P09 - Birmingham VA PWS 2022 new.pdf

Last Updated: 02/01/22

BIRMINGHAM VA PERFORMANCE WORK STATEMENT (PWS) FOR COMMUNITY

NURSING HOMES

A. Overview

1. Federal Acquisition Regulation (FAR) – Indefinite Delivery Indefinite Quantity Contract (IDIQ). In accordance with FAR 16.504, Indefinite-Quantity Contracts, this is an IDIQ with an ordering period of up to five years beginning from the date of award. This requirement is being solicited under the authority of 38 U.S.C. 8153 and VAAR Part 873.

2. Services Rendered at VA Per Diem Rates. Upon acceptance of a VA patient by the CNH, if and when requested by the VA Contracting Officer or Ordering Officer when delegated, the Contractor shall furnish all supplies and services herein described, at the per diem rates for the ”Levels of Care” specified in the Schedule of Items of this IDIQ. The VA “Levels of Care” are defined in an attachment in Section D.1 of the solicitation and the IDIQ. VA is obligated only to the extent authorized if placement of patients is made in accordance with the terms specified in the IDIQ.

3. Ordering. Orders may be issued by Ordering Officers to place Veterans in Nursing Homes utilizing the CPRS system at VA hospital sites. Ordering Officer Contact information is as follows:

Ordering Officer Name: Wendy Pounders Contracting Specialist: Frederick Weddington Address 6439 Garners Ferry Rd, Columbia, SC 29209 Telephone number 703-823-3907 E-mail address Frederick.weddington@va.gov

B. Introduction. The Community Nursing Home (CNH) program is a key component of the Veterans Health Administration (VHA) continuum of care. The Contractor agrees to provide in accordance with the terms and conditions stated herein to the U.S.

Department of Veterans Affairs Birmingham VA Health Care System, in Birmingham, AL at the prices specified in the section titled Schedule of Items of this IDIQ. Nursing home facilities in the CNH program shall cooperate with VA staff in referral of appropriate veterans for care and accept veterans of which they have the capability/capacity to care. The term, “facilities,” shall include but not be limited to rooms, wards, sections, eating areas, drinking fountains, entrances, and other like areas.

C. Requirements

1. General. Nursing home facilities in the CNH program shall ensure that care meets the health needs and promotes the maximum well-being of VA patients. Nursing home care will be furnished to ensure the total medical, nursing, and psychosocial needs of VA beneficiaries. All nursing home facilities in VA’s CNH program must have current Center for Medicare and Medicaid Services (CMS) certification (Medicare and/or Medicaid) and a State nursing home license. VA often has a particular need for specialty care services in the CNH program. The VA requires CNHs to have bed capacity to ensure their ability to take referrals when requested.

The CNH also must be able to accept VA referrals in a timely fashion (ideally within 24 hours of request). Provider visits will be available at the rate of one (1) visit per month. Laboratory, x-ray, and other special services will be available to VA patients as needed. In addition, the care provided will include room, meals, nursing care, and other services or supplies commensurate with the VA-authorized level of care, without extra charge. Duly authorized representatives of VA will provide quality oversight visits to veterans placed to assure continuity of care and to assist in the veterans’ transition back into the community. These visits do not substitute nor relieve the CNH in any way of the responsibility for the daily care and medical treatment of the veteran. The per diem rate(s) established in this IDIQ will include the cost of primary medical care, one (1) provider visit per month and needed consultation, drugs and routine supplies, laboratory, x-ray, and other special services authorized by VA, unless otherwise specifically excepted (see Schedule of Items in this IDIQ for details regarding per diem rates and coverage). Full attention shall be given to motivating and educating patients to achieve and maintain independence in the activities of daily living. Every effort shall be made to keep patients ambulatory and to achieve an optimal level of self-care.

2. Termination of Services. VA reserves the right to remove any or all VA patients from the CNH at any time when it is determined to be in the best interest of VA or the patients without additional costs to the Government.

3. VA Authorizations. Authorization for nursing home care will be submitted on VA Form 10-7078 , “Authorization and Invoice for Medical and Hospital Services” or UB-04 CMS-1450. Each authorization validity period will be noted on the VA Form 10-7078 with a beginning and end date. Any extension to the original authorization validity period, regardless of the number of days, requires a new VA Form 10-7078.

