Draft PWS - Quality and Regulatory Support - OAM.docx

B.3 PERFORMANCE WORK STATEMENT

Title: Quality and Regulatory Support for Office of Advanced Manufacturing OAM.

BACKGROUND

The Department of Veterans Affairs (VA) Office of Advanced Manufacturing (OAM), under the Office of Healthcare Innovation and Learning (OHIL), has a requirement for medical device regulatory and strategic guidance on development and creation of patient specific medical devices to support the delivery of health care within Veterans Health Administration (VHA) hospitals.

SCOPE OF WORK

OAM develops medical devices within VHA and requires support from a capable partner with deep experience in regulated medical device development, particularly involving patient specific designs and additive manufacturing. Additionally, the contract includes provisions for supporting OAM capabilities via services provided.

Provide guidance to the VA leadership team responsible for scaling up a quality management system (QMS) appropriate for a distributed advanced manufacturing approach, in some cases in collaboration with Department of Defense (DoD) and advanced manufacturing OEMs.

Work closely with FDA collaborators to ensure registration of Point of Care (PoC) advanced manufacturing facilities are completed properly with patient safety as utmost importance.

Write, edit, and/or collaborate on any regulatory submissions to the Food and Drug Administration (FDA) for medical devices either transitioning from industry to PoC manufacturing or initiated at the PoC facilities of the VA/DoD network.

Participate in stage gate reviews with an eye towards regulatory submission needs and requirements including review labelling, review instructions for use and control product release authorization.

Analyze field events to determine reportable events and train VHA staff to do regulatory review of change orders.

Assist in strategic program development for more than 90 VA sites with advanced manufacturing capabilities. This includes advising on the development of standard operating procedures (SOPs) and work instructions for items made via advanced manufacturing techniques across the sites, constructing risk analysis matrices for items made using advanced manufacturing techniques, and managing program activities between all involved stakeholders at Central Office, across Veterans Health Administration (VHA), industry partners and other government agencies, including FDA, DoD, and the National Institutes of Health (NIH).

Collaborate with VHA staff to build a world-class workforce training for PoC advanced manufacturing in collaboration with other leading hospital systems, standards organizations, and advanced manufacturing OEMs.

Collaborate with industry partners by communicating the VHA guiding principles and mission at industry meetings.

Regulatory advice on meeting FDA and other governing body requirements for 3D printed medical device manufacturing within VHA through implementation of a quality management system meeting FDA cGMP compliance, stated in 21 CFR 820.

Development of business cases for potential medical devices built using advanced manufacturing processes considered for regulatory clearance by FDA.

Guidance on design and development of medical devices, including ensuring design for manufacturability, drawing on a foundational background in mechanical engineering.

Sharing knowledge of FDA regulatory considerations with respect to medical devices including Additive Manufacturing/ advanced manufacturing considerations through customized reports centered on VHA activities.

Support the VHA team in any FDA inspections or other regulatory audits.

CONTRACT TYPE

This is a Firm Fixed Price Contract.

PERIOD OF PERFORMANCE

The period of performance is:

Base: 06/01/2024 – 05/31/2025 Option Period 1: 06/01/2025 – 05/31/2026 Option Period 2: 06/01/2026 – 05/31/2027 Option Period 3: 06/01/2027 – 05/31/2028 Option Period 4: 06/01/2028 – 05/31/2029

PLACE OF PERFORMANCE

The performance of this work statement will primarily take place at the contractor facility. Occasional travel to government facilities will be necessary for completion of tasks.

Extended stay at government facilities may be necessary in performance of tasks including, but not limited to:

· Implementation of a quality management system across VHA facilities

· In collaboration with VHA staff and FDA, develop PoC competencies for sites engaged in medical device manufacturing.

· Increase impact of advanced manufacturing by facilitating production of Class 1,2 and/or 3 medical devices within VHA.

TRAVEL

The Government anticipates travel under this effort. Travel must be pre-approved in writing by the Contracting Officer’s Representative (COR) and in accordance with Federal Travel Regulations. Each Contractor invoice must include copies of all receipts that support the travel costs claimed in the invoice. Local travel within a 50-mile radius from the contractor’s facility is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the Contractor’s facility are authorized for reimbursement on a case-by-case basis and must be pre-approved by the COR and must be planned and executed according to Federal Travel Regulations. General and Administrative expenses will not be reimbursed.

