uploaded to the Past Performance Information Retrieval System (PPIRS) database, which is available to all Federal agencies.

b. Each contractor whose contract award is estimated to exceed the thresholds outlined in FAR Part

42.15 is required to provide to the contracting officer contact information for the contractor’s representative with their response to the solicitation. The contractor is responsible to notify the contracting officer of any change to the contractor’s representative during the contract performance period. Contractor’s representative contact information consists of a name and email address.

c. The Government will register the contract within thirty days after contract award. For contracts with a period of one year or less, the contracting officer will perform a single evaluation when the contract is complete. For contracts exceeding one year, the contracting officer will evaluate the contractor’s performance annually. Intermediate reports will be filed each year until the last year of the contract, when the final report will be completed. Each report shall be forwarded in CPARS to the contractor’s designated representative for comment. The contractor’s representative will have thirty days to submit any comments and return the report to the VA contracting officer.

Failure by the contractor to respond within those thirty days will result in the Government’s evaluation being placed on file in PPIRS without contractor’s comments.

15. PAYMENT

Contractor’s employees must be present at the VA facility and must be performing the required services for the period specified within the contract.

The VA agrees to reimburse the contractor for services performed, minus any deductions, paid monthly, in arrears, upon receipt of a properly prepared invoice submitted by the contractor.

Payments made by the VA under this contract shall constitute the total cost of services provided by the contractor. The contractor hereby agrees; that in no event, shall contractor bill, charge, collect a deposit from, seek compensation, remuneration, or reimbursement from, or have any recourse against the beneficiary, the beneficiary’s family, private insurer, Medicare or any other entity acting on the beneficiary’s behalf, for services provided pursuant to this contract. Billings rendered by the contractor to the VA for services furnished a VA beneficiary under the terms of this contract shall be billings in full. This provision shall survive the termination or ending of the contract. Lease payments will not begin until VA can utilize trailer.

CONTRACT SECURITY REQUIREMENTS

1. GENERAL

Contractors, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Failure to comply with the contractor security requirements may result in termination of the contract for default.

Contractor Responsibilities It is imperative for the contractor to provide, at the request of VA, a listing of contractor personnel performing services under the contract for review by VA personnel. The information will include name (first, middle, last) social security number; date of birth; city, state, and country of birth.

The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract, and at the request of the VA, submit another employee for consideration.

A contractor/subcontractor shall request logical (technical) or physical access to VA information regarding connectivity, i.e.: IP address, AE title and Port for Worklist and Storage of MRI exams.

a. Automated record system. Contractor will utilize computers that are consistent with VA requirements and upgrade its computers if instructed to do so by VA in order to ensure compatibility with the VA system.

b. In performing this contract, contractor shall be considered a part of VA for purposes of 5 U.S.C. §552a, 38 U.S.C. §§5701 and 7332. Contractor's employees and agents may have access to patient medical records and general files to the extent necessary to perform this contract.

Notwithstanding any other provision of this contract, contractor and/or its employees may not disclose information contained in general files and patient records and or other individually identified patient information, including information and records generated by the contractor in performance of this contract, except pursuant to explicit instructions from the VA. For the purposes of this paragraph, instruction to disclose may be provided by these officials only: Contracting Officer, Contracting Officer Technical Advisor, the Release of Information supervisor, or VA attorneys.

c. Access to data will be limited to the minimum necessary for performance of the contract. Contractor will take steps to ensure that access is limited to those employees who need access to the data to perform the contract. Contractor will not copy information contained in their system, either by printing to paper or by copying to another digital format, without the express permission of one of the officials listed in paragraph (b), above, except as is necessary to make single copies in the ordinary course of providing patient care. Contractor will not commingle the data from the system with information from other sources. Contractor shall report any unauthorized disclosure of VA information to the officials listed in paragraph (b).

d. Certain information available from the database and other records created by the contractor under this Contract are medical quality assurance records protected by 38 U.S.C. §5705; it’s implementing regulations at 38 U.S.C. §§17.500-511; and VHA Directive 98-016,4.b.(1)(d), 4.6(2)(c) and 4.6(4).

These records may be disclosed only as authorized by 38 U.S.C. §5705 and the VA regulations.

Disclosure of these records in violation of §5705 is a criminal offense under 38 U.S.C. §5705(e).

e. Contractor shall follow all VA policies regarding the retention of records. In the alternative, contractor may deliver the records to VA for retention.

f. Any changes in the law or regulations governing the information covered by this contract during the term of this contract shall be deemed to be incorporated into this contract. Contractor shall educate its employees and subcontractors, if any, of the requirements of this section and shall advise its employees and subcontractors, if any, of any changes as they occur. On contractor's request, VA will provide trainers who can educate contractor's employees and subcontractors, if any, of their obligations under this section.

g. Contractor shall make its internal policies and practices regarding the safeguarding of medical and/or electronic information available to federal agencies with enforcement authority over the maintenance of those records upon request.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227- 14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements.

VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures follow VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor while performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the contract or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be enough grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the POC.

4. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the POC and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach.

Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the

Security Incident Investigation section above. Upon such notification, VA must secure from a non- Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data considering the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (Made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis; the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

NARA Records Management Language for Contracts (July 10, 2019) https://www.archives.gov/records-mgmt/policy/records-mgmt-language

Records Management Obligations

a) Applicability This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

b) Definitions "Federal record" as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal Fargo VA Health Care System under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that Fargo VA Health Care System or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

http://www.archives.gov/records-mgmt/policy/records-mgmt-language

The term Federal record:

1. Includes Fargo VA Health Care System records.

2. Does not include personal materials.

3. Applies to records created, received, or maintained by Contractors pursuant to their Fargo

VA Health Care System contract.

4. May include deliverables and documentation associated with deliverables.

c) Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a).

These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation. all data created for Government use and delivered to, or falling under the legal control of, the

Records Management Language for Contracts Records Officer FVAHCS:

Alicia Parker Phone: 701-239-3700, ext. 4590 E-mail: Alicia.Parker2@va.gov

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created during performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law.

Electronic records and associated metadata must be accompanied by enough technical documentation to permit understanding and use of the records and data.

4. Fargo VA Health Care System and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation.

Records may not be removed from the legal custody of Fargo VA Health Care System or destroyed except for in accordance with the provisions of the Fargo VA Health Care System records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to Fargo VA Health Care System. The Fargo VA Health Care System must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle].

The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected.

The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or…