This is also the case for form UB-04 CMS-1450.

https://www.va.gov/vaforms/medical/pdf/VHA-10-7078-fill.pdf

4. Rate Basis. VA will utilize the appropriate Resource Utilization Grouping (RUG) rate(s) as a guide to determine VA rates. The VA rate will include the cost of medical care, routine medications, laboratory, x-ray, therapy (ies), and other special services authorized by VA, unless otherwise specifically exempted. VA will contract for appropriate categories of care using Resource Utilization Groups (RUGs-IV) as a reference or guide.

The Level of Care classification and associated per diem rates will remain in effect for each placement until and unless one of the following events takes place:

a. Re-hospitalization that may be associated with a change in level of care;

b. Need for more intensive therapy;

c. Significant change in condition; or

d. Classification changes may also occur based on a determination by VA.

e. Medicaid Rates. The per diem rate will be established by utilizing the current Medicaid rate including the cost of supplies, services, and equipment above that which is provided under Medicaid. Medicaid rates established after the Effective Date of this IDIQ will require a modification to the IDIQ. The RUGS IV rates include room, board, and routine nursing care, rehabilitation therapy (including physical, speech and occupational therapy), respiratory therapy, oxygen therapy, medical and nursing supplies (including items such as urological and colostomy supplies), most oral medications, most items of durable medical equipment (excluding ventilators), x-rays, and routine laboratory tests (see Schedule of Items in this IDIQ for details on rates). Any additional requests for payment to the all-inclusive per diem rates must be pre-approved by the VA.

f. The CNH’s Minimum Data Set (MDS) Assessment for Medicare: The CNH’s Minimum Data Set (MDS) assessment will be completed on the same schedule as the current Medicare MDS-Scheduled assessments, including close of therapy (COT) assessments. Classification changes will be approved by VA, dependent on projection for short-term or long-term residence, and adhering to the most current MDS frequency guidelines from Medicare. The applicable per diem rate will continue until the next assessment. This request should be submitted on the Level of Care Authorization Form provided to the facility. VA will make the determination whether classification changes require readmission to VA. VA staff will audit approximately 20% of the MDS assessments.

5. Primary Medical Coverage. The assigned CNH provider is the primary medical provider during the nursing home stay and is responsible for writing or approving admission and all other orders as soon as the veteran arrives at the CNH. The CNH provider is responsible for general medical care, urgent evaluation and intervention.

Provider visits will be according to the Center for Medicare and Medicaid Services (CMS) guidelines. The assigned nursing home provider will provide timely care following the most current CMS guidelines; arranging 24/7 access for patient care;

arranging easy access to VA staff for consultation; providing timely response to calls and arranging for timely provider back-up according to OBRA guidelines (42 CFR 483.40, OBRA Guidelines).

6. Rehabilitation Criteria. All therapy provided under this IDIQ will be individual therapy, rather than group therapy, unless otherwise ordered by the authorizing VA facility. Therapy may require pre-approval by VA before services are provided.

Medical Restorative criteria will be used for physical therapy, occupational therapy, and speech therapy. Therapy must be skilled, relate to safety and be restorative according to Medicare criteria.

a. Description of Rehabilitative Therapy. The concept of rehabilitative therapy includes recovery or improvement in function and, when possible, restoration to a previous level of health and well-being. Therefore, evaluation, re-evaluation and assessment documented in the Progress Report should describe objective measurements which, when compared, show improvements in function, or decrease in severity, or justification for an optimistic outlook to justify continued treatment. Covered therapy services shall be rehabilitative therapy services unless they meet the criteria for maintenance therapy requiring the skills of a therapist.

b. Evaluations/re-evaluations should consider the following: Establishment of treatment goals specific to the patient’s disability or dysfunction and designed to specifically address each problem identified in the evaluation;

design of a plan of care addressing the patient’s disorder, including establishment of procedures to obtain goals, determining the frequency and intensity of treatment; continued assessment and analysis during implementation of the services at regular intervals; instruction leading to establishment of compensatory skills; selection of devices to replace or augment a function (e.g., for use as an alternative communication system and short-term training on use of the device or system); and patient and family training to augment rehabilitative treatment or establish a maintenance program. Education of staff and family should be ongoing.

7. Emergency Care; Financial Responsibility; Advanced Directives. In emergencies, nursing home staff will utilize the 911 local emergency systems as for any resident. Advance directives or living wills shall be adhered to according to the CNH physician’s orders. When private hospitalization or emergency services are required, the patient, spouse, financial guardian or insurer is financially responsible.

Service connected veterans may qualify for VA coverage of emergency care provided the VA Health Care System (VAHCS) is contacted by the private hospital provider within 72-hours of admission on the first business day following a weekend or holiday. This includes the cost of necessary transportation for such care.

