FINAL PWS - Accreditation Readiness Review PWS Clinical and Safety-2024.pdf

Performance Work Statement

A. General Information

A.1 Introduction Veterans Integrated Services Network (VISN) 4 is searching for a contractor to provide Accreditation Readiness Reviews to ensure compliance with The Joint Commission standards. VISN 04 is made up of nine Veterans Affairs Medical Centers: Altoona; Butler; Coatesville; Erie; Lebanon; Philadelphia; Pittsburgh; Wilkes‐Barre; and Wilmington.

A.2 Scope of Work The contractor shall provide all labor, expertise, supervision and all other resources required to conduct, at all VISN 4 medical centers: 1) Clinical/administrative Accreditation Readiness Review (ARR), hereinafter referred to as CLINICAL ARR, for The Joint Commission (TJC) survey in the Hospital, Laboratory, Ambulatory, Behavioral Health, Home Care Programs, and the Long Term Care Institute (LTCI) review in Community Living Centers (CLC), and 2) Environment of Care, Emergency Management and Life Safety ARR hereinafter referred to as SAFETY ARR.

A.3 Background The TJC and CLC accreditation visits are unannounced and may occur over a wide timeframe. To ensure compliance with the (TJC) standard and the State Operations Manual, VISN 4 requires both CLINICAL ARR and SAFETY ARR at all VISN 4 medical centers.

The CLINICAL ARR shall focus on the National Patient Safety Goals, challenging standards, frequently cited requirements for improvement, survey process, human resource readiness, and system and individual tracer methodology. The CLC consultation will be based on transformation of the culture of care and will be based on F‐ tags for determination of severity and scope.

The SAFETY ARR shall assess each VISN 4 facility’s current state of compliance with the identified TJC standards under the Environment of Care (EC), Emergency Management (EM), and Life Safety (LS) chapters of the applicable and most current TJC (Comprehensive Accreditation Manual for Hospitals) CAMH. The assessment is to identify deficient program areas and make recommendations towards abatement, control, and compliance.

All costs, including travel costs and materials furnished to the facilities/VISN 4, must be incorporated into each Contract Line Item Number (CLIN) in the Price Schedule.

A.5 Type of Contract Commercial Firm Fixed Price

A.6 Performance Period From Date of Award, a five‐year, base plus 4 option year FFP.

A.7 Place of Performance

The Contractor shall furnish services at the following locations:

VISN 4 Medical Center Locations

Facility Main Phone Street City State ZIP

Altoona 877‐626‐2500 2907 Pleasant Valley Blvd. Altoona PA 16602

Butler 800‐362‐8262 353 North Duffy Road Butler PA 16001

Coatesville 800‐290‐6172 1400 Black Horse Hill Road Coatesville PA 19320

Erie 800‐274‐8387 135 East 38th Street Erie PA 16504

Lebanon 800‐409‐8771 1700 South Lincoln Avenue Lebanon PA 17042

Philadelphia 800‐949‐1001 3900 Woodland Avenue Philadelphia PA 19104

Pittsburgh

866‐482‐7488 HJ Heinz Campus:

1010 Delafield Road

Pittsburgh PA 15215

866‐482‐7488 University Drive Campus:

University Dr.

Pittsburgh PA 15240

Wilkes Barre 877‐928‐2621 1111 East End Boulevard Wilkes Barre PA 18711

Wilmington 800‐461‐8262 1601 Kirkwood Highway Wilmington DE 19805

Note: The Pittsburgh facility has two campuses covered by one “umbrella” program. The onsite SAFETY ARR assessment will be conducted at the University Drive campus.

Facility Information

Facility Hospital

Square Footage Hospital Authorized Beds

CLC

Square Footage

CLC

Authorized

Beds

Altoona 285,208 SF 11

CLC 5 ‐ 12,946 SF

CLC 6 ‐ 12,948 SF

Butler

*Note –

Butler is ambulatory

HCC 246,612 GSF Dom has 5 buildings Bldg. 21:

11,955 GSF Bldg.

22: 5,372 GSF Bldg.

23: 6,590 GSF Bldg.

24: 6,590 GSF Bldg.

