Draft Performance Work Statement Johnson Controls Metasys System VA Sierra Nevada Health Care System.pdf

Johnson Controls Metasys Services for VA Southern Nevada Health Care System (VASNHCS)

Performance Work Statement

1. SCOPE OF WORK: Only Johnson Controls (JCI) or JCI authorized contractors shall furnish and conduct weekly servicing, maintaining, programming, and commissioning of the Building Management System (BMS). The JCI Metasys system monitors, communicates, and controls critical equipment and components, to include Life Safety equipment, for the VA hospital. Contractor must be experienced and certified to work on this critical system during normal hospital hours as well as to immediately resolve any system issues that may occur. In addition, contractor will provide data points or checklists on a weekly basis. This data will be provided to the Energy Plant supervisor or designee. Contractor shall provide all labor, tools, supervision, and equipment necessary to complete this service contract. Parts needed for repairs will be purchased using Government Purchase Card (GPC) or by using a separate contract. COR approval is required before any repairs begin. All associated equipment is located in VA Hospital Bldg. #1, #5 & #6, Fisher house Bldg #7, and Central Energy Plant facilities; Bldg. #2, #3 & #4 at the Veteran’s Hospital on 6900 North Pecos, North Las Vegas, Nevada, 89086.

2. SPECIFIC REQUIREMENTS:

Building Management System (BMS) Johnson Controls Metasys System – Provide service, maintenance, and training to the BMS Johnson Controls Metasys system. Contractor must have service experience with Johnson Controls Metasys system and related equipment. Technicians must carry a Senior or Master Level Technician Title to work with the sensitive electronic components and software programs. Computer equipment or software used must be compatible with Johnson Control system to prevent excessive programming or equipment reconfiguration. In addition, contractor must provide equipment/system points listing and a schedule to service, test and calibrate these equipment/system points. For critical equipment or surgical system components, contract must coordinate system schedule and substitute materials during testing and calibration processes to prevent critical system interruptions.

Contractor must have local access to JCI factory authorized parts the VA hospital currently utilizes.

These parts will have standard warranty to ensure quality products are replaced or installed.

Furthermore, contractor must provide 24-hour technical support for VA employees to be notified in case of emergencies and after duty hour service upon request. Contractor must respond within 2 hours of initial service calls and work on trouble call requests within 4 hours. Lastly, the contractor should possess JCI Factory Training Certification or equivalent to instruct the following course to VA technicians working on the Metasys system. The following components and system checks require training to VA maintenance employees.

- Commissioning FEC System and Programming FEC System with CCT Tree

- Commission and Troubleshoot Metasys Extended Architecture

Technician Support: Contractor will supply the VA Southern Nevada Healthcare System with a technician for (20) standard working days per month. A standard workday includes 8 hours of labor, during normal working hours. Normal working hours are 7:00 am to 4:00 pm Monday through Friday, excluding holidays. Under general supervision, contractor will conduct preventive maintenance and general servicing of the Metasys system. Contractor will monitor VA mechanical technicians on building automation activities and complete required documentation.

Metasys Preventive Maintenance to be performed by contractor to conduct tasks to ensure proper operation and sequences are being followed will include:

- Verify Sequences of operation

- Check alarms and coordinate corrective actions with VA representatives

- Perform all standard back-ups

- Uploads on server

- Minor updates to BMS graphics

Additional Items Included:

- Create and provide a complete equipment/system point list

- Contractor and VA representatives will develop a calibration schedule at the start of the contract, prioritizing critical areas to ensure minimal downtime. Scheduling and procedures will also be established for these critical areas. If after-hours access is required, the difference in overtime will be deducted from the block hours for outside services.

- Provide annual Metasys software Subscription and perform upgrades to the system as they become available.

- Provide comprehensive operator training for ten (10) VA employees on an annual basis.

Training shall be performed by a factory certified instructor in a formal classroom environment.