8. HIPAA Compliance. HIPAA compliance is required. The Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). As required by HIPAA, the Department of Health and Human Services (HHS) has promulgated rules governing the security and use and disclosure of protected health information by covered entities, including the Department of Veterans Affairs (VA). In accordance with HIPAA, the Contractor may be required to enter into a Business Associate Agreement (BAA) with VA, but VACO has recognized CNH Facilities as an entity that does not require a BAA as long as they are conducting health care on VA’s behalf. The CNH care program qualifies as a medical service, so no BAA is required.

9. Quality Expectations for CNH’s:

a. To participate in VA’s CNH Program, NHs are expected to have either 1) a three-star overall rating, or 2) a two-star overall rating with a four star or greater quality measures score on the Centers for Medicare and Medicaid (CMS) Nursing Home Compare Web site (https://www.medicare.gov/nursinghomecompare/search.html).

b. NHs with lower scores may participate in the CNH program only when a waiver has been filed and signed by Birmingham VA Director and VISN 7 Director. It is then posted to the National Sharepoint Community Nursing Home - CNH Medicare Star Rating Waivers - All Documents (sharepoint.com)

c. All NHs in the CNH Program must be certified by CMS under Title XVIII

(Medicare) or Title XIX (Medicaid), or have received special approval from the Office of Geriatrics and Extended Care (GEC) Office. NHs are responsible to the state of jurisdiction and CMS for the care provided. VA does not regulate the care or inspect CNHs. VA acts as an informed purchaser of care in order to purchase quality services for Veterans and enhance the Veterans’ experience in the home.

https://dvagov.sharepoint.com/sites/vhacommunity-nursing-home/CNH%20Medicare%20Star%20Rating%20Waivers/Forms/AllItems.aspx https://dvagov.sharepoint.com/sites/vhacommunity-nursing-home/CNH%20Medicare%20Star%20Rating%20Waivers/Forms/AllItems.aspx

D. The CNH must maintain a current and unrestricted state license to operate as a skilled nursing facility. Changes in the status of the licensure will be immediately reported to the Birmingham VA Home and Community Care Department at 205-440-9070 or email wendy.pounders@va.gov. VA will monitor the professional care and administrative management of services provided to VA beneficiaries under this IDIQ (reference 9.a.).

The CNH shall cooperate fully with VA’s quality improvement or quality assurance program functions relating to this IDIQ. The VA Contracting Officer shall make all final determinations as to the Contractor’s reasonable cooperation with VA and compliance with these requirements.

10. Corrective Action Plan. (QASP Indicators 18): The CNH will cooperate with timely development of Corrective Action Plans (CAPs) related to identified deficiencies and related to State, Federal or VA surveys. The CNH will develop in the time period specified by VA timely and appropriate CAPs for VA surveys or investigation of complaints related to quality of care or sentinel events. The CNH will also supply related documents or data as specified by VA. The CAPs will include but are not limited to the following criteria and shall:

a. contain elements detailing how the CNH will correct the deficiency as it relates to the individual;

b. indicate how the CNH will act to protect residents in similar situations;

c. Include the measures the CNH will take or systems that will be altered to ensure that the problem will not recur. The CNH must look at the system and determine if a change to the existing system will work, if a new system is necessary, or if a system does not exist and must be developed;

d. Indicate how the CNH plans to monitor performance to make sure that solutions are permanent. The CNH must develop a quality assurance tool for ensuring that correction is achieved and sustained. This tool must be implemented. Failure to implement a quality assurance tool to sustain compliance will reflect that the CNH has an ineffective quality assurance system; and

e. Provide dates when corrective action will be completed.

11. Life Safety Code. The CNH’s building shall conform to the most recent standards of the Life Safety Code (National Fire Protection Association Standard #101) in effect on the date of the IDIQ award. In addition, the CNH shall be in compliance with all applicable Federal, State and local regulations. The administrator of the CNH is required to notify the VA Contracting Officer in writing at least thirty mailto:wendy.pounders@va.gov

