Home O2 East Securtiy Info.pdf

SECURITY INFORMATION

1. VA sensitive information that has been properly disclosed by VA to the contractor is not subject to the VAAR security clause.

2. VA sensitive information is being properly disclosed to the contractor as part of this contract.

The contractor is not storing VA data on behalf of the VA. The information required to be provided to the contractor must be transmitted in a secure manner.

3. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data

- General, FAR 52.227-14(d) (1).

4. All email communications must use VA-approved encryption. A Contractor Security Control Assessment (CSCA) is also not required because the data is no longer owned by the VA once it is provided to the contractor to perform a healthcare operation.

5. The COR is responsible for ensuring that all Contractors comply with physical security policies.

All Contractors must receive Privacy training annually using one of the following methods:

• Complete “VA Privacy Training for Personnel without Access to VA Computer Systems or Direct Access to or Use to VA Sensitive Information” training by using VA’s TMS system (https://www.tms.va.gov/). Contractors may use the TMS Managed Self Enrollment method to complete the training in TMS.

• Complete the hard copy version of “VA Privacy Training for Personnel without Access to VA Computer Systems or Direct Access to or Use to VA Sensitive Information”. Signed training documents must be submitted to the COR.

6. Training must be completed prior to the performance of the contract and annually thereafter.

Proof of training completion must be verified and tracked by the COR.

7. it is determined that these companies have a health care entity exemption as a DME supplier and no BAA is required. If they do have access to PHI, annual Privacy & HIPAA training will be required and tracked by the COR.

https://www.tms.va.gov/