Temp, Humidity & Room Pressure Calibration Verification:

- Bi-Annual Verification of Calibration of 17 Temp & Humidity sensors

- Verification of Calibration of 17 Room Pressure Monitors

- All work to be performed off hours

- Certified TAB Report

The following are the room numbers and names. Each room has 1 temp/humidity and 1 pressure sensors, totaling 34 sensors to be verified and calibrated.

3D386 Operating Room 1 3D382 Operating Room 2 3D436 Operating Room 3 3D430 Operating Room 4 3D417 Operating Room 5 3D411 Operating Room 6 3D395 Operating Room 7 3D392 Operating Room 8 1A149 Oncology ante room 1A149A Oncology haz room 1A149B Oncology non-haz room 1G133 Temp pharmacy 1G135 Temp pharmacy 1D352A Pharmacy IV room

1D352B Pharmacy ante room 1D352C Pharmacy non-haz room 1D352D Pharmacy haz room

3. HOURS OF WORK AND SCHEDULING: Work shall be scheduled accordingly with the Plant

Supervisor during normal hours (Monday to Friday, from 7:00am to 4pm). Work in Building #2 Central Energy Plant and the VA Hospital after duty hours will be coordinated with the Energy Plant Utility Operators after 4pm daily, 7 days a week. The contact number for the Energy Plant Utility Operators is

(702) 791-9000 ext. 16900. An operator is on duty 24 hours a day, 7 days a week.

Place of Performance:

Department of Veteran Affairs Medical Center 6900 North Pecos Road North Las Vegas, NV 89086

4. QUALIFICATIONS: All work for the duration of the contract shall be performed by qualified, certified, and licensed personnel on the system. The Contractor must maintain a service organization within a 50-mile radius from the Veteran’s Hospital.

5. CONFIRMATION OF REPAIR WORK: All services will be confirmed and approved by the Energy Plant Supervisor or his/her designee. When service is completed, the certified technician must indicate on the service ticket the equipment serviced, specific action taken, and all parts replaced. The equipment serviced must be identified clearly by name, serial number, and location.

6. COMPLIANCE: The contractor shall be fully responsible for compliance with all VA, local, state, and

Federal environmental/occupational safety laws, rules, and regulations. The contractor shall follow life and safety codes and take necessary actions to avoid conditions that may be hazardous to the health and safety of hospital personnel and patients. The contractor is responsible for meeting all applicable OSHA and VA guidelines for safe working processes; example: lock-out/tag-out. All work for the duration of the contract shall be performed by certified trained technicians.

7. CONTRACTOR EMPLOYEES: The Contractor shall assign a Point of Contact (POC) for the purpose of ensuring compliance with all provisions of this contract. The Contractor POC shall be available on site and can address performance issues. All employees should be able to read and speak English.

The parties agree that Contractor personnel working under this contract shall not be considered VA employees for any purpose and shall be considered employees of the Contractor. All Contractor personnel assigned to the performance of this contract shall wear a Contractor-provided uniform or ID that clearly identifies the individual as a Contractor. All Contractor personnel are required to wear identification (I.D.) badges during the entire time they are on the VA Healthcare System grounds. I.D.

badges must have picture identification, name of the individual, and the represented company depicted on it.

Contractor personnel shall present a neat appearance and be easily recognized as contractor employees.

Example: wearing distinctive clothing such as uniform, badges, patches, etc. Contractor personnel should not wear sandals, flip-flop style footwear, or open-toe shoes and should follow VA dress guidelines. A copy of this will be provided upon request.

The Contractor will ensure that the staff assigned shall be cognizant of the VA’s sexual harassment and drug-free workplace policies. The Contractor may obtain a copy of this information from the COR or Contracting Officer.

8. ESCORT AND VETERAN’S HOSPITAL SECURITY POLICE CHECK-IN: All contractor personnel working onsite at the VA facility shall check in and out with VA Police dispatch located in the Administrative building #6 south entrance. Access to work areas, and performance monitoring, will be provided by VA Engineering Service personnel. After-hours work will be monitored by VA Central Energy Plant Operators, 702-791-9000 Ext 16900. In all cases, the VA Central Energy Plant Operator shall be notified of any changes which may affect the response time of vital equipment.

