Description of Services.pdf

Description of Services

Contractor shall furnish services related to the use of the University of Nevada, Reno Institutional Review Board (UNR IRB)

1.1 GENERAL: The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.2 Background: The VA Sierra Nevada Health Care System (VASNHCS) provides healthcare services for the area Veteran population. One of the charges of the VA is to promote Research and Development (RD) dedicated to improving the health and lives of Veterans.

This Performance Work Statement (PWS) is to conduct work in accordance with the following Memorandums of Understanding (MOU) between VASNHCS and the UNR IRB.

Specific responsibilities of both institutions are further detailed in the MOU attached to this document.

Federal Law mandates the Reno VA Medical Center (VAMC), Reno NV use an IRB, but the VAMC does not have resources to adequately support our own IRB and therefore, need these services from our affiliate, UNR.

The IRB process is based on rules and regulations for federally funded research, primarily the provisions of Protection of Human Subjects in the Code of Federal Regulations (45 CFR 46), and supporting materials such as the Belmont Report. The UNR IRB strives to create on campus a culture of respect for, and awareness of, the rights and welfare of human research participants, while advancing knowledge and facilitating the highest quality research.

Research is a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. Activities which meet this definition constitute research for purposes of this policy, if they are conducted or supported under a program which is considered research for other purposes.

1.3 Contractor Qualifications: The UNR IRB shall meet the following qualifications, capabilities and be able to document the following:

a. Must have an accreditation with the Association for the Accreditation of Human

Research Protection Program (AAHRP)

b. Expert knowledge and expertise in human research oversight. THIS IS A CRITICAL

REQUIREMENT

c. Must maintain Federal wide Assurance Number

1.4 General Scope: UNR IRB will provide content expertise in oversight of Human Research Protection Program (HRPP).

1.5 Period of Performance: The period of performance shall be fore one (1) Base Year of 12 months and four (4) 12-month option years.

1.6 Task/Requirements: UNR IRB will provide labor, materials, and consultation services in accordance with the IRB MOU to the VASNHCS.

1.7 Place of Performance: The performance of this work shall be at the UNR, which shall meet the qualifications listed in this PWS.

1.8 Government Furnished Equipment: VASNHCS will not furnish any government equipment. Certification and Accreditation requirements do not apply, and that a Security Accreditation Package is not required.

1.9 Deliverables: The UNR IRB will provide services in accordance with the IRB MOU to the VASNHCS. In addition, the UNR IRB will provide quarterly IRB trainings four times annually in either an in-person or virtual format. This contract will also support cost associated with email correspondence and ad hoc meetings between UNR IRB and VASNHCS staff.

1.10 Recognized Holidays: UNR IRB will not be required to perform services on these holidays.

New Year’s Day Labor Day Juneteenth Columbus Day President’s Day Independence Day Memorial Day Thanksgiving Day Martin Luther King Jr’s Birthday Christmas Day Veteran’s Day

1.11 Hours of Operations: The contractor is responsible for conducting business, between the hours of 07:30am – 04:00pm (work day) Monday thru Friday (work week) except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reason. The Contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.12 Confidentiality and Non-Disclosure: The contractor will have access to sensitive or confidential information during this contract. Disclosure of sensitive and/or confidential information will include access to sensitive and HIPAA protected information including, but not limited to, microbiology data, and directly identifiable fields including names.

1.13 Information and Information Security Requirements: Contract clause for Information and Information Technology Security:

a. Due to the threat of data breach, compromise or loss of information that resides on either

VA-owned or contractor-owned systems, and to comply with Federal laws and regulations, VA has developed an Information and Information Technology Security clause to be used when VA sensitive information is accessed, used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media).

b. The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

1.14 VA Information Custody:

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook

6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

h. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

i. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

j. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

k. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

1.15 Security Incident Investigation:

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

1.16 Liquidated Damages For Data Breach:

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including: (a) date of occurrence; (b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons)

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

1.17 Security Controls Compliance Testing:

a. On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day’s notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

1.18 Training:

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

1.19 Travel: Contractor will travel periodically to the VASNHCS

1.20 Contract Administration: Notwithstanding the Contractor’s responsibility for total management during the performance of this contract, the administration of the contract will require maximum coordination between the Government and the Contractor. The following individuals will be the Government’s points of contact during the performance of this contract:

Contracting Officer’s Representative (COR) Jared Ovitt, MPH Administration Officer/Research VA Sierra Nevada Health Care System Jared.ovitt@va.gov Phone: (775) 326-2793 The COR shall be designated on the authority of the Contracting Officer (KO) at the time of contract award to monitor all technical aspects of the contract. In no event is the COR empowered to change any of the terms and conditions of the contract. Changes in any section of this contract shall be made only by the KO pursuant to a properly executed modification. The types of actions within the purview of the COR’s authority are to ensure that the Contractor performs the technical requirements of the contract, and to notify both the Contractor and the KO of any deficiencies observed. A memorandum of designation shall be issue to the COR and a copy shall be sent to the Contractor at the time of contract award setting forth in full the responsibilities and limitations of the COR.

1.21 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulations Subpart 42.5. The KO, COR and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor’s performance. At these meetings the KO will apprise the contractor of how the government views the contractor’s performance and the contractor will apprise the government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

Definitions & Acronyms

2. DEFINITIONS:

2.1.1 Contractor. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2 Contracting Officer (KO). A person with authority to enter into, administer, and/or terminate contracts, and make related determinations and findings on behalf of the government.

Note: The only individual who can legally bind the government.

2.1.3 Contracting Officer’s Representative (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4 Deliverable. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.5 Human Research Protection Program (HRPP). HRPP is a comprehensive system to ensure the protection of human subjects participating in research. The HRPP consists of a variety of individuals and committees such as: the medical center Director, Associate Chief of Staff (ACOS) for Research and Development (R&D), the Administrative Officer (AO) for R&D, compliance officers, etc., the R&D Committee, the Institutional Review Board (IRB), other committees or subcommittees addressing human subjects protection (e.g., Biosafety, Radiation Safety, Radioactive Drug Research, Conflict of Interest), investigators, IRB staff, research staff, health and safety staff (e.g., Biosafety Officer, Radiation Safety Officer), and research pharmacy staff. The objective of this system is to assist the institution in meeting ethical principles and regulatory requirements for the protection of human subjects in research.

2.1.6 Institutional Review Board (IRB). An IRB is a board, committee, or other group formally designated by an institution to review, approve, require modification, disapprove, and conduct continuing oversight of human subject research in accordance with 38 CFR part 16 and other applicable regulations.

2.1.7 Memorandum of Understanding (MOU). A MOU is a written agreement between two VA medical facilities or between a VA medical facility and a non-VA institution documenting their relationship and defining their respective roles and responsibilities within that relationship.

2.1.8 Research. A systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. Activities which meet this definition constitute research for purposes of this policy, if they are conducted or supported under a program which is considered research for other purposes.

2.1.9 Subcontractor. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.10 Work Day. The number of hours per day the Contractor provides services in accordance with the contract.

1.21.11Work Week. Monday through Friday, unless specified otherwise.

3. ACRONYMS:

AAHRPP Association for the Accreditation of Human Research Protection Program CFR Code of Federal Regulations COR Contracting Officer Representative HIPAA Health Insurance Portability and Accountability Act HRPP Human Research Protection Program IRB Institutional Review Board KO Contracting Officer MOU Memorandum of Understanding POC Point of Contact PWS Performance Work Statement RD Research and Development UNR University of Nevada, Reno UNR IRB University of Nevada, Reno Institutional Review Board VAMC VA Medical Center VASNHCS VA Sierra Nevada Health Care System