P01 - Original PWS - Research Survey Database Subscription - Rev 2.19.26.docx

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veteran’s Health Administration (VHA) Digital Health Office (DHO) Office of Clinical Informatics (OCI) Human Systems Integration (HSI)

Research and Survey Database Subscription

Date: 02/19/2026

OHI ID#

DRAFT PWS Version Number: 1.1

Contents

BACKGROUND

The mission of the Office of Clinical Informatics (OCI) within the Digital Health Office (DHO) at the Department of Veterans Affairs (VA) is to enhance the lives of Veterans and VA staff by providing them with improved data and tools to make better decisions and streamline their workflows. Additionally, OCI strives to establish and promote standards and information technology resources based on scientific research, which would benefit the health of Veterans, their families, and the individuals who care for them. To accomplish this objective, OCI is dedicated to adopting interoperability and health information sharing methods based on national standards, promoting data standardization, and promoting an efficient exchange of health data through existing systems.

The Government seeks support services and domain expertise administering Clinical End-User Experience surveys; access to standardized experience questions and industry benchmarks for comparative analysis of survey results; and evidenced-based materials for healthcare best practices with the Electronic Health Record (EHR). VA is currently engaged in a transition to a new Federal EHR. These services and access to industry benchmarks and healthcare best practices are necessary to contribute to assessments of the Federal EHR to help meet the mission of the VA in providing the best Veteran patient care.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

13. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

15. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide, February 2024

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “VA Cybersecurity Program”, February 24, 2021

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems \ VA Information Security Program,” February 24, 2021

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, June 30, 2023

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning”, March 25, 2025

26. OI&T Process Asset Library (PAL), https://www.va.gov/process/ ., including Reference Process Maps and Artifact templates VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx) VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014 Privacy Impact Assessment Training Resources, https://dvagov.sharepoint.com/sites/OITPrivacyHub/SitePages/PIA-Training-Resources.aspx

27. VA Handbook 6510, “VA Identity and Access Management”, September 27, 2024

28. VA Directive 6300.4 Procedures for Processing Requests for Records Subject to the Privacy Act, August 19, 2023

29. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

30. NIST SP 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 2014

31. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, December 10, 2020

32. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6).

33. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

34. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

35. OMB Memorandum M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management, May 21, 2019

36. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

37. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

38. OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, January 3, 2017.

39. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

40. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

41. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

42. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

43. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

44. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

45. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015,

46. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.cisa.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

47. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

48. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

49. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

50. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

51. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

52. Executive Order 13221, “Energy-Efficient Standby Power Devices,” July 31, 2001

53. VA Directive 0057, VA Environmental Management Program, dated October 25, 2022

54. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

55. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

56. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015,

57. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015,

58. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015;

59. “Veteran Focused Integration Process (VIP) Guide 3.2”, December 2018, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

61. “POLARIS User Guide”, Version 1.9, March 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

62. VA Memorandum “Proper Use of Email and Other Messaging Services” dated January 2, 2018, https://www.research.va.gov/programs/epros/education/webinars/acos-ao-education/Proper-Use-of-Email-Memo.pdf

63. VA Directive 6066, “Protected Health Information (PHI) And Business Associate Agreements Management”, September 2, 2014

64. VHA Directive 1906, “Data Quality Requirements for Health Care Identity Management and Master Person Index Functions”, dated April 10, 2020

65. DAMA International, DAMA Guide to the Data Management Body of Knowledge, or DAMA DMBOK®2 Revised Edition, July 1, 2017

66. ASTM E1714 -00 (2017) Standard Guide for Properties of a Universal Healthcare Identifier (UHID)

SCOPE OF WORK

The Contractor shall support survey administration and provide analysis of survey results for two batches of survey data collected each year. The Contractor shall provide Government Purpose rights and permit the VA to utilize the library of standardized survey questions for independent analysis. The Contractor shall provide 4-6 benchmark numbers from Arch Collaborative data for purposes of comparison to VA data. The Contractor shall support the administration and analysis of VA end-user surveys that utilize the Contractors’ provided survey questions during the performance period and provide briefings for VHA on the survey analysis for each survey batch. The Contractor shall also support VA specific and unique questions, excluded from benchmarking, as needed to meet DHO and EHR Modernization measurement objectives.

The Contractor shall provide VA Personnel Resources (Government staff and contractors with va.gov accounts) access to case studies, webinars, and reports on topics covered by the experience survey questions. The Contractor shall annotate case studies with Key to Success and provide directions on best practices and helpful reports for DHO, EHR Modernization, and the field [Veteran Integrated Service Networks (VISNs) and VA Medical Centers (VAMCs)] to access. The Contractor shall connect DHO, EHR Modernization, and field Points of Contact with members of the Arch Collaborative on request or per Contractor advice.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be 12 months from date of award with four (4), twelve (12) option periods.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are ten (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at the contractor site.

TRAVEL

The Government does not anticipate any travel to perform tasks associated with this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

SUBSCRIPTION ACCESS

The Contractor shall provide instructions on how VA resources can access a web accessible resource of published reports, clinician interviews/surveys, webinars and any other product which are focused on provider success, trends, best practices and case studies. The Contractor shall support access by VA resources to include staff and third-party contractors, and answer questions about materials. VA resources are not under obligation to donate time back to the Contractor to maintain their access. The contractor shall answer questions from the PM as well as directly from VA personnel about access and materials. This may include hosting a session to demonstrate access and site navigation.

Deliverables:

A. Web access instructions: Due 2 weeks after the start of period of performance

· Support for VA personnel summarizing support provided over the course of the year as a report: Due 1 week after question received

SURVEY RESULTS BENCHMARKING and Presentation OF ALL RESULTS The Contractor shall conduct survey results and benchmarking and deliver formal presentations to VA personnel twice per year, approximately six months apart, to communicate findings, trends, and comparative insights derived from administered surveys. These presentations shall highlight key performance patterns, emerging themes, and areas of strength or concern, enabling VA stakeholders to better understand survey outcomes in context of industry benchmarks and prior results.

· The Contractor shall provide follow-on discussion and clarification as needed to support VA interpretation and application of benchmarking results. Each presentation shall include actionable observations and recommendations intended to inform decision-making, continuous improvement efforts, and future survey planning.

Deliverables:

A. Benchmarking and presentation of all results, due twice per year, approximately six months apart.

SURVEY BENCHMARKING OF TARGETED AREAS AND OVERALL RECOMMENDATIONS for a survey administration

· The Contractor shall deliver their question catalog for use by VA within its own collection platform. The Contractor shall permit Government Purpose rights and use of their catalog of questions by VA for 5 years after the last day of performance.

· For each survey iteration, the contractor shall meet with VA ahead of survey opening to recommend and review KLAS Arch Collaborative questions being used during administration.

· For any surveys VA will provide survey start and close date one month prior to survey start. If any modifications are going to be made to those dates, VA must provide advance notice to contractor of one week.

· Upon completion of VA’s data collection, VA will send summary data, and the contractor shall provide options for benchmarking views for entirety of data set.

· Benchmarking should be discussed with VA as survey progresses.

· Once the contractor has received survey data from the VA, the contractor shall provide benchmark metrics from industry tied to the question catalog with appropriate descriptive statistics for 2-4 comparisons per question, with at least two relevant Oracle Health peer groups, when compared to health system size and scope and implementation status.

· The Contractor shall keep VA’s survey results anonymous if shared with other healthcare entities.

· The contractor shall provide VA with benchmarked Oracle Health United States’ averages for the current calendar year that VA can use in their own presentations.

· The Contractor will participate in preparatory meetings as necessary, in preparation for the Results Preview Calls

· The Contractor shall be responsive to follow-up needs and internal VA approvals, such as union, legal, and communications reviews which need to occur prior to the Results Preview Call The contractor shall attend and/or lead up to 2 Data Preview Calls of 30-60 minutes each during the Period of Performance. These would be independent of each other and could be used as VA sees fit for dissemination of findings to key groups. The presentation of the data in these Results Preview Calls would be the same but would allow for varied questions from the different groups to whom these are presented.

· During the Results Preview Calls, the Contractor shall:

A. Review the benchmark data B. Answer questions about the comparisons C. Provide insights, guidance and recommendations based on the survey analysis from their domain experts

· After the Results Preview Calls are complete, the Contractor will deliver to VA leadership a deck or section of a deck that shall include:

A. Identification of trends based on year-to-year VA results B. Major trends and notable industry comparisons C. Recommendations for improvement D. Materials referenced in the presentation which shall be summarized for easy access by relevant VA resources

· The contractor shall present their section of content on up to 6 briefings/presentations/updates per survey administration. Those presentations will take 5-30 minutes each, though overall session may be longer.

· The contractor shall assist with answering questions during and following the briefing.

· The contractor shall advise VA on standard Oracle Health processes for their other clients and provide similar support in supporting discussions between vendors and clients.

Deliverables:

A. Question Catalog: Due 2 weeks after start of period of performance B. Question recommendations due one month before survey iteration C. Benchmark options due the day of survey close D. Benchmark slides and Oracle Health average slides drafts due 5 business days after delivery of summary VA data E. Revised deck or deck section due 2 days after the final Results Preview Call F. Curated list of references mentioned in deck: Due 22 days after Results Preview call G. Written answers to leftover questions for up to 6 presentations attended due 1 week after each respective call/presentation

OPTIONAL: ADDITIONAL SURVEYS BENCHMARKING OF ALL RESULTS

This task may be executed multiple times, up to a total of 4perperiod of performance. The Contractor shall perform an additional survey analysis if the Government elects to perform an additional survey iteration. Refer to task 5.2.

OPTIONAL: ADDITIONAL SURVEY FOR BENCHMARKING OF TARGETED AREAS AND OVERALL RECOMMENDATIONS

OPTIONAL: VISN LEVEL DATA REVIEW CALL MEETINGS

· The Contractor shall participate in Data Review Call meetings with VISNs to review the benchmark data, answer questions, and provide insights and recommendations based on the survey analysis from their domain experts. The Contractor shall delineate each Facility level response within the VISN when sufficient survey data for that facility is collected, and provide segmented analysis for Director level recipients when more than one facility is within the VISN results, including trending results if the VA has previous measurements

· Recommendations for improvement

· Materials referenced in the presentation shall be summarized for easy access by relevant VA resources

Deliverables:

A. VISN Level Survey analysis draft: Due 2 weeks after VA provides results to be included in comparisons B. VISN Level Final Survey Analysis: Due 1 week after feedback is provided on the draft C. VISN Level curated list of reference: Due 1 week after feedback is provided on the draft

GENERAL REQUIREMENTS

CONTRACTOR EXPERIENCE REQUIREMENTS - KEY PERSONNEL

The following minimum standards shall apply to all personnel performing under this contract and shall be maintained throughout the life of the contract.

The contractor agrees that the key personnel shall not be removed, diverted, or replaced from work without approval of the COR and PM. Any personnel the contractor offers as substitutes shall have the ability and qualifications equal to or better than the key personnel that are being replaced. Requests to substitute personnel shall be approved by the PM and the CO. All requests for approval of substitutions in key personnel shall be submitted to the PM and the CO within 30 calendar days prior to making any change in key personnel. This request shall be written and provide a detailed explanation of the circumstances necessitating the proposed substitution. The contractor shall submit a complete resume for the proposed substitute and any other information requested by the CO needed to approve or disapprove the proposed substitution. The CO will evaluate such requests and promptly notify the contractor of approval or disapproval thereof in writing.

Minimum qualifications of the key personnel for the execution of the tasks within this performance work statement shall include expert knowledge and abilities in the areas of Surveys, Analytics, and Data Management in a healthcare setting. The contractor shall provide key personnel that have extensive experience in the industry standard tools and processes used to support a large-scale healthcare system. Experience within a healthcare environment is required for the depth of understanding of our specific requirements.

During performance the contractor shall supervise its own employees. Additionally, the contractor shall provide one (1) principal point of contact in which all Government directions are provided through. All Government-contractor correspondence shall be directed through the principal contractor point of contact. The principal point of contact may be one of the FTEs described above.

SECURITY AND PRIVACY REQUIREMENTS

It has been determined that protected health information may be disclosed or accessed, and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the contract, and shall comply with VA Directive 6066.

POSITION/TASK RISK DESIGNATION LEVEL(S)

The PDT Tool is located at the following US Office of Personnel Management Website: https://www.opm.gov/investigations/suitability-executive-agent/position-designation-tool/)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

a. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1) Optional Form 306

2) Self-Certification of Continuous Service

3) Completed SIC Fingerprint Request Form The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-QIP).

1. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

1. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM. However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of OPM.

1. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Deliverable:

A. Contractor Staff Roster

METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format deliverables must be text-editable, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include, but not limited to: Microsoft 365, MS Word 2000/2003/2007/2010/2013/2016/2019/2021/2023 MS Excel 2000/2003/2007/2010,2013/2016/2019/2021/2023 MS PowerPoint 2000/2003/2007/2010,2013/2016/2019/2021/2023 MS Project 2000/2003/2007/2010,2013/2016/2019/2021/2023 MS Access 2000/2003/2007/2010,2013/2016/2019/2021/2023 MS Visio 2000/2002/2003/2007/2010,2013/2016/2019/2021/2023 AutoCAD 2002/2004/2007/2010,2013/2016/2019/2021/2023 and Adobe Postscript Data Format (PDF).