25: 5,276 GSF TR house:

8,405 GSF

No inpatient beds in HCC

Dom 56

TR 10

52,280 GSF 60 beds

Coatesville

90,465 SF (does not include

Primary Care and Behavioral health clinic space, but does include DOMs and inpatient

MH unit)

28 62,693 SF 90

Erie

261,779 SF: Includes all occupancies and mechanical spaces)

6,877 SF: New Domiciliary with planned opening in

February/March 2019

8 Dom Beds planned

Existing CLC:

26, 035 SF

New Freestanding CLC with planned opening in July ‐August 2019:

24,000 SF

Existing CLC:

New CLC: 22

Beds Phase I

Lebanon

Facility 830,000 SF

VCC’s 73,092 SF

Total 903,092 SF

Med Surg: 27

BH: 22

DOM/TR: 63

26,265 SF

Authorized:

Operating: 76

Philadelphia 300,000 SF 143 99,999 SF 120

A.8 Facility Information Continued

Hospital

Square Footage Hospital Authorized Beds

CLC

Square Footage

CLC

Authorized

Beds

Pittsburgh –

H.J. Heinz

108,700 SF 0 198,555 SF 225

Pittsburgh –

University Dr

600,000 SF 224

Wilkes Barre 251,188 SF clinical space 61 46,500 SF clinical space 95

Wilmington 122,953 SF 60 33,812 SF 60

VISN 4 and Facility Contacts – CLINICAL

Facility Position Name Email Telephone

VISN04 Quality Manager Kelly O’Connell Kelly.oconnell2@va.gov 412‐822‐3291

VISN04 Deputy Quality Manager Shannah Boyer Shannah.Boyer@va.gov 814‐207‐7055

VISN04

Accreditation

Manager/Coordinator Roxanne Degnan Roxanne.Degnan@va.gov 570‐899‐7950

VISN04

Quality Management

Admin Officer Brittaney Hardrick Brittaney.Hardrick@va.gov 412‐822‐3291

Altoona Quality Manager Elizabeth Katrancha Elizabeth.Katrancha@va.gov 814‐943‐8164

Altoona Accreditation Coordinator Deborah Zeiders Deborah.Zeiders@va.gov 814‐943‐8164 x 7135

Butler Quality Manager Carole Look Carole.Look@va.gov 878‐271‐6476

Butler Accreditation Coordinator Heather Truitt Heather.Truitt@va.gov 878‐271‐6487

Coatesville Quality Manager Kristen Delaney Kristen.Delaney@va.gov 610‐384‐7711 x 3826

Coatesville Accreditation Coordinator Jessica Piker Jessica.Piker@va.gov 610‐384‐7711 x 2115

Erie Quality Manager Nancy Eismeier Nancy.Eismeier@va.gov 814‐860‐2002

Erie Accreditation Coordinator Kimberly Pilker Kimberly.Pilker@va.gov 814‐860‐2261

Lebanon Quality Manager Laine Hellein Laine.Hellein@va.gov 717‐272‐6621 x 4407

Lebanon Accreditation Coordinator Dawn Thomas Dawn.Thomas2@va.gov 717‐272‐6621 x 4118

Philadelphia Quality Manager Virginia Davis Virginia.Davis4@va.gov 215‐823‐5800 x 6273

Philadelphia Accreditation Coordinator Teresa DeBoard Teresa.DeBoard@va.gov 215‐823‐5800 x 5314

Pittsburgh Quality Manager Kimberly Ripper Kimberly.Ripper@va.gov 724‐496‐2323

Pittsburgh Accreditation Coordinator Sherri Fitzgerald Sherri.Fitzgerald@va.gov 412‐360‐1714

Wilkes Barre Quality Manager Michalene Stevens Michalene.Stevens@va.gov 570‐824‐3521 x 27974

Wilkes Barre Accreditation Coordinator Raymond Hoffman Raymond.Hoffman@va.gov 570‐824‐3521 x 24146

Wilmington Quality Manager Tracey Schoen Tracey.Schoen@va.gov 302‐994‐2511 x 5032

Wilmington Accreditation Coordinator Dennis P. Tauchus Dennis.Tauchus@va.gov 302‐994‐2511 x 4120