9. AUTHORIZED SERVICE: Only those services specified within are authorized under this contract.

Before permitting any service or repairs of a non-contract nature, the Contracting Officer must be advised of the reasons for this additional work. The Contractor is cautioned that only the Contracting Officer or his/her designee may authorize additional service or repairs that are outside of the scope of this contract and that reimbursement shall not be made unless prior authorization is obtained.

10. TEST EQUIPMENT: The VA shall not furnish parts and/or test equipment for the performance of this contract. It is the responsibility of the contractor to have/bring the appropriate equipment and/or supplies necessary to complete the work.

11. CONTRACTING OFFICER REPRESENTATIVE (COR): The Contractor shall not accept any instructions issued by any other person(s) other than the Contracting Officer. The Government may appoint a COR. If so, a Delegation of Authority letter shall be forwarded to the using service and the Contractor after the contract has been signed, identifying the individual(s) as the COR(s).

12. CHANGES: The Contractor is advised that only the Contracting Officer, acting within the scope of the contract has the authority to make changes which affect the contract in terms of quality, quantity, price, or delivery. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change shall be considered to have been made without authority and no adjustment shall be made in the contract price to cover any increase in costs incurred as a result thereof.

13. PERSONNEL REQUIREMENTS: The Government reserves the right to accept or reject Contractor’s staff for the rendering of services. Complaints concerning Contract Personnel performance or conduct shall be dealt with by the Contractor, and/or the COR with the final decision made by the Contracting Officer.

14. PERSONNEL QUALIFICATIONS/EXPERIENCE CRITERIA: Contractor personnel shall have the following qualifications, but not limited to:

The contractor shall provide a Lead Technician to oversee all contract personnel with documented experience implementing large scale projects equal to, or greater than, the scope of this project.

15. CONTRACTOR’S RESPONSIBILITIES: The Contractor shall maintain personal liability and property damage insurance prescribed by the laws of the Federal Government. He/she shall take all precautions necessary to protect persons and property from injury or damage during the performance of this contract. He/she shall be responsible for any injury to himself/herself, his/her employees, or others, as well as for any damage to personal or public property that occurs during the performance of this contract that is caused by him/her or his/her employees’ fault or negligence. Contractor shall comply with all VA safety standards, manufacturers/industry standards, FDA, OSHA, JCAHO, and the latest edition of NFPA-99.

16. CONTRACTOR SUBMITTALS/INSURANCE REQUIREMENTS: The Contractor is required to comply with Federal and State Workers Compensation and liability insurance (Reference FAR clause 52.228-5-Insurance and Subpart 28.307-2-Liability). The Government shall be held harmless against any or all loss, cost, damage, claim expense or liability whatsoever, because of accident or injury to persons or property of others occurring in the performance of this contract. The Contractor shall be responsible for all damages to property, which may be done by him/her, or any employee engaged in the performance of this contract.

The parties agree that the Contractor’s personnel working as a result of this contract shall not be considered VA employees for any purpose and shall be considered employees of the Contractor. The Contractor shall be responsible for providing:

a. Workers Compensation.

b. Professional liability insurance.

c. Health examinations.

d. Income tax withholding, and,

e. Social Security payments.

17. SMOKING POLICY: Smoking is not permitted within or around the VA, except in designated areas.

18. SAFETY AND FIRE PREVENTION: In the performance of this contract, the Contractor shall take such safety precautions as necessary to protect the lives and health of the occupants of the building. Fire and safety deficiencies, which exist and are part of the responsibility of the Contractor, shall be immediately corrected. If the Contractor fails or refuses to correct deficiencies promptly, the COR may issue an order stopping all, or any part, of the work. The Contractor shall comply with applicable Federal, State, and local safety and fire regulations and codes, which are in effect during the performance period of the contract. The Contractor personnel shall follow applicable facility policies concerning fire/disaster programs.

19. VA POLICY: Possession of weapons is prohibited. Enclosed containers, including tool kits, are subject to search. Violations of VA regulations may result in citations answerable in the United States (Federal) District Court.

