Draft PWS VACHS Pharmaceutical Reverse Distribution 1 Nov 2022.docx

TABLE OF CONTENT

1. BACKGROUND 3

2. SCOPE 3

3. GENERAL 3

4. AWARDS 3

5. ESTIMATED ANNUAL REQUIREMENTS 4

6. REGULATORY COMPLIANCE 4

7. LICENSES, PERMITS, REGISTRATION, INSURANCE 4

8. CONTRACTOR AND SUBCONTRACTOR LICENSE QUALIFICATIONS REQUIREMENTS 5

9. SHIPPING/PROCESSING ARRANGEMENTS 5

10. PHARMACEUTICALS QUALIFYING FOR MANUFACTURER’S RETURN 5

11. PHARMACEUTICALS INELIGIBLE FOR CREDIT FROM MANUFACTURER 6

12. PAYMENTS 6

13. WEB-BASED TRACKING OF CREDITS 7

14. IMPLAMANTATION PLAN 7

15. CONTINGENCY PLAN 7

16. REPORTS 7

17. DASHBOARD REPORTING REQUIREMENT 9

18. TRAINING REQUIREMENTS 10

19. CONTRACT ADMINISTRATION AUTHORITY 10

20. FEDERAL GOVERNMENT HOLIDAYS 11

21. PHARMACEUTICAL PRIME VENDOR 11

22. REVERSE DISTRIBUTION PROGRAM ELIGIBLE FACILTIES 11

23. QUALITY ASSURANCE PLAN MATRIX 12

24. VA INFORMATION AND INFORMATION SYSTEM SECURITY 14

1. BACKGROUND

Since, the national contract was ended by VA in October 2020, the VA Caribbean Healthcare System, VACHS, have been processing its damaged, expired, or unused drugs (except controlled drugs) with quarterly purchase card orders. They also have processed non-controlled drugs with Clean Harbors through its contract with the Environmental Regulatory Section and the controlled drugs with Pharma Link through purchase card orders. Since, the national contract with Pharma Logistics was ended by VA in October 2020 and there is not a current national contract in place, the VACHS is requiring a firm-fixed price contract for processing its damaged, expired, or unused drugs at the Inpatient & Outpatient pharmacies in San Juan and the pharmacies in Ponce Outpatient Clinic (POPC) and Mayaguez Outpatient Clinic (MOPC).

2. SCOPE

The purpose of this solicitation is to establish a fixed-price contract for the VACHS with a reverse distributor with destruction capability, hereafter referred to as the Contractor, capable of achieving maximum credit return and in processing any related pharmaceutical waste that may arise out of non-returnable pharmaceuticals.

3. GENERAL

The Government need for on-site and off-site processing function is imperative to assure optimum inventory control and to minimize the violation of laws and regulations. The contractor shall be compliant with all applicable regulations related to non-hazardous and hazardous waste and controlled substances handling.

It is the intent that an efficient returns processing method where expired pharmaceuticals shipped to a centralized reverse distributor will reduce total costs in the health care system through a system of inventory controls and report analytics, while maintaining all necessary internal controls to ensure accuracy throughout the entire process. The Government will require a Contractor that can supply inventory scanning software as a service for use by the site and the vendor so a report can be generated to identify and address any item and its box location for any discrepancies so identified discrepancies can be addressed prior to expired inventory leaving the site. The Government will also require the Contractor to be the returns depot for current Prime Vendor so complete direct data from Prime Vendor can be generated with invoices so the site can review all credits provided with actual credit recovery, not estimated return value. Returns to be processed will cover expired pharmaceuticals and pharmaceuticals due to be expire within 120 days from authorized facilities approved to participate in the VA’s Pharmaceutical Prime Vendor (PPV) program. The contractor may not hold any expired pharmaceuticals identified as greater than 120 days from expiration and must immediately destroy identified product. The Government will also require a fee for service payment model to ensure the contractor is paid for services provided, and independent of the total amount of credit value achieved to avoid previous and current regulatory violations identified during current ongoing investigations.