A.10 VISN 4 and Facility Contacts – SAFETY

Facility Position Name Email Telephone

VISN04

Safety and Occupational

Health Manager Thomas Yaw thomas.yaw@va.gov 484‐280‐6266

VISN04 Capital Asset Manager Jacob Spruance Jacob.spurance@va.gov 302‐332‐0970

Altoona Facility Management

Office Representative Jerry Wilson

Jerry.wilson5@va.gov 814‐943‐8164 x8347

Butler Facility Management

Office Representative Daniel Michalek Daniel.michalek@va.gov 724‐285‐2467

Coatesville Facility Management

Office Representative Edouard Lemay Edouard.Lemay@va.gov 610‐384‐7711

Erie Facility Management

Office Representative Curt Slinger Curt.slinger@va.gov 814‐860‐2090

Lebanon Facility Management

Office Representative Thaddeus, Kocuba Thaddeus.kocuba2@va.gov 717‐272‐6621 x4740

Philadelphia Facility Management

Office Representative Susan McCaffery Susan.mccaffrey@va.gov 215‐823‐4251

Pittsburgh Facility Management

Office Representative Andrew Walbeck Andrew.walbeck@va.gov 412‐360‐6831

Wilkes Barre Facility Management

Office Representative Orlando Mirarchi Orlando.mararchijr@va.gov 570‐824‐3521 x24169

Wilmington Facility Management

Office Representative Jermaine Best Jermaine.best@va.gov 302‐994‐2511 x4098

B. Description of Work

B.1 Specifications/Requirements – CLINICAL ARR

a. At each of the VISN 4 Medical Centers (reference A.7 for locations), the Contractor shall provide all labor, expertise, supervision and all other resources required to conduct CLINICAL ARR for TJC survey in the Hospital, Laboratory, Ambulatory, Behavioral Health, and Home Care Programs and the CLC review using the State Operations Manual Federal Tags (F‐tags). The following table exhibits the required number of visits/days/consults annually per facility:

These are estimated facility needs for each period of performance and are subjective to change.

2‐Day on‐ site Visit with 2 Consultants

3‐Day on‐ site Visit with 2 consultants

5‐Day on‐ site Visit with 2

Consultants

1‐Day Virtual

Visit with

Consultant

2‐Day Virtual

Visit with

Consultant

1‐Day Virtual

Visit with

Consultant

2‐Day Virtual

Visit with

Consultant

Altoona 1 ‐ ‐ 1 1 1 1

Butler 2* ‐ ‐ 1 1 1 1

Coatesville 2* ‐ ‐ 1 1 1 1

Erie 2* ‐ ‐ 1 1 1 1

Lebanon 2* ‐ ‐ 1 1 1 1

Philadelphia 2* ‐ ‐ 1 1 1 1

Pittsburgh

1 1 1 1 1 1 1

Wilkes‐Barre 2* ‐ ‐ 1 1 1 1

Wilmington 2* ‐ ‐ 1 1 1 1

*These shall be separate visits.

**Site has the option to substitute (1) clinical Consultant with (1) Safety Consultant.

***Site has the option to split a 5‐day visit to (1) 3 day and (1) 2 day OR (1) 5 day.

****Each facility has the option to utilize a Laboratory Consultant for a consecutive 4‐day visit (OR) a consecutive (2) day visit PLEASE NOTE: This option would be in place of their 2‐day visit with 2 Consultants, NOT in addition to.

b. ESTIMATED QUANTITIES: All quantities listed herein are estimated annual quantities. The Government is not obligated to purchase any specified number of supplies/services under this contract but will be obligated to make payment for all services requested and received in the quantities and of the quality requested. The Government does not guarantee or imply that any fixed number of orders will be placed under the resultant contract.

c. CLC consultation shall cover the State Operations Manual including but not limited to: 1) compliance issues with residents’ rights and quality of life requirements, 2) the accuracy of residents’ comprehensive assessments and the adequacy of care plans based on these assessments, 3) the quality of care and services furnished, as measured by indicators of medical, nursing, rehabilitative care and drug therapy, dietary and nutrition services, activities and social participation, sanitation and infection control, and 4) the effectiveness of the physical environment to empower residents, accommodate resident needs, and maintain resident safety, including whether requested room variances meet health, safety, and quality of life needs for the affected residents.

d. Dates of the reviews shall be coordinated with and approved by the Quality Manager and Accreditation Coordinator at each facility in consultation with the VISN 4 Accreditation Manager. The review schedule will be definitized in the applicable TO. The Contractor will need to be flexible with regard to any schedule changes. The Contractor will be able to accommodate schedule changes requested 30 days prior to agreed upon schedule set in the TO.

e. The CLINICAL ARR will be coordinated with the quality management and/or accreditation staff at each facility.

