DRAFT STATEMENT OF WORK.docx

Draft Statement of Work Veterans Affairs Southern Nevada Healthcare System

1. CONTRACT TITLE: Pharmacy Hazardous Compounding Contingency

REQUIREMENTS/SCOPE: The Department of Veterans Affairs Southern Nevada Healthcare System (VASNHCS) is seeking a vendor for a firm fixed price contract to provide the compounding and delivery of antineoplastic hazardous drugs from an FDA 503A compliant facility on a contingency basis for patients receiving treatment and infusion services at VASNHCS.

The interested vendor must be able to provide the entire list of compounded chemotherapy medications on an as needed basis with terms and conditions as stated below.

This is a contingency contract where usage is dependent upon Government need. There will be approximately up to 15 patients on any given day, Monday through Friday for chemotherapy infusion for any week of the year. The vendor must be able to supply and deliver all compounded chemotherapy medications listed below. All orders to be placed on an as needed basis by VASNHCS.

REQUIREMENTS

1. Vendor must be able to compound and provide hazardous medications for VASNHCS; approximately up to 15 patients on any given day, Monday through Friday, throughout the performance period. The medications required are included in, but not limited to, those stated in the Draft Product List.

2. All medications must be delivered with no less than 12 hours remaining on the Beyond-Use-Dating (BUD).

3. All compounding, labeling, and BUD will be based off USP 797, USP 800, and Federal Law.

4. Vendor must have a certified 503A pharmacy with an active Board of Pharmacy license that is able to ship to/within the State of Nevada.

5. Vendor must complete and meet all requirements for VA Pharmacy Benefits Management (PBM) Compounded Sterile Products Assessment Guidelines.

6. Vendor must be able to provide documentation of compliance with the standards outlined in the current version of USP 797 and USP 800.

7. Vendor must provide any survey or inspection results and responses from the Joint Commission, Board of Pharmacy, FDA, or any other governing body upon request.

8. Vendor must be able to provide stability data for all medications upon request.

9. Vendor must provide any certification reports for the sterile compounding areas and compounding hoods upon request. In the event of any failures, vendor must notify VASNHCS, provide action plans for the correction of deficiencies, and provide testing results showing the failures have been corrected within five business days.

10. Vendor must notify VASNHCS about anticipated shortages/recalls/discontinuations of medications.

11. Vendor must be able to ensure and provide documentation that medications are handled appropriately per the manufacturer’s specifications prior to the receipt of the medication by VASNHCS.

12. Medications must be stored and used in accordance with directions on FDA approved labeling.

13. Orders from VASNHCS will be submitted to vendor by 12:00pm PST via secure network or fax for next day delivery.

14. Orders from VASNHCS submitted to vendor after 12:00pm PST will be considered STAT and incur additional charges if next business day delivery is available for that order. STAT orders will be placed via secure network or fax and followed up with a telephone call to vendor to ensure availability.

15. Compounded medications will be transported via courier, overnight mail service, or any other means necessary as defined by the vendor to ensure receipt of medications prior to infusion date/time to VASNHCS. All medications and supplies will be packed for transport in such a manner that will ensure acceptance by common carriers and safe delivery to VASNHCS. Packaged medications will comply with regulations of carriers as applicable to the mode of transportation.

16. All compounded medications will be delivered to the following address:

VA Southern Nevada Healthcare System 119-Inpatient Pharmacy 6900 North Pecos Road North Las Vegas, NV 89086

17. All compounded medications will be delivered to VASNHCS by 9:00am the first business day after orders are submitted.

18. Vendor will use specific supplies to be compatible with VASNHCS pumps and equipment.

a. Primary IV Set: BD Alaris: Pump Infusion Set Tubing (REF CH2426-0007)

b. In-Line Filters: Low Sorbing Extension Set 0.2 micron low Protein Binding Filter (REF:20350E)

c. Special Priming: Prime tubing with base fluid prior to adding medication

d. Total Volume Calculations: Per order if specified

e. Close System Transfer Device: BD PhaSeal

2. SPECIFIC TASKS:

Compounding and delivery of antineoplastic hazardous drugs from an FDA 503A compliant facility on a contingency basis, Monday through Friday for any week of the year. Up to 15 patients per day, with potentially multiple compounded medications needed per patient.

3. PERIOD OF PERFORMANCE/SCHEDULE:

The period of performance for this contract shall be from October 1, 2026 – September 30, 2031.

Orders from VASNHCS submitted to vendor after 12:00pm PST will be considered STAT and incur additional charges if next business day delivery is available for that order. STAT orders will be placed via secure network or fax and followed up with a telephone call to vendor to ensure availability.

Compounded medications will be transported via courier, overnight mail service, or any other means necessary as defined by the vendor to ensure receipt of medications prior to infusion date/time to VASNHCS. All medications and supplies will be packed for transport in such a manner that will insure acceptance by common carriers and safe delivery to VASNHCS. Packaged medications will comply with regulations of carriers as applicable to the mode of transportation.

All compounded medications will be delivered to the following address:

VA Southern Nevada Healthcare System 119-Inpatient Pharmacy Room 1D340 6900 North Pecos Road North Las Vegas, NV 89086

All compounded medications will be delivered to VASNHCS by 9:00am the following business day after orders are submitted.