20. BADGES AND PARKING: It is the responsibility of Contractor personnel to park only in designated parking areas. Parking information is available from the VA Police. The VA will not validate or make reimbursement for parking violations of the Contractor’s personnel under any circumstances.

21. HOURS OF SERVICES: The Contractor shall perform the onsite services Monday through Friday except for National Holidays (see below) between the hours of 7:30am to 4pm.

22. OVERTIME AND HOLIDAYS: Any overtime and/or holiday pay that the Contractor’s employees may be entitled to, shall be the sole responsibility of the Contractor and shall not be billed to or reimbursed by the Government.

23. NATIONAL HOLIDAYS

The contractor is not required to provide service on the following National holidays, nor will the Contractor be paid for these holidays. The following national holidays are observed by the Federal Government:

New Year’s Day 1 January Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May Juneteenth 19 June Independence Day 4 July Labor Day First Monday in September Columbus Day Second Monday in October Veterans Day 11 November Thanksgiving Day 4th Thursday in November Christmas Day 25 December

If any of the identified holidays fall on a Saturday, the preceding Friday will be observed. If any of the identified holidays fall on a Sunday, the following Monday will be observed.

24. PAYMENTS: Payments will be made in arrears upon receipt of an invoice prepared in accordance with FAR 52.212-4. Invoices should be electronically submitted at the OB10 website (http://www.ob10.com).

For OB10 system registration please call 877-752-0900, chose option #2, and use promotion code VAPC7Y18. This makes the service free to VA vendors.

25. RECORD MANAGEMENT: Contractor will ensure Record(s) Management compliance with all the applicable records management laws and regulations in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1.

26. SECURITY REQUIREMENTS: UNCLASSIFED INFORMATION/TECHNOLOGY SECURITY

RESOURCES

http://www.ob10.com/ http://www.ob10.com/ http://www.ob10.com/

a. The contractor and their personnel shall be subject to the same Federal laws, regulations, standards and

VA polices as VA personnel, regarding information and information system security. These include, but are not limited to, Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130, and guidance and standards, available from the Department of Commerce’s National Institute of Standards and Technology (NIST). This also includes the use of common security configuration available from NIST’s Web site at: http://checklists.nist.gov.

b. To ensure that appropriate security controls are in place, contractors must follow the procedures set forth in “VA Information and Information System Security/Privacy Requirements for IT Contractors” located at the following site: http://www.iprm.oit.va.gov.

c. These provisions shall apply to all contracts in which VA sensitive information is stored, generated, transmitted, or exchanged by VA, a contractor, subcontractor or a third-party, or on behalf of any of these entities regardless of format or whether it resides on a VA system or contractor/subcontractor’s electronic information system(s) operating for or on the VA behalf.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. The contractor or subcontractor must notify the COR immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The COR must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

http://checklists.nist.gov/ http://checklists.nist.gov/ http://www.iprm.oit.va.gov/ http://www.iprm.oit.va.gov/

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements.

VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor while performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the COR within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/ subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. In accordance with 45 CFR 164.502(e), the Privacy Rule includes exceptions to the Business

Associate Standard. This requirement meets the exception and does not require a Business

Associate agreement in order for Covered Entity to disclose Protected Healthcare Information to the contractor for treatment.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. The records created in accordance with this contract belong to the VASNHS and should be returned to the VASNHS and/or destroyed in accordance with VHA RCS 10-1. Destruction should only occur with advance notice and guidance from the Records Management Officer at the VASNHS.

Records shall be safeguarded in accordance with the Privacy Act, Health Insurance Portability and Accountability Act (HIPAA) and the VASNHS Release of Information Unit. Patient Medical information is considered privileged and shall not be disclosed or revealed in any way without prior written permission from the VA Chief, Health Information Management Section.

k. The Contractor shall only release medical information obtained during the course of this contract to those VA staff members involved in the necessary management and treatment of that individual patient. Patient list and name of patients are considered privileged information and shall not be disclosed or revealed in any way for use outside the Contractor without prior written permission from the referring VA Chief of Staff. Veterans requesting copies of medical information generated by the contractor will be referred to the VASNHS Release of Information Unit.

l. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/ subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VASNHS Release of Information Unit for response.

m. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/ subcontractor shall immediately refer such court orders or other requests to the VASNHS Release of Information Unit for response.

n. All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per 6500.1requirements. This must be completed within 30 days of termination of the contract.