4. AWARDS

The Government requires a one-year base period with a potential five-year period of performance. The Government will make this award based on Technical Capability and ability to address current issues identified by regulatory bodies, Past Performance, and Price. The proposed reverse distribution service fee shall be a firm fixed fee per site visit and priced according to class of trade and frequency of site visit. The firm fixed site visit service fee should cover all the contractor’s costs including, but not limited to, packaging, shipping, processing, software as a service application, waste disposal, and any other applicable costs or fees incurred in performance of reverse distribution and waste disposal services. Award will be made base year and option year one through four. To be considered for award, offerors are required to submit a proposal for all line items inside and outside the Customs Territory of the United States for the base year and each of the four option years. Proposals that fail to include fees for the base year and each of the four option years for all line items will be rejected and will receive no further consideration.

5. ESTIMATED ANNUAL REQUIREMENTS

VACHS estimated pharmaceutical expired returns for 2018 to 2020 averaged $1,011,330.00 annually. (2021 is not estimated due to non-contract service). The Government guarantees that it will order a minimum of 4 annual site visits from this solicitation. The total ceiling for this procurement will be a total of 16 site visits, inclusive of the base year, all four option years and the 6-month option to extend.

6. REGULATORY COMPLIANCE

The Contractor shall be required to provide all plant, materials, and labor needed to process credit return and/or arrange for proper disposal of designated pharmaceuticals, including Schedule II-V controlled substances for the Customs Territory of the United States. Schedule II-V returns are not permitted from outside the Customs Territory of the United States. Contractor shall be responsible for complying with all applicable federal regulations such as the Code of Federal Regulation (CFR) Title 21 Food & Drugs, Title 29 Hazardous Materials, Title 40 Protection of the Environment, Title 49 Department of Transportation; U.S. Environmental Protection Agency (EPA), Occupational Safety and Health Administration (OSHA), Food and Drug Administration (FDA), Drug Enforcement Administration (DEA), 41 U.S.C. chapter 67, Service Contract Labor Standards and VA regulations. The Contractor shall also comply with applicable state/local regulations and consult with regional offices of the federal regulatory agencies that have jurisdiction over their operations to ensure compliance with laws and regulations of host countries. Accordingly, the Contractor shall arrange for, recommend, and/or advise the returning drug distribution point of the proper means of transporting the returned products to the Contractor's central processing facility.

7. LICENSES, PERMITS, REGISTRATION, INSURANCE

All necessary permits and licenses required by Federal, state, and local authorities shall be acquired and maintained by the Contractor for the life of the contract. This includes required licenses, certifications, etc. for individual contractor staff as well as any required permits and licenses for interstate transport, and storage/disposal of hazardous and non-hazardous unserviceable and non-returnable items or returns. This includes but is not limited to DEA, DOT, EPA, FDA, OSHA and individual State regulations.

The Contractor shall be a licensed DEA registrant to handle Schedule II - V controlled substances. A copy of all renewals shall be forwarded to the contracting officer for retention in the contract file. The Contractor shall have proper insurance coverage, including environmental remediation if awarded a contract. A copy of such insurance coverage shall be provided to the Contracting Officer, upon request.

8. CONTRACTOR AND SUBCONTRACTOR LICENSE QUALIFICATIONS REQUIREMENTS

The Contractor and any respective subcontractors shall maintain all necessary licenses, permits and certifications required by the Resource Conservation and Recovery Act, Clean Air Act, Clean Water Act, Occupational Safety and Health Administration, and all licenses and permits required by local agencies for reverse distribution operations. All vehicles shall have proper State and Federal Department of Transportation (DOT) licenses required for the transportation of hazardous wastes for each jurisdiction in which they will be operating under this contract.

9. SHIPPING/PROCESSING ARRANGEMENTS

A Government designated employee will mutually coordinate with the Contractor directly to arrange for a return shipping date. The Contractor shall provide all instructions, forms, and labels needed to ship the designated items to a Contractor's central processing facility. Contractor will work on-site to electronically scan and generate a list of all pharmaceuticals and prepare their outdated products for shipment to the reverse distribution facility for processing. A copy of the contractor’s on-site inventory report will be available in the same format as the contractor’s supplied, facility itemized electronic list. Contractor must also provide software as a service and/or electronic methods to cross reference site electronic record against contractor electronic record to identify discrepancies. Reverse distributor product may not leave site until all discrepancies have been resolved. The Contractor is responsible for the shipment and associated costs from the facility to the Contractor’s reverse distribution facility. Product status shall be provided via the contractor’s web-based reporting system within three (3) business days after processing is complete.