Each accreditation readiness review may include, but not be limited to, an opening conference, training, tracer activities, a Leadership conference, an exit briefing and/or a standards‐based verbal or written report.

f. The consultants shall address Hospital, CLC, Behavioral Health, Home Care, Laboratory and applicable Ambulatory Care Standards and the programs under which these standards are surveyed.

g. The CLINICAL ARR must be provided and priced as indicated in the Price.

B.2 Specifications/Requirements – SAFETY ARR

a. At each of the VISN 4 medical centers (reference A.7 for locations), the Contractor shall provide all labor, expertise, supervision and all other resources required to conduct SAFETY ARR for TJC survey by assessing compliance with the Joint Commission EC, EM, and LS standards and elements of performance. Contractor will review written policies and documentation, interview staff, and physically survey each facility in the gathering of information and completion of the assessment. The assessment is to identify deficient program areas and make recommendations toward abatement, control and compliance. NOTE: The assessment of the LS standards excludes the generation of the SOC, which include Basic Building Information, Life Safety Assessment, Plan for Improvement, and drawings indicating features of fire protection. However, the Contractor must verify the organization has implemented a process to effectively manage the SOC.

b. Prior to an assessment, the Contractor shall forward a pre‐assessment questionnaire to the applicable Facility Management Office Representative (FMOR), identified in Section A.10, to determine 1) the scope of services provided by the facility and 2) the applicable TJC manuals required to perform the assessment (Ambulatory, Behavioral Health, Home Care, Hospital, Laboratory, and/or Nursing Care Center). The Contractor shall include a list of required documents, policies, reports, etcetera, for the facility to provide the Contractor prior to the on‐site portion of the assessment.

c. The Contractor shall review all documents requested from the facility, refer to Section B.2b, as well as any other relevant documents provided by the facility for applicable TJC standards compliance. During the on‐site assessment, the Contractor may request additional documents to provide relevant and useful information.

d. The Contractor shall begin the on‐site portion of the assessment with an interview meeting to include the assessment team, FMOR and other facility representatives. The meeting will include: 1) a review of the questionnaire required in Section B.2b to clarify any uncertainties, 2) assessment strategy development to ensure it is conducted efficiently with minimal disruption to facility operations, and 3) a question and answer session to address the facility’s inquiries and concerns.

e. The Contractor shall immediately provide a verbal report to the FMOR, VISN 4 Safety and Occupational Health Manager (SOHM) and/or VISN 4 Capital Assets Manager (CAM) of any situation or condition that presents an immediate threat to health or safety. The Contractor shall submit a written report regarding the unsafe situation or condition within three (3) days of the verbal notification to the FMOR, VISN 4 SOHM and VISN 4 CAM.

f. Each onsite assessment will be three (3) consecutive days.

g. The Contractor shall coordinate dates of the reviews with and receive prior approval from the FMOR at each facility in consultation with the VISN 4 CAM and SOHM. The review schedule will be definitized in the applicable Task Order (TO) and, if required by FMOR, be accomplished within three (3) months of TO award date. The Contractor will need to be flexible with regard to any schedule changes. The Contractor will be able to accommodate schedule changes requested 30 days prior to agreed upon schedule set in the TO.

h. At the end of each onsite assessment, the Contractor shall hold a preliminary closeout meeting with appropriate VA Medical Center (VAMC) representatives identified by the FMOR for each site. The meeting shall include at least the following:

1. A summary of preliminary findings

2. A synopsis of individual program compliance status, noting significant issue areas

3. A list of deficiencies that may result in significant findings by the TJC

4. Steps the facility may take to address the deficiencies

5. A clear report for gaining as well as maintaining compliance

i. The Contractor shall prepare for and participate in monthly conference calls/webinars with the VISN 4 CAM and facility leadership. The conference call requirements are as follows:

Calls shall be a minimum of one hour.

