DRAFT PWS.docx

B.3 PERFORMANCE WORK STATEMENT

1. SCOPE

1.1. The Contractor shall provide maintenance, clinical and technical support, project management, and ongoing sustainment for the existing (or upgraded systems) as part of the Veteran Integrated Services Network (VISN) 21 Philips Picture Archiving and Communication System (PACS) Enterprise. The support shall include furnishing all necessary hardware, software, licensing, professional and installation services, and upgrades required to maintain the VISN 21 PACS at a 99.99% uptime. The PACS system covers all facilities in VISN 21: San Francisco, Palo Alto, Mather, Reno, Fresno, Honolulu, Sacramento, Las Vegas, and Manila (see item 22 for locations and addresses). VISN 21 has over 6.5 million PACS studies with an annual volume of over 600,000 studies.

1.2. The Contractor shall provide an Enterprise-wide viewer that is a browser-based medical image and information management system that provides one (1) click to offer full resolution, diagnostic-quality images on demand, directly to the point of patient care to all standard Personal Computers (PCs) anywhere across the VA enterprise. The Contractor must provide unlimited viewing licenses for enterprise-wide viewer application. The Contractor must work with the Veteran Affairs (VA) to keep the software approved for use with Office of Information and Technology (OI&T) baselined computers and systems via the Technical Reference Model.

1.3. The Contractor shall provide a Diagnostic Radiology Client that is an advanced radiology diagnostic application that provides a comprehensive, full-resolution diagnostic presentation of current and prior procedures and associated clinical information. The radiology client shall include functionality, including but not limited to multi-planar, maximum intensity projection and basic three-dimensional rendering capabilities. The Contractor must provide unlimited viewing licenses for Diagnostic Radiology Client application.

1.4. The Contractor shall also provide a single database and PACS storage for all sites (except Manila which will have its own separate system) that is an always-online digital medical image storage system that supports millions of studies per year and thousands of concurrent Enterprise-wide viewers and Diagnostic Radiology clients across multiple sites. In addition, the Contractor shall provide database and PACS storage provides a common storage/archive for VISN 21 Cardiology PACS images. The Contractor must provide an unlimited number of modality connections to the Contractor provided PACS solution. The PACS system shall have a local cache for processing exams and an additional backup solution (PICS) if main repository is offline (for all locations listed in section 22). Both the local cache, and disaster recovery system shall each hold one (1) years’ worth of studies (minimum per site), and the system shall not use near-line (optical storage) or off-line storage.

2. DEFINITIONS AND ACRONYMS

2.1. Acceptance Signature – VA employee who indicates FSE demonstrated service conclusion/status and user has accepted work as complete/pending as stated in ESR.

2.2. Authorization Signature – COR’s signature; indicates COR accepts work status as stated in ESR.

2.3. Biomedical Engineering - Supervisor or designee

2.4. CDRH – Center for Devices and Radiological Health

2.5. CO – Contracting Officer

2.6. COR – Contracting Officer’s Representative

2.7. Contractor Customer Service Representative – anyone who is authorized to respond to customer outage situations including, without limitation, third parties who are authorized by the Contractor to respond to customer service tasks

2.8. ESR – Contractor Engineering Service Report. Documentation of the services rendered for each incidence of work performance under the terms and conditions of the contract.

2.9. External Downtime – all time that the server cannot be accessed by all authorized users beyond the Single Point of Demarcation (SPOD) due to causes beyond the Contractor’s reasonable control and occurring without its fault or negligence, including, without limitation, war, strikes, fires, floods, governmental restrictions, power failures or surges, disruptions in telephone service or manual shutdowns by Customer.

2.10. FSE – Field Service Engineer is a person who is authorized by the contractor to perform maintenance (corrective and/or preventive) services.

2.11. NFPA – National Fire Protection Association

2.12. OEM – Original Equipment Manufacturer.

2.13. PM – Preventive Maintenance Inspection. Services which are periodic in nature and are required to maintain the equipment in such condition that it may be operated in accordance with its intended design and functional capacity with minimal incidence of malfunction or operative conditions.

2.14. Scheduled Downtime – all time that the server cannot be accessed by all authorized users beyond the SPOD due to scheduled maintenance including, but not limited to, preventative maintenance, updates, upgrades, scheduled reboots, and restarts. The Contractor will work with the Customer to determine a mutually agreeable time for Scheduled Downtime; however, the Contractor as the sole discretion in determining the final timing of Scheduled Downtime. The Contractor shall provide at least twenty-four (24) hours advance notice of Scheduled Downtime.