The Contractor shall provide on-site servicing within ten (10) business days from the date of the facility request. The Contractor shall not separate returnable from non-returnable pharmaceuticals on-site, instead the Contractor shall package the designated returns and transport them to the Contractor’s facility where the determination will be made concerning product that is returnable and product that is waste. The Contractor shall arrange for pick-up of controlled substance returns from the facility within 1 business day of service unless a delay is requested by site. The Contractor shall arrange for pick-up of non-controlled substance returns from the facility within 5 business days of service unless a delay is requested by site. Chain of custody paperwork shall be prepared for controlled substances and given to the returning facility by the Contractor at the time the package(s) are prepared for shipment. Within thirty (30) days of receiving the returned goods, the Contractor shall process all designated items by sorting, listing, and processing items through either a manufacturer's credit program or through the disposal process in accordance with all applicable federal, state, and local regulations. The Contractor shall comply with participating customers’ additional security requirements and procedures for access to facilities. All costs associated with gaining access to any customer facility shall be the responsibility of the Contractor.

10. PHARMACEUTICALS QUALIFYING FOR MANUFACTURER'S RETURN

Products qualifying for manufacturer’s return are pharmaceuticals, including partials pharmaceuticals, in the original manufacturer containers. Everything else is considered waste and facilities must follow applicable federal, state, and local laws and ordinance for waste disposal.

Any items removed during a facility’s service event will be processed and associated to a single order that is unique to that service event.

11. PHARMACEUTICALS INELIGIBLE FOR CREDIT FROM MANUFACTURER

The Contractor shall list all items (including non-controlled and controlled substances and non-hazardous and hazardous substances) designated for disposal on a disposal manifest. This list will include at a minimum product name, National Drug Code (NDC) or catalog number, quantity, total estimated return value, and reason for non-eligibility for credit. Separate manifests shall be provided for the disposal of Schedule II – V controlled substances and when disposing of hazardous waste products as defined by the EPA Resource Conservation and Recovery Act (RCRA) regulations. A Certificate of Destruction including the disposal date, destruction method, destruction location, weight, disposal company name and proof of destruction affidavit shall be available to the returning facility and maintained on the reporting website upon completion of destruction. All Manifests shall be available to the returning facility within 30 calendar days of Contractor's item receipt, except for the Certificate of Destruction/Affidavit which shall be provided within 30 days of the completion of destruction. Shipments to the Contractor that require transport to the disposal location shall be done via approved and licensed vehicles in accordance with federal, state, and local laws and regulations where the processing will be completed. Contractor spills or releases of toxic/hazardous substances into the environment shall be reported to the returning facility immediately.

12. PAYMENTS

Awards shall be paid directly from the Government, not through credits, under a firm fixed fee. The firm fixed site service fee is assessed either monthly or quarterly based upon a prior agreed to service level commitment. For monthly service, site is invoiced on the 20th of each month. Monthly site service must be scheduled prior to the 20th of each month. For quarterly service, site is invoiced on the 20th of the month of service. Quarterly site service must be scheduled prior to the 20th of the last month of the quarter.

The firm fixed site visit service fee should cover the contractor’s costs including, but not limited to, packaging, shipping, processing, software as a service application, waste disposal, and any other applicable costs or fees incurred in performance of reverse distribution and waste disposal services.

Within 15 days from receipt of award, the Contracting Officer shall be notified by the contractor awarded a contract under this solicitation if any business-to-business-agreements cannot be reached with the VA PPV. Failure or refusal to reach agreement with the VA PPV shall constitute sufficient cause for terminating the contract under Federal Acquisition Regulation Part 52.212-4(m), Contract Terms and Conditions-Commercial Items, Termination for Cause unless such failure is unintentional and for valid and justifiable reasons despite good faith discussions.

The Contractor is encouraged to establish a working relationship with each manufacturer and comply with each manufacturer’s return goods policy to ensure maximum credit receipt and reduce the cost of returning non-returnable items. The Contractor is responsible for contacting the manufacturer to ensure that credits are received in accordance with the negotiated timeframe stated in each return goods policy and to assist in resolving issues of inadequate or non-payment of outstanding credits. If manufacturers have an established reverse distributor that handles their credit and return process, the awarded Contractor shall make every effort to work with these reverse distributors that have current agreements directly with the manufacturers. The site service fee is fixed and there will be no adjustments based on credits received.