Contractor shall provide applicable educational and supportive materials.

Contractor shall coordinate the call schedule with the VISN 4 CAM.

Each call shall consist of a discussion of current TJC survey trends, frequently cited EC, EM and LS standards, “hot” topics, proposed or revised standards, and key reminders for survey readiness.

Calls shall be educational and pertinent hand‐out material provided via e‐mail.

Contractor shall provide to the CAM a written report of each call including: topics, attendance, material, and answers to questions posed during the call.

k. The Contractor shall respond to telephone and e‐mail requests for interpretations and means of accomplishing the standards’ intent for a period of one year following an assessment’s final report at no additional charge to the Government. The response may take any form acceptable to the applicable facility; a follow‐up e‐mail will document an answer was provided. Questions received from individuals not included on the Facility and VISN point of contacts list in Section A.10 must be vetted by the applicable facility FMOR prior to answer submission.

l. The SAFETY ARR must be provided and priced as indicated in the Price Schedule located in Section __________ of this PWS.

C. Key Personnel Requirements

C.1 Contractor personnel performing the CLINICAL ARR shall possess the appropriate qualifications and experience for conducting the TJC compliance assessments as follows:

Each clinical ARR consulting team shall have an administrative and clinical person for review.

The clinical and administrative person shall have credentials like those of a TTJC surveyor.

Prior experience serving as TTJC surveyors and/or credentials for conducting surveys.

Demonstrate experience and knowledge of the unique challenges faced by VA Medical Centers.

Experience conducting assessments within the VHA is required.

Consultant expertise in Hospital, Community Living Centers, Laboratory, Behavioral Health, Home Care, Life Safety and Ambulatory Care is required.

Consultants may not be employed by the TJC in any capacity.

C.2 Contractor personnel performing the SAFETY ARR shall possess the appropriate qualifications and credentials for conducting TJC compliance assessments as follows:

A minimum of five (5) years’ experience (within the last 7 years) as a TJC compliance consultant.

Experience conducting assessments within the VHA is required.

Possess a minimum of ten (10) years knowledge of healthcare engineering.

Demonstrate an understanding of the intent of the EC, EM, and LS chapters of the TJC standards under the Ambulatory, Behavioral Health, Home Care, Hospital, Laboratory, and Nursing Care Center manuals.

Consultants shall not be employed by the TJC in any capacity.

Contractor must include with proposal each consultant’s qualifications and experience history.

C.3 Certain skilled experienced professional and/or technical personnel are essential for successful contractor accomplishment of the work to be performed under this contract. These are defined as "Key Personnel" and are those persons whose resumes were submitted for evaluation of the proposal.

(A) The contractor agrees that such personnel shall not be removed from the contract work or replaced without compliance with paragraphs (b) and (c) hereof.

(B) If one or more of the key personnel for whatever reason becomes, or is expected to become, unavailable for work under this contract for a continuous period exceeding thirty (30) work days, or is expected to devote substantially less effort to the work than indicated in the proposal or initially anticipated, the contractor shall immediately notify the Contracting Officer and shall, subject to the concurrence of the Contracting Officer or his authorized representative, promptly replace such personnel with personnel of at least substantially equal ability and qualifications.

(C) All requests for approval of substitutions hereunder must be in writing and provide a detailed explanation of the circumstances necessitating the proposed substitutions. They must contain a complete resume for the proposed substitute, and any other information requested by the Contracting Officer or needed by him to approve or disapprove the proposed substitution. The Contracting Officer or his authorized representative will evaluate such requests and promptly notify the contractor of his approval or disapproval thereof in writing.

D. Deliverables

D.1 CLINICAL ARR

a. The Contractor shall provide a detailed, standards‐based verbal and/or written exit report at the completion of each site visit. The report format will reference and use the Survey Analysis for Evaluating Risk (SAFER) methodology to include the matrix. The report shall cite the specific standards assessed as opportunities for improvement. The written and/or verbal report format is at the discretion of the facility leadership. Satisfactory report completion is based upon government acceptance.

b. At each review completion, the consultants will provide a written report to the associated facility and VISN Accreditation Manager within 5 working days of the visit.

c. If there are any significant findings the vendor must immediately notify the VISN 4 Quality Management Office or Officer (QMO), VISN 4 Accreditation Manager and at least one member of the facility’s executive board (Director, Associate Director, Associate Director of Patient Care Services, Chief of Staff). Refer to the table in Section A.7 for the facilities’ main telephone numbers. Following the immediate notification, the vendor must conduct a VISN 4 conference call with VISN 4 QMO, VISN 4 Accreditation Manager and Facility leadership within two hours of the significant findings’ discovery.

d. The exit report schedule must be coordinated with and approved by each facility’s Quality Manager or Accreditation Coordinator.

e. The Contractor shall provide telephone or email responses to questions regarding TJC standards or F‐tags throughout the term of the applicable TO.

D.2 SAFETY ARR

a. The Contractor shall provide a pre‐assessment questionnaire, refer to B.2b for details.

b. The Contractor shall provide a written report regarding any unsafe condition within three (3) days of the verbal notification, refer to B.2e for details.

c. The Contractor shall provide a preliminary closeout presentation and report, refer to B.2h for details.

d. The Contractor shall provide a separate written report for each facility encompassing and assessing the EC, EM, and LS Standards for the applicable accredited programs (Ambulatory, Behavioral Health, Home Care, Hospital, Laboratory, and Nursing Care Center). The report shall include the probable TJC standard score and the suggested means of achieving satisfactory compliance when a Standard or EP is scored partial or insufficient compliance. The Contractor shall submit the report to the FMOR, VAMC Director, VISN 4 CAM, and the COR.

The draft written report shall be:

Submitted as a draft and include individual standard compliance status with recommended corrections

Submitted within ten (10) business days after each site visit/exit interview

Submitted electronically in Microsoft Word to the VISN 4 CAM, COR, and FMOR

The final written report shall:

Incorporate all comments and be submitted within ten (10) business days of receiving VAMC comments

Be submitted as an electronic Microsoft Word version as well as four (4) hard copies to the VISN 4 CAM (1 copy), Contracting Officer Representative (COR) (1 copy), and FMOR (2 copies)

Submission of the safety reports shall be according to the following schedule:

Facility Site Assessment Draft Report VAMC Review Final Report

VISN 4

Medical Center

TBD – Per individual TO and coordination with

FMOR

10 business days from Exit Interview

10 business days from receipt of Draft Report

10 business days from receipt of VAMC Comments

The report shall include the following:

1. Executive Summary

2. Methods, scope and procedures used for conducting the survey

3. Identification of specific program deficiencies with associated reference to applicable standards

4. Each finding should be clearly linked to a Standard and appropriate Element of Performance and include the reference

5. Recommended actions for abatement to achieve compliance

E. Contractor Responsibilities

a. Consultants shall use the most recent edition of TJC Standards published in the CAMH: The Official Handbook and other appropriate standards for Nursing and Rehabilitation Centers such as the State Operations Manual, F‐ tag, Ambulatory Care, Home Care, Behavioral Health Ambulatory, Behavioral Health, Hospital, Laboratory, and/or Nursing Care Center. TJC standards can be found at www.jointcommission.org and the State Operations Manual can be found at https://www.health.pa.gov.

b. The Contractor shall coordinate the ARRs with the requisite Government points of contact as stipulated in the requirements Section B.

c. The Contractor shall refer questions from persons not included on the Government approved listing to the COR.

d. Subsequent consultant substitution must be approved by the VISN 4 Safety and Occupational Health Manager (SOHM) and the applicable facility’s FMOR. Consultant substitution costs will be borne by the Contractor.

F. Invoices

a. Vendor must invoice the government within 30 days after completion of services. Invoices must contain at a minimum the purchase order and itemized list of products delivered, unit prices, and total price.

b. Invoices shall be identified with proper purchase order number for that period of performance and shall reflect all deliveries made against the delivery order.

c. Itemized invoices shall be submitted after services are rendered and shall include the following per FAR Clause 52.212‐4(g):

Contractor’s business name and address

Contractor’s Tax Identification Number (TIN)

Invoice date

Date(s) of services provided

Contract number

Total amount billed

Purchase Order number

d. Failure to include the above information may result in delay of payment. Invoices will be returned to the Contractor for completion if there are any omissions.