The FTR can be referenced at:

http://www.gsa.gov/portal/ext/public/site/FTR/file/FTRTOC.html/category/21865/hostUri/portal

TASK STATEMENT

Tasks performed shall be of a non-personal nature. VA organizations will not provide supervision of contractor personnel. Contractor personnel shall at no time allow an employer-employee relationship to develop with VA organizations or their staff. VA organizations will refrain from any activities that create the appearance of such a relationship.

Contractors shall not perform inherently governmental functions including: decision-making, supervision of Government employees, supervision of other contractors on other contracts, and activities that create the appearance of performing such functions.

7.1 Kick off Meeting

The contractor shall work with the COR to set a date and time for a kickoff meeting to occur within 2 weeks of the contract start date. The contractor shall provide an agenda to VA before the meeting that will lead to a discussion about how the contractor will fulfill each base requirement and discuss start dates for staff. The VA will discuss staff onboarding, requirements for equipment configuration, and additional services.

REPORTING REQUIREMENTS

The contractor shall provide the COR with monthly progress reports in electronic form using Microsoft Word or Microsoft Excel. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect progress as of the last day of the preceding month. The report shall be delivered by the 7th day of each month during the contract period. Before starting work on a task, the contractor shall provide a written scope of work including objectives, expected outcomes, detailed protocol, and breakdown of who is doing what work and where. Work on this task should not start until VA approval of the scope of work. Additionally, the contractor shall provide project updates in meetings scheduled on a quarterly basis or on a schedule agreed to by all parties.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the previous month’s approved Monthly Progress Report and report any deviations. It is expected that the Contractor shall maintain communication with VA so that any arising issues are transparent to both parties to prevent escalation of outstanding issues.

In addition, the monthly progress report shall include details of all tasks completed and results of the work for the following:

TASK AREA: IMPLEMENTATION OF A QUALITY MANAGEMENT SYSTEM FOR MEDICAL DEVICE DEVELOPMENT AND MANUFACTURING ACROSS VHA HOSPITALS -CLIN0002 – CLIN0006

Task: Provide guidance and facilitate leading the VA team responsible for maintaining and scaling up a quality management system (QMS) appropriate for a distributed manufacturing approach, in some cases in collaboration with DoD and 3D printing OEMs. CLIN0002, CLIN0003, CLIN0004, CLIN0005 The Contractor shall work with VA staff, DoD staff, and VA Industry Collaborators to ensure successful maintenance of existing VA QMS documents and integration of new QMS documents with the QMS system at Walter Reed Medical Center (DoD) as appropriate. The Contractor shall serve as an unbiased third party to delineate pros and cons of different strategies for QMS integration between the systems.

The Contractor shall also review existing (SOPs, WI’s, Component Specs, etc.), make suggestions on improvements to document management, and help write future (SOPs) that will translate to higher quality products for Service Members and Veterans.

The Contractor shall perform internal audits per established internal audit program per released Internal Audit SOP biannually. Internal audits must cover each clause of 21CFR820 at least annually. Determine if revision to internal audit SOP is appropriate and recommend updates to the SOP. Internal Audits include both analysis of gaps between SOP’s and the QS regulation and gaps between SOP’s/Work Instructions and records documenting, via objective evidence, the extent that QMS activities are performed to SOP’s/work instructions.

If requested by VHA, the contractor shall perform internal audits per established internal audit program per released Internal Audit SOP biannually for newly established OAM registered sites.

The Contractor shall provide regulatory review of Field Experience Reports (complaints) to determine if complaint is reportable per 21CFR803. These activities may require travel to VHA hospitals for site visits, and/or virtual visits.

The Contractor shall work with VA staff to develop an expanded access strategy and SOP for implementing strategy.

The Contractor shall ensure that quality system SOP’s meet 21 CFR 820 requirements for quality system regulation, drawing on experience from working at FDA previously. The Contractor shall communicate with FDA as needed to ensure compliance. As the FDA adopts the requirement for ISO13485 standards during the contract, the Contractor shall provide recommendations on incorporation.

Travel may be required to provide support for this task.