NOTE: There may be instances where more favorable return good policies have been negotiated on Federal Government contracts. To take advantage of more favorable return policies, the Contracting Officer will assist in providing a copy of the negotiated agreement(s) to the Contractor. There may be manufacturers that will only accept returns directly from the facility and will only provide credits through their own reverse distributor. If known, the Contractor shall identify in its proposal, those manufacturers that will not accept products through this Reverse Distribution Program.

13. WEB-BASED TRACKING OF CREDITS

To ensure adequate tracking of credits from inception to disposition, the Contractor shall make available the PPV confirmation of itemized credit statements received from the manufacturers at least monthly. To ensure full visibility of all credit amounts against the item(s) credited, the contractor must also be a reverse distributor for the PPV. The contractor shall instruct manufacturers to issue all credits directly to the PPV since the PPV has credit accounts established for each authorized user of the PPV Program for purposes including reverse distribution. Any credits received by the Contractor from the manufacturer shall be forwarded to the PPV within ten (10) business days from date of receipt. In addition, each agency/facility that receives credits directly from the manufacturers because of reverse distribution processing will be instructed to notify the Contractor of receipt of such credits so that the Contractor can update their electronic reporting system. Credits will be deposited into the individual facility accounts by the PPV upon receipt of itemized credit statements for each individual facility provided by the Contractor. The credit statements provided by the Contractor to the PPV shall include the customer account number and appropriate invoice number to facilitate this process and for tracking purposes. Based on the above, any arrangements to facilitate the processing of credits through the PPV must be made solely between the Reverse Distributor and the PPV. Any fees associated with this arrangement shall not be removed from the facility credits due. Credits may NOT be used by VA PPV customers for additional value-added services from the Contractor, such as report customization or additional site visits, for VA facilities.

14. IMPLEMENTATION PLAN

Offerors shall submit a written proposed plan detailing implementation of the Reverse Distribution Program including details on how billing will be completed (credit card, PO, etc.). Billing requires the ability to accept both credit card (Visa and MasterCard) and invoice options depending on the value of the transaction. Individual orders will specify the local options. Additional information regarding invoicing procedures is included in the clauses.

15. CONTINGENCY PLAN

The contractor shall submit and maintain a plan for contingency operations, which identifies the ability to provide uninterrupted support of the requirements outlined in this solicitation under emergency and/or contingency conditions.

16. REPORTS

The Contractor shall provide a return detail report by manufacturer to each returning facility within (30) calendar days after processing for all credit returns. This report should include at a minimum, the customer account number, applicable order or invoice number, product name, NDC or catalog number, lot or batch number, quantity returned, date returned, unit of measure, estimated return value, and a list of non-returnable pharmaceuticals with the weight and cost for disposal. An additional credit report shall be provided showing both the estimated credits and actual credits received, including total actual credit received and credit received by unit of measure for each NDC, as well as the date that the credit was issued, and identify contractor fees taken for each pharmaceutical return. The contractor shall make available copies of the manufacturer credit memos with this report to ensure adequate tracking of credits from inception to disposition. Separate reports shall be provided for Schedule II – V controlled substances and for hazardous waste to include weight of disposal.

The Contractor shall provide a web-based reporting tool that will generate the following reports:

The following VACHS staff shall have access to the dashboard to generate reports:

VACHS, San Juan (Outpatient Clinic)- Reporting requirements shall be e-mailed to (To be Determined).

VACHS, San Juan (Inpatient Clinic)- Reporting requirements shall be e-mailed to (To be Determined).

Ponce Outpatient Clinic (POPC)- Reporting requirements shall be e-mailed to (To be Determined).

Mayaguez Outpatient Clinic (MOPC)- Reporting requirements shall be e-mailed to (To be Determined).

· Job Order Credit

· Job Credit Detail (Open vs. Closed)

· Returns Analysis

· Returns Dashboard

· Non-Returnable Products

· In-Dated Items Report

· Top Dollar Report

· Schedule 2 Item Report

· Aging Dashboard

· Manufacturer Analysis Detail

· Master Store Detail

VA Reporting Requirements:

Each NDC processed should contain the minimal data points:

· Contract Number

· Account Number

· ITAG Number

· Order Number

· Receive Date

· Original Process Date

· NDC

· Product Name

· Manufacturer Name

· DEA Class

· Expiration Date

· Returnable Flag

· Waste Reason Code

· Hazardous Flag

· Unit Price

· Quantity

· Estimated Return Value (Extended Price)