G. Government Responsibilities

a. Each facility will supply the consultants with accurate information describing the scope of services provided. The facility will provide access to those staff members who would normally be involved in a Joint Commission Survey and Long Term Care Institute (LTCI) visit to allow adequate assessment of standards compliance.

b. The facility will designate representative(s) to participate will have knowledge of the physical plant and campus and its operations.

c. Provide the Contractor with the assigned and approved VAMC Point of Contact (POCs). Questions by persons not included on the provided listing shall be referred

d. Review the Draft Reports within the specified timeframe. And provide any additional documentation that may not have been made available during the onsite assessment to substantiate comments.

e. The Government IT security requirements for certification and accreditation (authorization) (C&A) of the contractor system do not apply and a Security Accreditation Package is not required since the no contractor‐ owned IT devices in support of these services will connect to a VA internal trusted network.

H. Performance Standards

Contract Performance and Evaluation Criteria and Standards In accordance with FAR Subpart 42.1503.

I. Technical (Quality of Product or Service)

Quality Report in accordance with contract terms and conditions. Provide accurate and current responses tailored to the individual needs of the requestor and to agency requirements.

Ratings

Exceptional: Deliverables received are always well‐researched, complete and technically accurate. The Contractor frequently exceeds technical expectations. Rework is not required. Other deliverables typically exceed all Contract requirements.

Very Good: Deliverables received are well‐researched, complete and technically accurate. Other deliverables meet all Contract requirements.

Satisfactory: Deliverables received are well‐researched, complete and technically accurate. No more than one

(1) revision is needed to accept the item. Other deliverables meet all Contract requirements.

Marginal: Deliverables are occasionally not well‐researched and contain some technical inaccuracies. Rework is occasionally required.

Unsatisfactory: Deliverables are typically not well‐researched and contain many technical inaccuracies. Rework is frequently required.

II. Schedule / Timeliness

Schedule / Timeliness

Provide timely notification on items requiring government action and timely response to inquiries.

Ratings

Exceptional: Contractor routinely delivers ahead of deadlines, schedules, and responds immediately to Government requests.

Very Good: Contractor routinely meets deadlines and schedules and occasionally delivers early and responds immediately to Government requests.

Satisfactory: Contractor routinely meets deadlines, schedules, and quickly responds to Government requests.

Marginal: Contractor occasionally misses deadlines, schedules or is slow to respond or occasionally non‐ responsive to Government requests.

Unsatisfactory: Contractor frequently misses deadlines or is slow to respond / non‐responsive to Government requests.

III. Management / Business Relations

Communication Timely and effective communication to the Government in accordance with contract terms and conditions.

Ratings

Exceptional: Contractor takes proactive approach such that communications are almost always clear, effective and timely.

Very Good: Contractor routinely communicates with Government in an effective and timely manner and is frequently proactive in managing communications.

Satisfactory: Contractor routinely communicates with Government in an effective and timely manner and communicates emergent issues in accordance with contract terms and conditions.

Marginal: Contractor occasionally fails to communicate with Government in an effective and timely manner.

Unsatisfactory: Contractor fails to communicate with Government in an effective and timely manner.

III. Management / Business Relations continued

Responsiveness Responsive to Government requests and concerns.

Ratings

Exceptional: Contractor’s management takes proactive approach in dealing with Government representatives and anticipates concerns.

Very Good: Contractor’s management is responsive to requests and concerns and is occasionally proactive in anticipating concerns.

Satisfactory: Contractor’s management is responsive to Government requests and concerns.

Marginal: Contractor’s management is occasionally unresponsive to Government requests and concerns.

Unsatisfactory: Contractor’s management is unresponsive to Government requests and concerns.

Problem Resolution

Resolve problems quickly requiring little to no Government mitigation.

Ratings

Exceptional: Problems are nonexistent, or the Contractor takes corrective action without Government involvement.

Very Good: Problems occur infrequently and are generally resolved quickly with minimal Government involvement.