The C&A requirements do not apply, and that a Security Accreditation Package is not required.

Ensure that a Contractor Security Control Assessment (CSCA) is completed within 30 days of contract approval and yearly on the renewal date of the contract.

Ensure that the CSCA is sent to the ISO and the OCS Certification Program Office for review to ensure that appropriate security controls are being implemented in service contracts.

Ensure a copy of the CSCA is maintained in the Security Management and Reporting Tool (SMART) database. COR will provide a copy of the completed CSCA to ISO for uploading into SMART database.

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA):

Contractor shall take reasonable measures to ensure patient privacy and confidentiality. The contractor agrees to take all reasonable precautions to safeguard patient information from unauthorized access or modification, in both electronic and hard-copy formats. This includes not only electronic security measures such as “strong” user passwords on computer systems, but also physical barriers to prevent unauthorized use of computer work-stations; that hard copy patient files are in secured lockable areas, that files are in lockable cabinets, that the cabinets can in fact be locked, i.e., keys are available, and the locking mechanisms work properly. This precaution also includes the proper transfer of patient information via electronic means, such as faxing or system to system transmission.

That only the minimum necessary patient information is used to provide appropriate service to the correct patient.

That the undersigned understands that all parties are bound by the requirements of the “Health Insurance Portability and Accountability Act of 1996” which provide guidance on the protection of patient privacy and confidentiality. This Act mandates that all government agencies, and those bodies with whom they contract, must be in compliance with the directives of the Act.

SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/ subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach.

Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non- Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy

Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

a. Notification;

b. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

c. Data breach analysis;

d. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

e. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

f. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day’s notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

TRAINING

Contractor/subcontractor employees requiring access to VA information shall complete privacy training annually as required for covered entities under the HIPAA.

The COR shall ensure employees complete training within 1 week of the initiation of the contract and annually thereafter, as required.

Failure to complete the mandatory annual training annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

RECORDS MANAGEMENT

Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. Chapters. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C.

552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of

1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

In accordance with 36 CFR 1222.32, the contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

The VA Southern Nevada Healthcare System (VASNHS) and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of VASNHS or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity.

Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.

In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, the contractor must report to VASNHS. The agency must report promptly to NARA in accordance with 36 CFR 1230.

The contractor shall immediately notify the appropriate Contracting Officer (CO) upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment.

Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract documents. The contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to VASNHS control or the contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the CO or address prescribed in the contract documents. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

The contractor is required to obtain the CO's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The contractor (and any sub-contractor) is required to abide by Government and VASNHS guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

The contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with VASNHS policy.

The contractor shall not create or maintain any records containing any non-public VASNHS information that are not specifically tied to or authorized by the contract.

The contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the FOIA.

VASNHS owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which VASNHS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

Training. All contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take VHA-provided records management training. The contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

Flowdown of requirements to Subcontractors:

The contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract document, and require written subcontractor acknowledgment of same.

Violation by a subcontractor of any provision set forth in this clause will be attributed to the contractor.

VHA Supplemental Contract Requirements for Ensuring Adequate COVID-19 Safety Protocols for Federal Contractors statement inclusion to Statement of Work (SOW).

1. Contractor employees who work in or travel to VHA locations must comply with the following:

a. Documentation requirements:

1) If fully vaccinated, shall show proof of vaccination

i. NOTE: Acceptable proof of vaccination includes a signed record of immunization from a health care provider or pharmacy, a copy of the COVID-19 Vaccination Record Card (CDC Form MLS- 319813_r, published on September 3, 2020), or a copy of medical records documenting the vaccination

2) If unvaccinated and granted a medical or religious exception, shall show negative COVID-19 test results dated within three calendar days prior to desired entry date. Test must be approved by the Food and Drug Administration (FDA) for emergency use or full approval. This includes tests available by a doctor’s order or an FDA approved overthe-counter test.

3) Documentation cited in this section shall be digitally or physically maintained on each contractor employee while in a VA facility and is subject to inspection prior to entry to VA facilities and after entry for spot inspections by Contracting Officer Representatives (CORs) or other hospital personnel.

4) Documentation will not be collected by the VA; contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

2. Contractor employees are subject to daily screening for COVID-19 and may be denied entry to

VA facilities if they fail to pass screening protocols. As part of the screening process contractors may be asked screening questions found on the following website: COVID-19 Screening Tool.

Regularly check the website for updates.

a. Contractor employees who work away from VA locations, but who will have direct patient contact with VA patients shall self-screen utilizing the COVID-19 Screening Tool, in advance each day that they will have direct patient contact and in accordance with their person or persons who coordinate COVID-19 workplace safety efforts at covered contractor workplaces. Contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

3. Contractor must immediately notify their COR or Contracting Officer if contract performance is jeopardized due to contractor employees being denied entry into VA Facilities.”

4. For indefinite delivery contracts: Contractor agrees to comply with FAR 52.232-99 and VHA

Supplemental Contract Requirements for any task or delivery orders issued prior to this modification when performance has already commenced.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.va.gov%2Fcovid19screen%2F&data=04%7C01%7C%7C180e5dd7385a45f5f9d008d98dcf9308%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637696745073428839%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9a3zmolR1Sj4C1v8xtjiDkzvloPNAQzZz3%2FoySde%2FB0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.va.gov%2Fcovid19screen%2F&data=04%7C01%7C%7C180e5dd7385a45f5f9d008d98dcf9308%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637696745073428839%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9a3zmolR1Sj4C1v8xtjiDkzvloPNAQzZz3%2FoySde%2FB0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.va.gov%2Fcovid19screen%2F&data=04%7C01%7C%7C180e5dd7385a45f5f9d008d98dcf9308%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637696745073428839%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9a3zmolR1Sj4C1v8xtjiDkzvloPNAQzZz3%2FoySde%2FB0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.va.gov%2Fcovid19screen%2F&data=04%7C01%7C%7C180e5dd7385a45f5f9d008d98dcf9308%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637696745073428839%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9a3zmolR1Sj4C1v8xtjiDkzvloPNAQzZz3%2FoySde%2FB0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.va.gov%2Fcovid19screen%2F&data=04%7C01%7C%7C180e5dd7385a45f5f9d008d98dcf9308%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637696745073428839%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9a3zmolR1Sj4C1v8xtjiDkzvloPNAQzZz3%2FoySde%2FB0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.va.gov%2Fcovid19screen%2F&data=04%7C01%7C%7C180e5dd7385a45f5f9d008d98dcf9308%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637696745073428839%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9a3zmolR1Sj4C1v8xtjiDkzvloPNAQzZz3%2FoySde%2FB0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.va.gov%2Fcovid19screen%2F&data=04%7C01%7C%7C180e5dd7385a45f5f9d008d98dcf9308%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637696745073428839%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9a3zmolR1Sj4C1v8xtjiDkzvloPNAQzZz3%2FoySde%2FB0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.va.gov%2Fcovid19screen%2F&data=04%7C01%7C%7C180e5dd7385a45f5f9d008d98dcf9308%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637696745073428839%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9a3zmolR1Sj4C1v8xtjiDkzvloPNAQzZz3%2FoySde%2FB0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.va.gov%2Fcovid19screen%2F&data=04%7C01%7C%7C180e5dd7385a45f5f9d008d98dcf9308%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637696745073428839%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9a3zmolR1Sj4C1v8xtjiDkzvloPNAQzZz3%2FoySde%2FB0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.va.gov%2Fcovid19screen%2F&data=04%7C01%7C%7C180e5dd7385a45f5f9d008d98dcf9308%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637696745073428839%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9a3zmolR1Sj4C1v8xtjiDkzvloPNAQzZz3%2FoySde%2FB0%3D&reserved=0