· Recall Flag

· Aged Flag

· Unaged Flag

· Aging Processing Date

· Manufacturer Debit Memo Number

· Return Authorization Number

· Item Disposition*

· Item Status

· Amount Credited

· Prime Vendor Credit Memo Number

· Amount Waiting Credit

17. DASHBOARD REPORTING REQUIREMENT

The reverse distribution vendor shall provide a web-based corporate level dashboard and reverse distribution information system available to the user at each facility for the purpose of managing, tracking, and comparing the processing of unused pharmaceutical returns across the VACHS. The web-browser based application is the preferred and required type of digital dashboard specified by this contract. The digital dashboard and reverse distribution information system shall be configured to track the flow of business processes associated with the return, destruction, disposal, waste, credit or other disposition of unused pharmaceuticals processed from the agency through the reverse distributor. The system shall provide graphic representation (i.e., dials, graphs, charts, etc.) of high-level processes and allow for drill down into low level data, with the purpose of allowing agency executive level leaders the ability to view and make comparisons of return processes and data across facility. The dashboard shall use standardized metrics and key performance indicators and display these data points to allow comparison between different levels of the agency (i.e., agency or service level, and regional level). The digital dashboard shall display data elements in both a control panel format and database table format. Users will be able to generate and export data from the control panel into a downloadable spreadsheet (e.g., Excel spreadsheet). The digital dashboard and reverse distribution information system will allow users to monitor the return of unused pharmaceuticals through the vendor and compare the activities of the various levels (i.e., agency or service level, and regional level). Features and benefits of the dashboard and reverse distribution information system shall include visual presentation of performance measures; ability to identify and correct negative trends; measure of efficiencies/inefficiencies; ability to generate detailed reports showing new trends; overall visibility of the activities across an agency or service; efficient identification of data outliers and correlations. The dashboard application will provide decision makers with the input necessary to manage the reverse distribution business process by providing a web-based graphical user interface designed to display summaries, graphics (e.g., charts, graphs, gauges) in a portal-like framework to highlight important information and benchmark across a corporate, regional and treatment facility level so that the number of pharmaceutical credits across the systems can be maximized.

18. TRAINING REQUIREMENTS

The Contractor shall provide, at no cost to the Government, orientation, and training down to the facility level on the various reports and functionality of reports to assist the facilities in monitoring and tracking potential credits. Training shall include actual demonstration and operation of the web-based electronic service request ordering system. In addition, the Reverse Distributor shall provide updates and system changes, and training prior to the adoption of changes as they occur throughout the term of the contract. Training should be provided on-site at each participating customer’s facility. The contractor shall notify all sites 14 calendar days before the date of their scheduled training. Training shall cover at a minimum the following:

· Full web access and reports training, including targeted data extrapolation.

· Credit detail reports displaying estimated and actual credits.

· Potential inventory management strategies.

An instructional user guide with step-by-step instructions on the above topics shall also be provided via a link on the reporting website. A contact person and telephone number shall be provided to each facility in the event additional instruction is necessary or if there is a change in personnel.

19. CONTRACT ADMINISTRATION AUTHORITY

(a) The Contracting Officer is the only person authorized to approve changes or modifications to the requirements under this contract on behalf of the Government.

(b) In the event the Contractor makes any changes at the direction of any person other than the Contracting Officer, such changes shall be considered to have been made without authority and any adjustments in price involved because of unauthorized changes to the contract will not be ratified.

(c) This contract will have a designated COR who will serve as a point of contact for all matters pertaining to the technical aspects of the contract. At time of contract award, or upon appointment the Contractor will be furnished with a copy of the COR’s appointment letter. CORs have limited authority as delineated by the cognizant Contracting Officer in their appointment letter and cannot make any commitment obligating the Government.

(d) In addition to designated CORs that will be responsible for all technical aspects of the contract, this facility will have a designated Ordering Officer or Contracting Officer. Only VACHS personnel officially designated as Ordering Officers under the Reverse Distribution contract or warranted contracting officers may place orders under this contract. Ordering Officers do not have the authority to negotiate, make any commitments or changes that will affect the terms and conditions of this contract. Ordering Officer Designations pertain only to the Government.

20. FEDERAL GOVERNMENT HOLIDAYS

The following information is provided to assist the Contractor in scheduling returns when on-site service is required:

*If these holidays fall on a Saturday or Sunday, the contractor should contact the returning facility to determine on which day (Friday or Monday) they will be observed.

21. PHARMACEUTICAL PRIME VENDOR

The following represents the current VA Pharmaceutical Prime Vendor as of the date of this solicitation. The Contractor will be given notice via e-mail within 90 days when a change occurs.

McKesson Corp. Pharm. Group 2975 Evergreen Drive Duluth GA 30096 Point of Contact:

Ms. Anita Robinson, Account Executive Phone:678.471.0632

22. REVERSE DISTRIBUTION PROGRAM ELIGIBLE FACILITIES

Government Participants. The contractor shall provide reverse distribution services at the fees awarded herein for the facilities below as well as other VACHS facilities approved to participate in the VA’s Pharmaceutical Prime Vendor (PPV) program.

(Ponce Outpatient Clinic) VA Euripides Rubio Clinic- Ponce OPC- Outpatient Clinic Paseo Del Veterano #1010 Ponce, PR 00716-2001 Phone: (787)812-3030, ext. 244154

(Outpatient Pharmacy) VA Caribbean Healthcare System 10 Casia Street San Juan, PR 00921 Phone: (787) 641-7582, ext. 131668

(Inpatient Pharmacy) VA Caribbean Healthcare System 10 Casia Street San Juan, PR 00921 Phone: (787) 641-7582, ext. 147049

(Mayaguez Outpatient Clinic) Mayaguez Outpatient Clinic State Road # 2 Km. 149.9 Ave. Algarrobo, Bo. Sabanetas Mayaguez, PR 00681-1507 Phone: (787) 834-6900, ext. 248473

23. QUALITY ASSURANCE PLAN MATRIX

The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success. The government expects the contractor to perform at a minimum, the identified acceptable levels throughout the life of the contract, and the contractor’s performance shall be given significant consideration when evaluating recommendations for future government contracts and or awards.

23.1 Method of Surveillance: The Government performs surveillance to determine if the Contractor exceeds, meets, or does not meet these standards. The Government shall use these standards to determine Contractor performance and shall compare Contractor performance to the Acceptable Quality Level (AQL). Surveillance methods may include random, planned, 100% inspections, and/or customer complains.

acceptable level

acceptable level

acceptable level

acceptable level

acceptable level

acceptable level

acceptable level

21.2 Quality Assurance. The Government will evaluate the Contractor’s performance under the contract, IAW the PRS Matrix. The Government retains the right to inspect and test all services called for by the contract. The Government will perform inspections and tests in a manner that will not unduly delay the work. If any of the services performed do not conform to contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no increase in contract amount.

21.3 Whenever the COR notifies the contractor of any deficiencies detected in the work performed, the contractor shall correct cited deficiencies within 2 days, or as otherwise authorized by the COR, after the notification in writing by the COR without affecting the regularly scheduled work.

21.4 Upon satisfactory completion by the Contractor and acceptance by the COR of the work completed by the contractor in accordance with this Performance Work Statement, payment will be approved. Failure to complete the work stated in this PWS may result in unfavorable Contractor Performance Assessment Reporting System (CPARS) ratings and/or deduction to be determined by the CO.

21.5 Quality Control. The contractor shall develop and maintain an effective Quality Control Program (QCP) to ensure services are performed IAW this PWS. The purpose of this program is to identify, prevent, and ensure non-recurrence of defective services. A Quality Control Plan shall be submitted within 10 calendar days after contract award. Any modifications to the program shall be provided to the Contracting Officer for review no later than 10 working days prior to effective date of the change. The QCP shall be subject to the Government's review and approval.

24. VA INFORMATION AND INFORMATION SYSTEM SECURITY

With No Sensitive Data but Requires Training

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

VA INFORMATION CUSTODIAL LANGUAGE:

a. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

b. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

c. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

d. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

SECURITY INCIDENT INVESTIGATION:

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH:

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

SECURITY CONTROLS COMPLIANCE TESTING:

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

TRAINING:

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete VA Privacy and Information Security Awareness and Rules of Behavior Training before being granted access to VA information and its systems.

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Rules of Behavior before being granted access to VA information and its systems.

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

The Certification and Accreditation (C&A) requirements do not apply and a Security Accreditation Package is not required for this SOW.