2.15. SPOD – Standard Point of Demarcation meaning the network connection interface installed at the server computer hardware.

2.16. Unscheduled Downtime – all time that the server cannot be accessed by all authorized users beyond the SPOD that is not Scheduled Downtime or External Downtime, the cause of which originates on the Contractor’s side of the SPOD. Measurement of Unscheduled Downtime begins when Customer’s authorized representative notifies a Contractor Customer Service Representative of the existence of Unscheduled Downtime and the Contractor Customer Service Representative issues and logs a trouble ticket.

3. PACS CONTRACT PRICE INCLUSIONS

3.1. Contract Line-Item Number (CLIN) Structure

3.1.1. PACS Support

3.1.2. Mammography support

3.1.3. Common storage/archive for VISN 21 Cardiology PACS images

3.1.4. Contractor’s user group or offsite classroom training

3.1.4.1. Optional CLIN for one (1) additional class

3.1.5. Contractor Onsite training

3.1.5.1. Optional CLIN for one (1) additional week

3.2. Deliverables

3.2.1. Contractor Project Management Plan

3.2.2. Contractor’s Quality Control Program

3.2.3. Quarterly downtime report

3.2.4. Annual inventory of all equipment

3.2.5. Annual report of all studies broken out by site, modality, institution or other specified by Contractor Officer’s Representative (COR)

3.2.6. Annual training credit report with current training credits for training covered in Section 4

3.2.7. Library and access to all clinical and technical documentation

3.2.8. Annual hardware report for all locations. Report should include storage and compute resources available and list all hardware related issues for the last year. Hardware resources for ingest Digital Imaging and Communications in Medicine Modality (DICOM) processors shall be broken out by the following types:

3.2.8.1. Base Radiology Exams

3.2.8.2. Mammography Exams

3.2.8.3. Cardiology Storage and Archive

3.2.9. Annual report showing remote location cache and PICS storage for available storage (GB), number of studies stored, and also number of years of studies currently stored.

3.3. Web Distribution and Remote Viewing

3.3.1. Web distribution through Enterprise-wide viewer (chronological timeline with reports, status, and presentation states available from standard PCs).

3.3.2. Unlimited # of one click to offer full fidelity full resolution users for Enterprise-wide viewer.

3.3.3. Unlimited view rate for all studies with Enterprise-wide viewer or Diagnostic Radiology Client.

3.3.4. Unlimited Concurrent users on Enterprise-wide viewer.

3.3.5. There is no separate web server, everyone gets one click full resolution (no loss compressed or key images).

3.3.6. Unlimited clinical workstation licenses

3.3.7. Unlimited (QA)/Quality Control (QC) workstation licenses

3.3.8. Unlimited peer review functionality via a plugin to main application that allows peer review of radiologist following American College of Radiology (ACR) standards

3.3.9. CD Burning (studies, reports, presentation states, help menu and viewing software).

3.3.10. Unlimited study access without additional fee

3.4. Integration and Customization

3.4.1. Application Programming Interface (API integration toolkit included for 3rd party Contractors.

3.4.2. Integration to Powerscribe 360 or Powerscribe One voice recognition.

3.4.3. Integration to Customers current and future electronic medical record systems (VISTA and Federal EHR - Oracle Health).

3.4.4. Integration to PACSHealth dose reporting system.

3.4.5. Integration to TeraRecon Eureka and Titanium post processing systems.

3.4.6. Integration to Veterans Health Administration (VHA)/VISN 21 image exchange system.

3.4.7. Health Level Seven International (HL7) Radiological Information System (RIS) integration through Imaging Suite – (Rhapsody).

3.4.8. Technologist Worklist that provides reconciliation of metadata by technologists on PCs.

3.4.9. DICOM (Digital Imaging and Communications in Medicine Modality) Worklist Service Class Provider.

3.5. Software and Hardware Inclusions

3.5.1. The Contractor is responsible for upgrading and maintaining the hardware, software, and any required licensing to guarantee performance. The Contractor is responsible for providing additional hardware, software, and licensing as required to meet guaranteed performance and maintain all studies online within the PACS and VNA. The Contractor shall provide an annual report on hardware.

3.5.2. All Server hardware Enhancements, Updates, Refresh, and Upgrades included

3.5.3. The Contractor must provide VA with all inventory documentation for equipment and network configuration for any hardware additions or subtractions. The Contractor must provide a hardware assessment at the request of the Contracting Officer's Representative (COR) annually if requested.

3.5.4. All like for like software enhancements, updates, and new versions included

3.5.5. All VISN 21 sites are upgraded to the latest version every two (2) years with managed service agreement.

3.5.6. Software for Diagnostic Radiology clients can be loaded on an unlimited number of Workstations utilizing (COTS) Common Off-The-Shelf Hardware. The Contractor shall provide minimum specs to fulfill this statement.

3.5.7. The Contractor shall provide dedicated DICOM processing nodes at all locations to handle VISN 21 Cardiology exams and also mammography exams. Mammography DICOM processors and hardware should have specifications to handle the large file types used for mammography.

3.5.8. The Contractor shall stand up new DICOM processor servers within two (2) weeks of a formal request by COR or designee. If not, this will be counted as downtime.

3.5.9. The Contractor shall allow, or work to approve, installation of VA SMAK toolset and other VA HTM inventory tools onto all applicable equipment.

3.6. Multi-Site Configuration

3.6.1. Support merger of all sites into common Enterprise PACS across the VISN to PACS Storage in Sacramento.

3.6.2. The Contractor shall provide a federated view of all images to provide a comprehensive imaging timeline for a specific patient on the PACS system.

3.6.3. All server-side hardware and software/operating systems shall be supported by the official original equipment manufacturer (OEM) and not at end-of-life/support

3.6.4. The system shall provide a DICOM Modality Worklist for modalities. This worklist can be filtered by site, modality type, and by using other DICOM or user defined method.

3.7. Uptime Performance Guarantee

3.7.1. The uptime performance guarantee is effective upon contract signing.

3.7.2. Uptime Performance Discounts: In the event the Contractor is unable to meet the specified uptime performance guarantee in a particular month, the Contractor shall discount that month’s Service Fee as follows:

Scheduled downtime (agreed upon by COR and Philips) and downtime due to VA will not be included in these calculations.

4. EDUCATION/CLINICAL APPLICATION SUPPORT

4.1. The Contractor shall provide Original Equipment Manufacturer (OEM) approved and validated training to the clinical staff on all components of the PACS and VNA systems and software. All educators shall have current certification from the OEM. The Education shall be provided for any major or minor software release and be scheduled at the request of the clinical staff. Training will not expire during contract terms. The onsite locations are any of the locations listed in section 22. The Training offered by the Contractors will be for Radiologists, Radiology Technicians, Biomedical personnel, and PACS Admins.

4.1.1. Offsite Training: The Contractor shall provide tuition, travel, and lodging for eight (8) PACS Administrators from VISN 21 to attend the Contractor’s user group or classroom training on an annual basis.

4.1.1.1. Additional training will be an optional CLIN

4.1.1.2. Training does not expire

4.1.2. Classroom training:

4.1.2.1. PACS Admin Training Course at Clinical Informatics Learning Services

4.1.2.2. PACS Advanced Admin Training Course at Clinical Informatics Learning Service

4.1.3. Phone support: The Contractor shall provide unlimited user education and training on the PACS software via phone twenty-four seven three hundred sixty-five (24x7x365) days a year.

4.1.4. Onsite training: The Contractor shall provide onsite training for Radiologists and PACS admins on the PACS software on an annual basis. The Contractor will provide a pool of fifteen (15) days of onsite training for VISN 21 to pool from. All costs to include travel will be covered to facilitate onsite training.

4.1.4.1. Additional training will be an optional CLIN.

4.1.4.2. Training does not expire

4.2. Migration Services (Upgrade or Project to in place system)

4.2.1. If required, the contractor will provide migration services for all existing images in the current legacy PACS. This migration will be performed without significant interruption to day-to-day operations. If migration services are stopped for more than one (1) week due to Contractor equipment failures or lack of storage, this will be counted as a downtime for system. This will only include migration services associated with project related activities.

4.3. Conformance Standards

4.3.1. The Contractor shall provide services and material to ensure that the equipment functions in conformance with the latest requirements of NFPA-99, The Joint Commission (TJC), National Electric Code (NEC), Federal and VA information security specifications and requirements as applicable. The equipment shall be maintained such that it meets or exceeds the performance specifications as established in the OEM’s technical specifications. Additional performance specifications that exceed the OEM specifications shall be specified in writing by the VA.

4.4. Preventive Maintenance (PM)

4.4.1. The Contractor shall be responsible to monitor and manage operating system patching and anti-virus updates on all PACS servers. Operating system patches, when approved by Philips, shall be installed as made available from third party Contractors on a monthly schedule unless deemed to be a critical security vulnerability. Anti-virus is updated nightly to include any new virus definitions and product specific updates. Systems will be set up to sync with the VA national time server to ensure that all systems have a common time reference. The Contractor will proactively monitor system health with real-time server status monitoring and will take corrective/preventive action when system performance is outside of normal operating limits. The Contractor will share proactive monitoring results with VA and/or allow VA to install their own tools.

4.5. Performance and Uptime

4.5.1. Contractually guarantee 99.99% monthly uptime with financial penalties.

4.5.2. Long Term Persistent storage in spinning disk on a Redundant Array of Inexpensive Disks or Redundant Array of Independent Disks (RAID) configuration to exceed RAID 5.

4.5.3. On-site hardware support by contractor’s hardware Contractor (OEM).

4.5.4. First image display of ≤ 6 seconds for all imaging studies for study object data in the system.

4.5.5. System Monitoring and four (4) hour onsite guarantee.

4.5.6. Hours for Support

4.5.6.1. Clinical Application Support and Education: Twenty-four (24) hours a day, seven (7) days a week and 365 days a year (24x7x365).

4.5.6.2. Technical Support: Twenty-four (24) hours a day, seven (7) days a week and 365 days a year (24x7x365) and have a dedicated help desk for VISN 21 (or VA)

4.5.7. Response Time: Contractor must respond to a phone call within four (4) hours for any call. For emergency technical support issues, Contractor must provide immediate technical support.

5. EMERGENCY MAINTENANCE

5.1. Will be provided Twenty-four (24) hours a day, seven (7) days a week and 365 days a year (24x7x365).

6. DISASTER RECOVERY

6.1. Offsite Disaster Recovery at dedicated VA disaster recovery system

6.1.1. Real-time backup of image files

6.1.2. Continuous log files are updated

6.1.3. Twice daily incremental backup of Data Base (DB)

6.1.4. Weekly full backup DB

6.1.5. Enterprise Philips PACS back up the database, reports, and images for fast rebuilding of DB in the event of disaster.

6.1.6. Application Service Provider (ASP) and Capital pricing includes tape backup at remote site

6.1.7. ASP and Capital pricing includes onsite database restoration within ninety-six (96) hours of disaster notification for 5TB of data. Remaining data will be restored in coordination with the COR and Philips.

7. HOURS OF COVERAGE

7.1. Active system monitoring with in-house support desk Twenty-four (24) hours a day, seven (7) days a week and 365 days a year (24x7x365). A four (4) hour onsite guarantee for hardware repair/replacement. All service/updates will be performed during normal hours of coverage unless requested or approved by Facility POC designee.

8. PARTS

8.1. All parts for maintenance, repair, and sustainment of the PACS will be provided by the Contractor. The Contractor has ready access to all OEM parts, including unique and/or high mortality replacement parts. All parts supplied shall be from the OEM. All parts shall perform identically to the OEM specifications and not invalidate the Food and Drug Administration (FDA) certification.

9. SOFTWARE AND HARDWARE INCLUSIONS

9.1. The Contractor is responsible for upgrading and maintaining hardware to guarantee performance. All system/application software, enhancements, updates, and new versions included for both client and server.

10. SERVICE MANUALS

10.1. The VA shall not provide service manuals or service diagnostic software to the Contractor for use in providing services under this contract. The Contractor shall obtain, have on file, and make available to its FSE’s all operational and technical documentation, (such as: operational and service manuals, schematics, and parts list), which are necessary to meet the performance requirements of this contract. The location and listing of the service data manuals, by name, and/or the manuals themselves shall be provided to the COR upon request.

11. DOCUMENTATION AND REPORTS

11.1. The documentation will include equipment downtime and detailed descriptions of the scheduled and unscheduled maintenance procedures performed, including replaced parts and prices (for outside normal working hour services) required to maintain the equipment in accordance with conformance standards. Such documentation shall meet the guidelines as set forth in the Conformance Standards. In addition, each ESR must at a minimum document the following data legibly and in complete detail:

11.1.1. Name of Contractor

11.1.2. Name of FSE who performed services

11.1.3. Contractor Service ESR Number/Log Number

11.1.4. Date, Time (starting and ending), Hours-On-Site for service call

11.1.5. VA Purchase Order Number(s) (if any) covers the call, if outside normal working hours.

11.1.6. Description of Problem Reported by COR/User.

11.1.7. Identification of Equipment to be serviced to include the following: Equipment ID # or EE# from the bar-code, Manufacturer's Name, Device Name, Model #, Serial #, and any other Manufacturer's identification numbers.

11.1.8. Itemized Description of Service(s) Performed (including Costs associated with after normal working hour services), including Labor and Travel, Parts (with part numbers) and Materials and Circuit Location of problem/corrective action.

11.1.9. Total Cost to be billed.

11.1.10. Signatures from the following:

11.1.10.1 FSE performing services described.

11.1.10.2 VA Employee who witnessed service described.

11.1.11 Equipment downtime, calculated in accordance with Conformance Standards.

NOTE: Any additional charges claimed must be approved by the COR before service is completed.

12. REPORTING REQUIREMENTS

12.1. The Contractor shall report to Biomedical Engineering to “check-in” upon arrival and prior to performance of work under this contract. This check-in is mandatory and can be accomplished in person or by phone contact.

12.2. When the service(s) is/are completed, the FSE shall document the services rendered on a legible ESR(s). The FSE shall check-out with the Biomedical Engineering Department (location to be specified at time of contract award) and submit the ESR(s) to the COR. All ESRs shall be submitted to the equipment user for an “acceptance signature” and to the COR for an “authorization signature.” If the COR is unavailable, a signed accepted copy of the ESR will be sent to the COR within five (5) business days of work completion.

13. ADDITIONAL CHARGES

13.1. There will be no additional charge for time spent at the site during, or after the normal hours of coverage awaiting the arrival of additional FSE and/or delivery of parts.

13.2. Under no circumstances would a study stored on servers within VISN 21 ever be billed/charged more than once, nor would images added to a study result in additional charges, including post-acquisition image processing and additional views.

14. REPORTING REQUIRED SERVICES BEYOND THE CONTRACT SCOPE

14.1. The Contractor shall immediately, but no later than twenty-four (24) consecutive hours after discovery, notify the COR, (in writing), of the existence or the development of any defects, or repairs required to the scheduled equipment which the Contractor considers he/she is not responsible for under the terms of the contract. The Contractor shall furnish to the COR with a written estimate of the cost to make necessary repairs.

15. CONDITION OF EQUIPMENT

15.1. The Contractor accepts responsibility for the equipment in “as is” condition. Failure to inspect the equipment prior to contract award will not relieve the Contractor from performance of the requirements of this contract. All parts of the in place or upgraded system will be covered unless the Contractor explicitly provides a report outlining what is not covered.

16. COMPETENCY OF CONTRACTOR PERSONNEL SERVICING EQUIPMENT

16.1. The Contractor shall have an established business, with an office and full-time staff. The staff includes a “fully qualified” FSE and a “fully qualified” FSE who will serve as the backup.

16.2. “Fully Qualified” is based upon training and on experience in the field. For training, the FSE(s) shall have successfully completed a formalized OEM training program for the PACS system. For field experience, the FSE(s) shall have a minimum of two (2) years of experience, with respect to scheduled and unscheduled preventive and remedial maintenance on equipment identified in Item

16.3. The FSE(s) shall be authorized by the Contractor to perform the maintenance services as required. All work shall be performed by “Fully Qualified” competent FSEs. The Contractor shall provide written assurance of the competency of their personnel and a list of credentials of approved FSEs for each make and model. The CO may authenticate the training requirements, request copies of training certificates or credentials from the contractor at any time for any personnel who are servicing or installing any equipment covered under this contract. The CO and/or the COR specifically reserve the right to reject any of the contractor's personnel and refuse them permission to work on the equipment.

17. TEST EQUIPMENT

17.1. Prior to commencement of work on this contract, the Contractor shall make available if requested a copy of the current calibration certification of all test equipment that is to be used by the Contractor in performing work under the contract. This certification shall also be provided on a periodic basis when requested by the COR. Test equipment calibration shall be traceable to a national standard.

18. IDENTIFICATION, PARKING, SMOKING, CELLULAR PHONE USAGE AND VA REGULATIONS

18.1. The Contractor’s FSE shall always wear visible identification while on the premises of the VA. It is the responsibility of the Contractor to park in the appropriate designated parking areas. Information on parking is available from the VA Police-Security Service. The COR will not invalidate or make reimbursement for parking violations of the contractor under any conditions.

18.2. Smoking is prohibited inside any building at the VA.

18.3. Cellular phones and two-way radios are not to be used within six feet of any medical equipment. Possession of weapons is prohibited.

18.4. Enclosed containers, including tool kits, shall be subject to search.

18.5. Violations of VA regulations may result in a citation answerable in the United States (Federal) District Court, not a local district state, or municipal court.

18.6. Customer Complaints: The Contractor shall notify the COR, in writing, and within twenty-four (24) hours of any complaints made by the customer with regards to the PACS service. The Contractor may provide recommendations for improved services. No recommendations shall be construed as being effective until and unless it is provided in writing by the Contracting Officer.

19. CONTRACTOR’S QUALITY CONTROL PROGRAM (QCP)

19.1. The Contractor shall establish and maintain quality control to ensure all contract requirements are met. The Contractor’s QCP shall include the following or have incorporated into during performance of contract, at a minimum:

19.1.1. The Contractor shall provide monthly downtime report identifying any facilities where the performance benchmark was not met. To be provided as a component of monthly invoice.

19.1.2. The Contractor shall provide an on-line web portal for tracking work orders generated by VISN 21 sites.

19.1.3. The Contractor shall have an on-line twenty-four seven (24x7) proactive monitoring tool that identifies issues with critical system processes. Corrective action shall be taken as a result of a process triggering an alert.

19.1.4. The Contractor shall maintain on-site records identifying the security credentials, certifications and ongoing training of each employee performing services under this contract.

19.1.5. The Contractor shall have methods of identifying and preventing communication breakdowns and provide a detailed procedure for alternative communications in the event of a breakdown of the communication system.

19.1.6. The Contractor shall participate in quarterly scheduled and/or non-scheduled conference calls with the VA representatives to provide a report of on-going operational issues.

20. MAJOR SITE LOCATIONS AND ADDRESSES

20.1. San Francisco VAMC, 4150 Clement Street, San Francisco, CA 94121

20.2. Palo Alto VAMC, 3801 Miranda Ave, Palo Alto, CA 94304

20.3. Mather VAMC, 10535 Hospital Way, Sacramento, CA 95655

20.4. Reno VAMC, 1000 Locust Street, Reno, NV 89502

20.5. Fresno VAMC, 2615 E. Clinton Ave, Fresno, CA 93703

20.6. Honolulu VAMC, 459 Patterson Road, Honolulu, HI 9681

20.7. Sacramento Data Center, 1100 North Market Blvd, Sacramento, CA 95834

20.8. Las Vegas VAMC, 6900 North Pecos Road, N. Las Vegas, NV 89086

20.9. Manila VA Clinic, 1501 Roxas Boulevard, Pasay City, PI 1302

21. SECURITY AND REMOTE ACCESS

21.1. The Contractor shall have and will maintain a VA approved site-to-site Virtual Private Network (VPN) connection for remote service and shall have a Business Associates Agreement on file with VHA. The Contractor shall comply with APPLICABLE clauses in VA Directive 6500.5 and will provide security/privacy training to employees that service VA sites.

22. GENERAL

22.1. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

23. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

23.1. A Contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

23.2. All Contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

23.3. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

23.4. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

23.5. The Contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

24. VA INFORMATION CUSTODIAL LANGUAGE

24.1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

24.2. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

24.3. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

24.4. The Contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

24.5. The Contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

24.6. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

24.7. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

24.8. The Contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

24.8.1. The Contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

24.8.2. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

24.8.3. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

24.8.4. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

25. SECURITY INCIDENT INVESTIGATION

25.1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

25.2. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

25.3. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

25.4. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

26. LIQUIDATED DAMAGES FOR DATA BREACH

26.1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

26.2. The Contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

26.3. Each risk analysis shall address all relevant information concerning the data breach, including the following:

26.3.1. Nature of the event (loss, theft, unauthorized access);

26.3.2. Description of the event, including:

26.3.2.1. date of occurrence;

26.3.2.2. data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

26.3.2.3. Number of individuals affected or potentially affected;

26.3.2.4. Names of individuals or groups affected or potentially affected;

26.3.2.5. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

26.3.2.6. Amount of time the data has been out of VA control;

26.3.2.7. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

26.3.2.8. Known misuses of data containing sensitive personal information, if any;

26.3.2.9. Assessment of the potential harm to the affected individuals;

26.3.2.10. Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

26.3.2.11. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

26.4. Based on the determinations of the independent risk analysis; the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

26.4.1. Notification;

26.4.2. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

26.4.3. Data breach analysis;

26.4.4. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

26.4.5. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

26.4.6. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

27. TRAINING

27.1. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

27.1.1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

27.1.2. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

27.1.3. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

27.1.4. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

27.2. The Contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

27.3. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

(END OF PERFORMANCE WORK STATEMENT)