ACCEPTANCE OF DELIVERABLES

The Government will have ten (10) business days to review each deliverable and provide feedback/comments. The contractor shall have five (5) business days to incorporate feedback/comments and make appropriate revisions. The contractor shall provide the revised version of each deliverable to the COR, VA PM, CO, and CS (as applicable). The COR and/or VA PM will review and determine final acceptance by the Government. The COR and/or VA PM will notify the contractor of final acceptance within five (5) business days.

The contractor shall be responsible for adhering to all pertinent Veterans Affairs (VA) standards including but not limited to ensuring that all documentation and deliverables are sent via email to the COR, PM, CO. The contractor shall use Microsoft Teams for all pertinent conference calls, and the VA Exchange server for all pertinent email.

If for any reason, any deliverable cannot be delivered in the time schedule, the contractor shall provide a written explanation to the COR, VA PM, CO, and CS as applicable as soon as late deliverable is anticipated and no less than three (3) working days prior to scheduled delivery. This written transmittal shall include a firm commitment of when the work shall be completed. This notice to the CO shall cite the reasons for the delay, and the impact on the overall project. The CO will then review the facts and issue a response in accordance with applicable regulations.

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products Satisfactory or higher

2. Quick response capability

3. Products completed, reviewed, delivered in accordance with the established schedule

4. Notifies customers in advance of potential problems Satisfactory or higher

2. Personnel possess necessary knowledge, skills and abilities to perform tasks Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

FACILITY/RESOURCE PROVISIONS

All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR and PM as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

VA may provide remote access to VA specific systems/network in accordance with VA Handbook 6500, which requires the use of a VA approved method to connect external equipment/systems to VA’s network. Citrix Access Gateway (CAG) is the current and only VA approved method for remote access users when using or manipulating VA information for official VA Business. VA permits CAG remote access through approved Personally Owned Equipment (POE) and Other Equipment (OE) provided the equipment meets all applicable 6500 Handbook requirements for POE/OE. All of the security controls required for Government furnished equipment (GFE) must be utilized in approved POE or OE. The Contractor shall provide proof to the COR for review and approval that their POE or OE meets the VA Handbook 6500 requirements and VA Handbook 6500.6 Appendix C, herein incorporated as Addendum B, before use. CAG authorized users shall not be permitted to copy, print or save any VA information accessed via CAG at any time. VA prohibits remote access to VA’s network from non-North Atlantic Treaty Organization (NATO) countries. The exception to this is countries where VA has approved operations established (e.g. Philippines and South Korea). Exceptions are determined by the COR in coordination with the Information Security Officer (ISO) and Privacy Officer (PO).

This remote access may provide access to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, PAL, Primavera, and Remedy, including appropriate seat management and user licenses, depending upon the level of access granted. The Contractor shall utilize government-provided software development and test accounts, document and requirements repositories, etc. as required for the development, storage, maintenance and delivery of products within the scope of this effort. The Contractor shall not transmit, store or otherwise maintain sensitive data or products in Contractor systems (or media) within the VA firewall IAW VA Handbook 6500.6 dated March 12, 2010. All VA sensitive information shall be protected at all times in accordance with VA Handbook 6500, local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this PWS. The Contractor shall ensure all work is performed in countries deemed not to pose a significant security risk. For detailed Security and Privacy Requirements (additional requirements of the contract consolidated into an addendum for easy reference) refer to ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED and ADDENDUM B - VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE.

GOVERNMENT FURNISHED PROPERTY

The Government will not provide any Government Furnished Property for this contract. The Government will furnish information such as data files, guidance, and reference materials, which may be shared with the contractor via secure government email or other approved electronic means. All Government Furnished Information shall be handled in accordance with applicable security, privacy, and data-protection requirements, and used solely for the purposes of contract performance.

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

VA Internet and Intranet Standards The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains but is not limited to: creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

Notice of the Federal Accessibility Law Affecting All Information and Communication Technology (ICT) Procurements (Section 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

Section 508 – Information and Communication Technology (ICT) Standards The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

Compatibility with Assistive Technology The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

Acceptance and Acceptance Testing Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

Confidentiality and Non-Disclosure The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

APPLICABLE PARAGRAPHS TAILORED FROM: THE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6, APPENDIX C, APRIL 22, 2024

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality- assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above- mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as…