Deliverables:

Task: Work closely with FDA collaborators to ensure registration of Point of Care (PoC) printing facilities are completed properly with patient safety as utmost importance. CLIN0006 The Contractor shall regularly track any FDA recommendations and amendments to recommendations regarding PoC manufacturing, which may include travel to working group meetings, conferences, and other activities hosted by or on behalf of the FDA on the topic of additive manufacturing/ 3D printing. The Contractor shall synthesize this information in written form and ensure that existing FDA-registered VHA hospitals continue to meet the requirements as laid out by FDA.

Deliverables:

Task: Rapid Response and Stand Alone Regulatory Assessments. CLIN0007 and CLIN0008 [CLIN 0007A&B] Contractor shall provide rapid response regulatory assessments on projects/products that the VHA may choose to produce internally to determine preliminary regulatory pathway in PoC environment. VHA to provide information on project/product to base the assessment on. VHA has identified a current need for six Rapid Response assessments, which are included in the base. Optional Rapid Response assessments are for the case that the PoC device environment grows faster than anticipated. Options would be exercised tranches of six assessments at a time if needed by VHA.

Rapid response regulatory assessments shall include:

· Does the proposed device appear to meet the definition of regulatory device.

· Preliminary Risk Classification.

[CLIN 0008A&B] Contractor shall provide Stand Alone regulatory assessment reports on projects of interest to VHA advising on FDA regulatory pathway and estimate of regulatory lift. VHA has identified a current need for two Stand Alone assessments, which are included in the base. Optional Stand Alone assessments are for the case that the PoC device environment grows faster than anticipated. Options will be exercised in tranches of two assessments at a time if needed by VHA.

Reports shall include:

· Recommendation on regulatory pathway(s),

· Applicable guidance documents and standards,

· Possible comparative/predicate devices as available, and

· Key testing considerations including human clinical trials.

· Include references to information the regulatory assessment is based on.

Travel may be required to provide support for this task.

Deliverables:

(Options ordered in tranche of 2).

TASK AREA: CONSULTING SUPPORT TO INCREASE ADVANCED MANUFACTURING CAPABILITIES WITHIN THE VHA OFFICE OF ADVANCED MANUFACTURING (OAM) HUB SITES AND EXPAND THE NUMBER OF VETERANS WHO RECEIVE POINT OF CARE ADVANCED MANUFACTURED HEALTHCARE SOLUTIONS ACROSS THE VHA ENTERPRISE. CLIN 0009 Task: Facilitate the successful installation of new advanced manufacturing technologies (including 3D printers) to expand PoC manufacturing capabilities within the OAM hub sites. CLIN0009 The Contractor shall support OAM staff in upgrading advanced manufacturing technology as well as adopting new equipment.

This support shall encompass pre-installation planning and site-preparation activities, machine installation qualification, and machine performance optimization in support of medical products under the purview of VHA OAM.

The Contractor shall work closely with OAM engineers, VHA facilities management staff, corresponding staff at Walter Reed involved in the JIF project, and external original equipment manufacturer (OEM) staff to ensure seamless planning, installation, and adoption of these technologies.

The contractor shall comment on feasibility of layout with respect to site preparation guidelines from OEMs, communicate directly with engineering and construction staff to explain site preparation guidelines in layman’s terms to maximize successful communication, create and maintain projected timelines, and anticipated any barriers/risks.

The Contractor shall provide recommendations to mitigate risks that might prevent successful technology development within the determined timelines. Reports may also include virtual and/or physical site visits to registered and non-registered sites at VHA and potential industry partners.

Travel may be required to provide support for this task.

Deliverables:

Task 4.2.2 Increase impact of point of care advanced manufacturing by facilitating production of Class 1,2 and/or 3 medical devices within VHA. CLIN0010 and CLIN0011 In collaboration with VHA staff and other contracted OAM team staff, the Contractor shall help develop the strategy for PoC medical device design and development in VHA, ensuring that the OAM mission guides all activities. This shall require the Contractor to regularly attend design review, risk analysis, and gate review meetings, and interact with a wide variety of stakeholders both within and outside of VHA.

The contractor shall be responsible for the regulatory deliverables as part of the 21CFR820.30 product development process (Design Controls). The Contractor is specifically responsible for supporting VHA staff in detailing the cost and advise on navigation of the regulatory pathways, including a list of activities required to take the product through regulatory approval, including any benchtop testing, preclinical testing, clinical trials, and design validation studies required. The Contractor shall participate on project teams as a regulatory representative and contribute to a projected timeline for these activities and provide consultation on costs for each activity.

The Contractor shall contribute to business case analyses by weighing the benefits and return on investment (ROI) of proposed products against the cost and perceived difficulty of gaining regulatory approval.

For devices that the VA selects for Expanded Access approval, the contractor shall provide support on regulatory strategy development. Contractor shall participate in writing and editing regulatory submissions to the FDA and may participate in Face-to-Face meetings with FDA during the development of the device(s).

The Contractor shall also provide consultative support on the design and implementation of in-house testing strategies, as well as recommend whether some testing should be done out of house. The Contractor shall also provide consultative support surrounding any sterilization validation documents needed, including helping to draft sterilization protocols. Finally, the Contractor shall contribute to the writing and editing of any regulatory submissions to the FDA for medical devices.

Travel may be necessary to support this task.

Deliverables:

Task: Assist in strategic program development for more than 90 VHA sites with advanced manufacturing capabilities. CLIN0012 and CLIN0013 The Contractor shall help create best practices for advanced manufacturing of clinically relevant medical devices produced at Point of Care (PoC), to be disseminated across the VHA 3D Printing Network (Network). This includes advising on the development of standard operating procedures (SOPs) and work instructions for items manufactured at PoC using advanced manufacturing techniques across the network, constructing risk analysis matrices for specific families of items, educating VHA employees on FDA thinking on registration and listing requirements for clinicians fabricating for their own patients.

The primary initial deliverable shall include a collection of resources, for the non-device manufacturing professional, that can be shared with the Network. This collection of resources shall include: an overview of the medical device regulatory space, considerations, specific considerations for the different point of care applications (i.e. pre-procedural models, dental, O&P, device accessories, etc.), considerations for ORD projects, and a collection of links to additional regulatory resources.

The Contractor may carry out virtual and/or physical site visits to VA hospitals within the Network, as needed. The Contractor shall help support strategic planning for 3D printing program activities between stakeholders at Central Office, across Veterans Health Administration (VHA), industry partners and other government agencies, including FDA, DoD, NIH, and others. The Contractor may present on behalf of VHA to both internal and external stakeholders, as well as at conferences.

Travel may be required to provide support for this task.

Deliverables:

Task Area: CONSULTING SUPPORT FOR TRAINING AND WORKFORCE DEVELOPMENT FOR PoC advanced manufacturing. CLIN0013 Task: In collaboration with VHA staff and FDA, develop PoC competencies for sites engaged in medical device manufacturing. CLIN0014 The Contractor, or Sub Contractor, shall train staff at OAM sites on the performance of technical roles supporting POC manufacturing and additional responsibilities with the QMS environment, including strategies for performing product development activities inside a formal product development process and on the scope of the quality function. The contractor shall provide additional team training regarding the medical device regulatory space, implementing design controls, and continuous improvement including in person visits to registered and non-registered OAM sites. These activities shall consist of a mix of both in person and virtual training sessions. The occurrence of these training session will be planned with guidance of the VA team and no less than two weeks in advance. The topics to be covered shall include but are not limited to:

· How to write good technical documents

· How to gather customer needs and transform into design inputs

· How to perform process validation

· Medical Device Development skills

· Medical Device Manufacturing Process Development skills

· Project management skills

· Product marketing/clinical engagement skills Travel may be required to provide support for this task.

Deliverables:

Task Area: SUPPORT THE CREATION OF A DISASTER PREPAREDNESS PLAN FOR RAPID DESIGN, TESTING AND PRODUCTION OF MEDICAL SUPPLIES AND DEVICES DURING TIMES OF SUPPLY CHAIN DISRUPTION. CLIN0015 Task: In collaboration with VA staff generate preparedness plan for design, testing, and production of medical supplies and devices during times of supply chain disruption. CLIN0015 In collaboration with VHA staff, support the implementation of MOU 225-23-008 (VA and FDA) “Enabling emergency preparedness and response with distributed manufacturing and digital stockpiles”.

In collaboration with VHA staff, create a regulatory best practice guide for “digital stockpile” for areas of future supply chain vulnerability.

The Contractor shall advise on regulatory considerations for devices made in support of potential disasters or supply chain disruptions, including appropriate testing, documentation, and submission to relevant regulatory agencies.

Contractor shall participate in task force meetings with FDA, DoD, VHA, and outside partners (industry and associations) to develop test cases to demonstrate how a digital stockpile could be implemented and operationalized into physical devices and accepted at Healthcare Facilities.

Disaster preparedness planning shall include a framework for determining which designs should be taken through regulatory clearance during non-crisis operations (in anticipation of future needs) versus which designs should be prepped for potential clearance during disaster regulations.

Disaster preparedness plans shall incorporate an assessment of differences in FDA guidelines during times of crisis versus standard operations, based on knowledge and understanding of FDA decision making processes. The plan shall include assessment of activities (such as testing, documentation, or risk assessments) that may be required for VHA medical device projects during times of crisis, either for submission to the FDA, or to reduce risk of a medical device category or technology that has not been previously considered by the VHA team.

Travel may be required to provide support for this task.

Deliverables:

DELIVERY SCHEDULE

See section 7 for deliverables.

KEY PERSONNEL

Skilled experienced professional and/or technical personnel are essential for successful contractor accomplishment of the work to be performed under this effort. These are defined as individuals crucial to the successful performance of the orders issued and the programs being supported by those orders and are those persons identified as key personnel in accordance with solicitation requirements. The Contractor agrees that the key personnel shall not be removed, diverted, or replaced from work without prior notification of the CO. Contractor staff shall be fully qualified and have the level of experience necessary to accomplish the requirements of this PWS, as well as those requirements outlined in Section 7.0.

Principal Consultant – Regulatory A Principal Consultant – Regulatory shall have 10 or more years of experience in medical device regulatory affairs and be considered an expert navigating regulatory pathways from pre market to post market. They shall have the ability to advise across a broad variety of technologies based on experience with submissions that span investigational device exemption (IDE), premarket approval application (PMA), 510(k), and De Novo regulatory pathways as well as Q-Submissions, and expedited pathways (e.g., Breakthrough Designation Request and SteP programs).

Principal Consultant – Strategic and Product Development A Principal Consultant – Strategic and Product Development shall have 10 or more years of experience in full-cycle product development, project leadership, interdepartmental collaboration, management, and employee development. They shall have expertise in medical device launches in the US market, medical device verification and validation testing, instrumentation design, testing development, manufacturing scale up, production setup, supply chain monitoring, quality system setup, FDA QSR and ISO 13485 implementation, animal study selection and biomechanical cadaveric studies.

Principal Consultant – Advanced Manufacturing and Regulatory Strategy (AMRS) The Principal Consultant – AMRS shall have 10 or more years of experience in medical device design, development, manufacturing, and regulatory affairs. They shall have expertise in medical device and medical instrument design, benchtop testing development to support design control activities, US FDA regulatory submissions (Pre-submission, 510(k), PMA), regulatory strategy, and incorporating additive manufacturing into medical device design controls and FDA QSR and ISO 13485 implementation.

Substitution of Personnel: Any personnel the contractor offers as substitutes shall have the ability and qualifications, including educations and experience, equal to or better than the key personnel whose biography was submitted with the successful proposal. Requests to substitute personnel shall be provided to the CO for review and approval. All notification of substitutions in key personnel shall be submitted to the CO at least 15 calendar days prior to making and change in key personnel, to the maximum extent practicable. The notification shall be in writing and shall provide a detailed explanation of the circumstances necessitating the proposed substitution. The contractor shall submit a complete biography/resume for the proposed substitute, and any other information requested by the CO. The CO will evaluate such requests and promptly notify the contractor of approval or disapproval thereof in writing.

GOVERNMENT- FURNISHED EQUIPMENT/ MATERIALS/ FACILITIES/ INFORMATION

The Government will provide adequate physical work space for up to two contractor personnel and will furnish the following: desk, encrypted laptop, phone, electronic mail (e-mail) account, and use of the Government telephone, facsimile machine, and copier, as required by this task order. The use of contractor equipment in Government facilities must be approved by Program Office.

The contractor shall adhere to all VA security requirements for any VA issued equipment and all contractor personnel that will receive and utilize VA issued laptops shall sign a VA property loan form and all associated documentation prior to receiving the equipment. All VA policies related to networked computer use will apply. Personal identification verification (PIV) cards shall be required for all contractor personnel with VA network access/accounts. Contractor personnel shall complete VA’s Privacy and Information Security Awareness and Rules of Behavior training before networked computer access will be granted.