4. PARTICIPATING FACILITY:

VA Southern Nevada Healthcare System 119-Inpatient Pharmacy Room 1D340 6900 North Pecos Road North Las Vegas, NV 89086

5. VA Facility Point of Contact The VA Facility Point of Contact (POC) shall provide general instructions and shall be responsible for ensuring invoices are certified for payment in a timely manner. Facility POC name and contact information shall be provided upon award.

6. CONTRACTOR POINT OF CONTACT:

a. Contractor shall designate one employee as the Contractor Point of Contact (POC) responsible for administrative matters in the performance of services under this contract. The Contractor POC shall have full authority to act for the Contractor on all matters relating to the daily performance of this contract.

b. The Contractor POC shall be available by telephone Monday through Friday, between 08:00 a.m. and 4:30 p.m. excluding national holidays.

c. Contractor shall provide the name and telephone number of the person designated as Contractor Point of Contact, Contractor Alternate Point of Contact, and the name, location and telephone number of the office where normal and emergency service calls are to be placed:

Point of Contact (Full Name):

Telephone Number:

E-mail Address:

Alternate Point of Contact (Full Name):

Telephone Number:

E-mail Address:

Emergency Service Contact Information:

Emergency Service Telephone Number:

7. U.S. GOVERNMENT FURNISHED MATERIALS AND SERVICES:

The contractor shall be responsible for the receipt and handling of all equipment and materials. The contractor shall coordinate proposed delivery areas with pharmacy.

8. CONTRACTOR FURNISHED ITEMS AND SERVICES:

The contractor shall furnish all necessary medications, materials and products. The contractor shall provide delivery for medication via national carrier.

9. RE-PERFORMANCE:

If product or delivery does not conform to the contract specifications, the Facility POC or the Contracting Officer shall require the Contractor to provide again to conform to the contract specifications, at no cost to the Government. When the defects in cannot be corrected by re-performance, the VA Medical facility may require the Contractor to call in a senior technical engineer from the manufacturer or from a different company. The Contractor shall incur and absorb all expenses for consultation outside the Contractor’s organization.

10. NATIONAL HOLIDAYS:

The Contractor is not required to provide delivery or pick up services on the following National Holidays.

When a holiday falls on a Sunday, the following Monday shall be observed as a legal holiday by U.S. Government agencies. When a holiday falls on a Saturday, the preceding Friday shall be observed as a legal holiday by U.S. Government agencies. Also included would be any other day specifically declared by the President of the United States as a National Holiday.

11. OVERTIME AND HOLIDAYS:

Any overtime or holiday pay that may be entitled to Contractor personnel performing under this contract shall be the sole responsibility of the Contractor and shall not be billed to nor reimbursed by the Government.

12. CHANGES TO CONTRACT:

Only those items specified herein are authorized. Before providing any items or support of a non-contractual nature, Contractor shall advise the CO of the reason(s) for the additional work and/or service. Only the Contracting Officer is capable of making modifications to the contract.

13. COMPLAINTS:

Contractor shall promptly and courteously respond to complaints within 3 working days, including complaints brought to Contractor’s attention by the CO. Contractor shall maintain a written record of all complaints, both written and oral, showing the identity of the individual, the nature of the complaint, and Contractor’s response. Contractor shall permit the Government to inspect such records upon reasonable notice.

14. INVOICE REQUIREMENTS:

No advance payments will be authorized.

The Government shall pay the Contractor, upon the submission of a properly prepared invoice for prices stipulated in this contract for services and supplies delivered and accepted.

The invoice shall be itemized to include the following minimum information:

Invoice Number and Date.

Contract Number.

Purchase Order/Obligation Number (to be assigned upon task order award).

Date of service.

Itemized list of costs including drugs used, materials, and patient fees.

15. COMPLIANCE WITH APPLICABLE LAWS AND REGULATIONS:

The Contractor shall ensure that services provided to the Government under this contract comply with all applicable laws, statutes, regulations, and guidelines. The Contractor shall also ensure that all services provided to the Government under this contract comply with all Government mandated procedures, standards, and requirements.

Information Systems Officer, Information Protection:

The contractor will not have access to VA Desktop computers, nor will they have access to online resources belonging to the government while conducting services.

16. PRIVACY OFFICER:

The contractor will have access to protected Patient Health Information (PHI), any memory storage devices, such as hard drives, solid state drives and non‐volatile memory units will remain in VA control are prohibited. All research data available for Contractor analyses is de‐identified.

17. RECORDS MANAGER:

1. Records Manager:

a. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33;

Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

b. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

c. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

d. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

e. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

f. The Government Agency owns the rights to all data/records produced as part of this contract.

g. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

18. VA INFORMATION CUSTODIAL LANGUAGE:

1) Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2) VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3) Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

4) The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

5) The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

6) If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

7) If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

8) The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

9) The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

10) Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

11) Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

12) For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the VA Point of Contact (VA POC).

19. SECURITY INCIDENT INVESTIGATION:

1) The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the (VA POC) and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

2) To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

3) With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

4) In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

20. LIQUIDATED DAMAGES FOR DATA BREACH:

1) Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

2) The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

3) Each risk analysis shall address all relevant information concerning the data breach, including the following:

4) Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: