Genetics Testing - SOW DRAFT.pdf

Draft Statement of Work

GENERAL: The Michael E. DeBakey VA Medical Center (MEDVAMC) is pursuing a contract with a base year from date of award with four one-year options and an emergency six-month extension at the end of the last option year for genetic testing.

BACKGROUND: The genetic test will be prescribed by the Veterans' attending Physician who has the authority to prescribe the method of treatment for best optimal medical care of his/her patient. The physician has determined that the requested Genetic Tests are medically necessary to diagnose the Veteran’s medical condition. These genetic tests are critical for making a diagnosis for the patient which in turn will help focus their management and initiate surveillance. Making a diagnosis is crucial for the patient as it removes uncertainty, determines further management including treatment and surveillance and prevents further intensive workup and expensive investigations. It improves patient outcomes as management can be based on anticipatory guidance and prognosis, thus optimizing long-term care. This will help us to achieve the best possible outcomes for our Veteran patients needing genetic and genomic care.

Genetics testing that also offer supplementary RNA analysis for specific oncology panels which is very helpful for interpreting variants of uncertain significance and determining further management for our Veteran patients.

Management decisions are based on genetic testing results, particularly in oncology and having access to RNA sequencing is essential for determining the clinical significance of variants in genes associated with hereditary cancer. We have had many young male and female Veteran patients ask for carrier screening to help determine their future reproductive planning.

SCOPE: The MEDVAMC is requesting referral genetic testing for the below CPT Code and respective

Manufacture Catalog # of variants. A detailed list of tests is included with the contracting packet and is titled

“VA Test Panel List” SEE ATTACHED. They should be able to perform sample intake, processing, analysis, interpretation, and reporting for germline genetic testing. These will include single gene testing, as well as panels, including whole exome and whole genome sequencing curated by the laboratory in accordance with national guidelines.

TASK: The Contractor shall notify the Contracting Officer Representative (COR) or authorized MEDVAMC

Lab Tech representative when test results will not be available for greater than 21 days at 713-794-7332.

Test Contractor Point of Contact. The Contractor shall assign a specific account representative to MEDVAMC.

The Contractor shall provide the following point(s) of contact when immediate inquiry regarding the status of a pending test(s) is required:

a. Person(s) name(s): __________________________

b. Telephone number: _________________________

c. Fax number: _________________________

The Contractor laboratory shall provide and ensure safe, secure, and careful handling of the patient samples and the reporting of results in accordance with established guidelines from the Department of Veterans Affairs

Handbook 6500, the College of American Pathologists (CAP), the Joint Commission on Accreditation of Health

Care Organizations (JCAHO), guidelines established by VA Laboratory Service or as required to follow the

Health Insurance Portability and Accountability Act of 1996 (HIPAA) during transportation. The contractor must be approved by the College of American Pathologists (“CAP”) and the Clinical Laboratory Improvement

Amendments (“CLIA”).

The Contractor shall maintain current licenses and certificates and provide copies of such to VA within 30 days of written request. The Contractor shall make sure employees have current and valid professional certifications before starting work under this contract. Technologist, medical technicians, and cytotechnologist shall meet personnel qualifications required by Clinical Laboratory Improvement Act (CLIA) '88 Guidelines. Pathologists must have graduated from an approved school of medicine or osteopathy and completed a residency or fellowship in pathology acceptable to the United States Surgeons General and must possess a valid license to practice clinical reference laboratory services from a United States (U.S.) jurisdiction; and shall have provided pathology services for a minimum of 24 months within the past 36 months and pathology consultation services at a minimum of 36 months within the past 48 months. The Contractor shall include names and telephone numbers of technical Directors and Pathologists available for consultation.

The Contractor shall advise the MEDVAMC of any changes in methodology, procedure, reference ranges delays in testing, and any new tests introduced.

They will provide a list of tests available as well as a secure online ordering and reporting portal. Invitae will maintain the minimum acceptable service, reporting system, and quality control.

The VA send out laboratory will be responsible to provide laboratory specimens to be prepared in accordance with the contractor laboratory specifications. All specimens will be labelled with at least two patient identifiers

(e.g., name, DOB, medical record number).

INVOICING:

The contractor shall bill only for the tests sent by the VISN16 telegenomics program run through the Michael E

DeBakey VA Medical Center and ordered by authorized providers. The contractor laboratory shall provide up-to-date point of contact information for all correspondence related to genetic testing and billing from the VA.

HOURS OF OPERATION:

The contractor laboratory is responsible for providing services Monday through Friday 8:00 AM – 4:30 PM

Central Standard Time (CST), except Federal Holidays and the contractor shall always maintain an adequate workforce to ensure provision of genetic testing services.

PERIOD OF PERFORMANCE:

Base Period: From Date of Award

Option Year 1: 12 months

Option Year 2: 12 months

Option Year 3: 12 months

Option Year 4: 12 months

GOVERNMENT FURNISHED: The MEDVAMC is responsible for collecting, packaging, and mailing the specimens.

The MEDVAMC Send-Out laboratory personnel will affix a label containing the patient’s full name and full social security number to the specimen’s container to ensure integrity of the information, place the specimen

(that is being sent for processing) in a sealed tamper evident container and ship via UPS.

The Genetics Counselor have access to the portal and will post results on the share point. Then MEDVAMC laboratory personnel will scan the result report to CPRS.

FEDERAL HOLIDAYS: The Contractor is not required to perform services on the following Federal holidays:

New Year’s Day January 1st

Birthday of Martin Luther King Jr. 3rd Monday in January

Washington’s Birthday 3rd Monday in February

Memorial Day Last Monday in May

Juneteenth National Independence Day June 19th

Independence Day July 4th

Labor Day 1st Monday in September

Columbus Day 2nd Monday in October

Veterans Day November 11th

Thanksgiving Day 4th Thursday in November

Christmas Day December 25th

In addition to the days designated as holidays, the Government observes the following days: Any other day designated by Federal Statute. Any other day designated by Executive Order. Any other day designated by the

President’s Proclamation.

The Government anticipates award of a Firm Fixed Price type.

SECURITY REQUIREMENTS: VA Protected Health Information is provided to the vendor under this contract. This contract is to enable a HIPAA Covered Entity to provide clinical services on behalf of VA. A patient’s consent is not required (1605.1P24). The vendor is required to secure the PHI as required by HIPAA.

INFORMATION SYSTEMS OFFICER, INFORMATION PROTECTION: The Contractor will not have access to VA Desktop computers, nor will they have access to online resources belonging to the government while conducting services. If removal of equipment from the VA is required, any memory storage devices, such as hard drives, solid state drives and non-volatile memory units will remain in VA control and will not be removed from VA custody.

PRIVACY OFFICER: The Contractor will not have access to protected Patient Health Information (PHI), nor will they have the capability of accessing patient information during the services provided to the VA and if removal of equipment from the VA is required, any memory storage devices, such as hard drives, solid state drives and non-volatile memory units will remain in VA control and will not be removed from VA custody. All research data available for Contractor analyses is de-identified.

VA-SPECIFIC/PRIVACY TRAINING. The Contractor shall complete the VA Privacy and Information

Security Awareness and Rules of Behavior (VA10176) training and Privacy and HIPAA Focused training

(VA10203) in the Talent Management System (TMS) annually, as well as, any other mandated training, at their own cost before access is given, at no cost to the government.

INFORMATION SYSTEM SECURITY: For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent to those procedures used to secure

VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COTR and approved by VA

Privacy Service prior to operational approval. All external Internet connections to VA’s network involving VA information must be reviewed and approved by VA prior to implementation.

Adequate security controls for collecting, processing, transmitting, and storing of

Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization)

(C&A) of the contractor’s systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA OCS Certification Program Office. Government-owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

The contractor/subcontractor’s system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the ISO for entry into VA’s POA&M management process. The contractor/subcontractor must use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. The Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with contractor/subcontractor activities must also be subject to such assessments. If major changes to the system occur that may affect the privacy or security of the data or the system, the C&A of the system may need to be reviewed, retested and re-authorized per VA Handbook 6500.3. This may require reviewing and updating all of the documentation (PIA, System Security Plan, and Contingency Plan). The Certification Program Office can provide guidance on whether a new C&A would be necessary.

The contractor/subcontractor must conduct an annual self-assessment on all systems and outsourced services as required. Both hard copy and electronic copies of the assessment must be provided to the COTR. The government reserves the right to conduct such an assessment using government personnel or another contractor/subcontractor. The contractor/subcontractor must take appropriate and timely action (this can be specified in the contract) to correct or mitigate any weaknesses discovered during such testing, generally at no additional cost.

VA prohibits the installation and use of personally owned or contractor / subcontractor owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW or contract. All of the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned OE.

All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media

Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier.

Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/subcontractors that contain

VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per 6500.1 requirements. This must be completed within 30 days of termination of the contract.

Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

Vendor must accept the system without the drive;

VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact; and any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be preapproved and described in the purchase order or contract. A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and

(b) controls above are in place and completed. The ISO needs to maintain the documentation.

RECORDS MANAGER: Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter

XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of

1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974

(5U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the

Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

Michael E. DeBakey Veterans Affairs Medical Center system and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of Michael E. DeBakey Veterans Affairs Medical Center system or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to Michael E.

DeBakey Veterans Affairs Medical Center system. The agency must report promptly to NARA in accordance with 36 CFR 1230.

The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from

Government facilities or systems, or facilities or systems operated or maintained on the Government's behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to Michael E.

DeBakey Veterans Affairs Medical Center system control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand-carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is

EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

The Contractor is required to obtain the Contracting Officer’s approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to contracts. The Contractor (and any sub-contractor) is required to abide by Government and Michael E. DeBakey Veterans Affairs Medical Center system guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with Michael E. DeBakey Veterans Affairs Medical Center system policy.

The Contractor shall not create or maintain any records containing any non-public Michael E. DeBakey

Veterans Affairs Medical Center system information that are not specifically tied to or authorized by the contract.

The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of information Act.

Michael E. DeBakey Veterans Affairs Medical Center system owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which

Michael E. DeBakey Veterans Affairs Medical Center system shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

TRAINING: All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take Michael E. DeBakey Veterans Affairs Medical Center system provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.