Satisfactory: Problems are resolved quickly with minimal Government involvement.

Marginal: Problems are generally resolved but take unusual Government effort to resolve or take an excessive amount of time to resolve.

Unsatisfactory: Problems are unresolved, repetitive, or take excessive Government effort to resolve.

IV. Other ‐ Staffing

Qualifications Personnel shall have the knowledge, experience and certifications needed to meet contract requirements. The Contractor shall maintain adequate staffing levels to ensure performance and delivery requirements are met.

Ratings

Exceptional: Contractor provides highly qualified personnel. There are no lapses in coverage. New and/or substitute resumes are submitted in accordance with contract requirements. Personnel work/deliver products that are fully consistent with resume qualifications.

Very Good: Contractor provides a mix of qualified and highly qualified personnel. Lapses in coverage are rare and are successfully managed by the contractor with little or no impact on timeliness or quality. New and/or substitute resumes are submitted in association with contract requirements. Personnel work/deliver products that are fully consistent with resume qualifications.

Satisfactory: Contractor provides qualified personnel. Lapses in coverage occur occasionally and are successfully managed by the contractor to minimize impact on timeliness or quality. New and/or substitute resume are submitted in association with contract requirements. Personnel work/deliver products that are fully consistent with resume qualifications.

Marginal: Contractor provides marginally qualified personnel. Lapses in coverage occur more than occasionally.

Unsatisfactory: Contractor provides marginally qualified or unqualified personnel. Lapses in coverage occur regularly.

V. Other ‐ Customer Satisfaction

Customer Satisfaction

Meets Government’s expectations based on contract requirements with no customer complaints.

Ratings

Exceptional: Exceeds customer expectations.

Very Good: Routinely meets or occasionally exceeds customer expectations.

Satisfactory: Meets customer expectations.

Marginal: Contractor occasionally fails to meet customer expectations.

Unsatisfactory: Fails to meet customer expectations.

I. SECURITY REQUIREMENTS

The Contractor will review VA Handbook 6500.6 (see attached). In reference to Appendices B and C, this contract does not require software to be installed on a VA computer.

The Information System Security Officer has determined that paragraphs 5 (f, g) of VA Handbook 6500.6, Appendix C be included in the contract. The aforementioned paragraphs are incorporated below.

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

f. VA prohibits the installation and use of personally‐owned or contractor/subcontractor owned equipment or software on VA’s network. If non‐VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW or contract. All of the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA‐approved antivirus (AV) software and a personal (host‐based or enclave based) firewall that is configured with a VA approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti‐viral software and the firewall on the non‐VA owned OE.

g. All electronic storage media used on non‐VA leased or non‐VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier.

Media (hard drives, optical disks, CDs, back‐up tapes, etc.) used by the contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self‐ certify that the media has been disposed of per 6500.1 requirements. This must be completed within 30 days of termination of the contract.

Additionally, the contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

The Contractor will also complete the attached Contractor Security Control Assessment, within 30 days of the contract approval and periodically as requested by the Government to ensure that appropriate security controls are being implemented.

J. PRIVACY REQUIREMENTS

The Privacy Officer has determined paragraphs 1, 2 (a, b, e), 3 (a, b, c, d, e, f, g, h, j, k), 6 (a, b, c, d), 7 (a, b, c, d), 8 and 9 (a, b, c) of VA Handbook 6500.6, Appendix C be included in the contract. The aforementioned paragraphs are incorporated below.

1. General

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. Access to VA Information and VA Information Systems

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third‐party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA Information Custodial Language

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data ‐ General, FAR 52.227‐14(d) (1).

b. VA information should not be co‐mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co‐mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on‐site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self‐ certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA‐approved encryption tools that are, at a minimum, FIPS 140‐2 validated.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or

Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

6. Security Incident Investigation

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to

VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break‐in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

7. Liquidated Damages for Data Breach

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non‐Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $______ per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

8. Security Controls Compliance Testing

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working‐days notice, at the request of the government, the contractor must fully cooperate and assist in a government‐sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

9. Training

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate:

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, VA Handbook 6500.6, Appendix D relating to access to VA information and information systems;

(2) Successfully complete the VA Privacy and Information Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system…