Prior to the use of any Government-furnished equipment, the Contractor shall complete all mandatory training courses on the VA training site, currently the VA Talent Management System (TMS), and will be tracked therein. The TMS may be accessed at https://www.tms.va.gov. If an individual does not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

The VA laptop computers must comply with all rules/requirements regarding patches and updates and must be returned to VA at the conclusion of the task order.

QUALITY ASSURANCE SURVEILLANCE PLAN

Performance Standards define required performance for specific tasks. The Government performs surveillance to determine if the contractor exceeds, meets, or does not meet these standards.

METHODS OF SURVEILLANCE

Various methods exist to monitor performance. The COR shall use any or several of the surveillance methods listed below in the administration of this QASP.

1. 100% Inspection (evaluates all outcomes) – Each month, the COR shall review all of the contractor’s performance/generated documentation and document results accordingly. This assessment shall be placed in the COR’s QA file.

2. Random Sample – The COR shall review a random sampling of the contractor’s performance/generated documentation and document your results accordingly. This assessment shall be placed in the COR’s QA file.

3. Validated Customer Complaint or Validated Below Average ALP in a Specific Area – Each month, the COR shall review the contractor’s performance/generated documentation corresponding to a validated customer complaint or validated inability to perform in accordance with the ALP in a specific area and document your results accordingly. This assessment shall be placed in the COR’s QA file.

FREQUENCY OF MEASUREMENT

During task order performance, the COR will periodically analyze whether the negotiated frequency of surveillance is appropriate for the work being performed, and at a minimum shall be twice a year.

ACCEPTABLE PERFORMANCE LEVELS (APLS)

Standard Surveillance Method Outcome

DOCUMENTING PERFORMANCE

Acceptable Performance:

The Government shall document acceptable performance in accordance with the chart above. Any report may become a part of the supporting documentation for any contractual action.

Unacceptable Performance:

When unacceptable performance occurs, the COR shall inform the CO. This will always be in writing although when circumstances necessitate immediate verbal communication, that communication will be followed in writing. The COR shall document the discussion and place it in the COR file.

When the CO determines formal written communication is required, the COR shall prepare a Contract Discrepancy Report (CDR), and present it to the contractor's program manager.

The contractor shall acknowledge receipt of the CDR in writing to the CO. The CDR will state how long after receipt the contractor has to take corrective action. The CDR will also specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CO shall review the contractor's corrective action plan to determine acceptability.

Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO.

SECURITY AND PRIVACY REQUIREMENTS

POSITION/TASK RISK DESIGNATION LEVEL(S)

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

a) The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

b) The Contractor shall bear the expense of obtaining background investigations. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the ProPath template. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 7.0 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

c) The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

d) The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1. For a Tier 1/Low Risk designation:

0. OF-306

0. DVA Memorandum – Electronic Fingerprints

1. For Tier 2/Moderate or Tier 4/High Risk designation:

1. OF-306

1. VA Form 0710

1. DVA Memorandum – Electronic Fingerprints

The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via eQIP).

e) The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

f) A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) finger print results, training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and, the signed “Contractor Rules of Behavior.” However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

g) The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

Physical Security and Safety Requirements

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

a. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

b. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

c. Smoking is prohibited inside/outside any building other than the designated smoking areas.

d. Possession of weapons is prohibited.

e. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

Confidentiality and Non-Disclosure

0. The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

0. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

0. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

0. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA CO.

0. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

0. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

0. Contractor must adhere to the following:

1) The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

2) Controlled access to system and security software and documentation.

3) Recording, monitoring, and control of passwords and privileges.

4) All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

5) VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

6) Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

7) Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

8) Contractor does not require access to classified data.

0. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

0. VA Form 0752, Confidentiality of Sensitive Information Non-Disclosure Agreement, shall be completed by all Contractor employees that receive Government furnished laptops, and shall be provided to the CO before any work is performed. In the case that Contractor personnel are replaced in the future, their replacements shall complete VA Form 0752 prior to beginning work.

APPLICABLE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE (per VA HANDBOOK 6500.6, APPENDIX C, MARCH 12, 2010)

GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c.