(30) calendar days prior to any planned facility changes that could impact the Life Safety Code and other safety features of the facility which were in existence at the time this IDIQ became effective. The VA Contracting Officer will notify the VA Safety Manager responsible for the Life Safety Code inspection of the CNH and he/she will review (inspect the facility if required) the proposed changes and provide necessary approval or disapproval of the CNH to house veterans during and/or after the proposed changes. These changes may include but are not limited to:

a. Interior changes requiring VA approval. Some examples of facility changes that require the VA Contracting Officer notification are as follows: interior finish, corridor partitions/walls, patient room doors, linen or trash chutes, exits, emergency lighting, fire alarm systems, automatic sprinklers, smoke barrier walls or doors, oxygen systems, compressed gas storage, HVAC, electrical and fuel gas systems;

b. Automatic sprinkler system. All VA contracted CNH facilities are to be fully-equipped with a fully-automatic sprinkler system installed in accordance with the National Fire Protection Association’s (NFPA) standards and be 100% sprinklered;

c. Natural disasters. In the event of a natural disaster (flood, tornado, etc.), the CNH shall communicate all action plans to VA. The action plans will at a minimum identify temporary transfers of location, dates, and names of veterans transferred; and

d. Major construction; additions; and renovations. Major construction including building additions or other renovations which may affect physical plant integrity; SHALL MEET latest NFPA 101 Life/Safety Code requirements as well as any additional VA CNH construction standards in place at time of renovation or alteration.

12. Acceptable Safety and Sanitation Practices. Acceptable safety and sanitation practices shall be observed throughout the facility. The CNH will address employee and patient safety practices through staff orientation, training and adherence to related policy or procedures to provide a safe and clean environment.

13. Re-admission to the VA Hospital and Emergency Care; Notification of Death of Veterans; CNH Responsibility for Veteran’s Belongings or Personal Effects (QASP Indicator 2,12). VA beneficiaries who begin to require more than the level of care authorized by VA will be readmitted to an appropriate VA facility, as determined and authorized by VA.

a. When such an admission is not feasible because of the nature of the emergency, hospitalization in a non-Federal facility may be accomplished provided VA authorization is obtained. VA authorization must be obtained within 72-hours of admission of the patient to a non-Federal facility and notice of any veteran death within 24-hours or immediately upon the first business day after a weekend or holiday. If hospitalization of a non-emergency nature is required, readmission to a VA Medical Center may be accomplished as soon as the patient’s condition is sufficiently stabilized to permit admission to a VA Medical Center.

b. In the event of a death of any veteran, the Contractor agrees to notify VA immediately of the death. In the event a death of a VA beneficiary while receiving nursing home care under this IDIQ, the CNH will promptly notify the VA facility which authorized admission and immediately assemble, inventory, and safeguard the patient’s personal effects. The funds, deposits, and effects left by the VA patients upon the premises of the CNH shall be delivered by the CNH to the person(s) entitled thereto under the laws currently governing the CNH for making disposition of funds and effects left by patients, unless the beneficiary died without leaving a will, heirs or next of kin capable of inheriting.

c. When disposition has been made, the itemized inventory with annotation as to the disposition of the funds and effects will be immediately forwarded to the VA facility that authorized admission. Should a deceased patient leave no will, heirs, or next of kin, his/her personal property and funds wherever located vests in and becomes the property of the United States in trust. In these cases, the CNH will forward an inventory of any such property and funds in its possession to the VA facility authorizing admission and will hold them (except articles of clothing necessary for proper burial) under safeguard until instructions are received from VA concerning disposition. CMS regulations require retention of records for five (5) years when there is no requirement in State law.

14. Leave of Absence (LOA) – Bed-Hold Statement. For re-hospitalizations or therapeutic passes, VA will not pay a bed hold. Therapeutic passes will be authorized by the CNH staff based on individual patient needs but are generally limited to 3 days in a quarter and should be pre-approved by VA for long term patients. VA will not cover bed holds. If a veteran does not return from LOA, the veteran’s contract will be terminated immediately.

Bed-hold will begin the date the resident leaves the CNH and full per diem will resume on the date of readmission to the CNH. Absences of fifteen (15) consecutive calendar days or more, whether in a VA or in a non-Federal facility require a new authorization agreement. The nursing home is responsible to notify the family if a bed hold is required. The family would then make arrangements with the home to hold the bed.

15. Reportable Events (QASP Indicators 22,17,). VA requires CNHs to report to the CNH Coordinator at VA any of the below events within 24-hours or immediately upon the first business day after a weekend or holiday. Reporting shall include date of occurrence and patient disposition and outcome.

a. Sentinel events;

b. When there is a change of ownership of the CNH;

c. When there is a change of nursing home administrator or Director of

Nursing/Director of Nursing Service;

d. substantiated allegations of mistreatment, neglect, abuse or misappropriation of CNH veterans or property;

e. Elopements of CNH veterans pursuant to state regulations;

f. Infectious outbreaks;

g. Resident to resident or resident to staff altercations involving a CNH veteran resulting in any injury that is other than minor;

h. Copies of annual surveys or substantiated complaint investigations conducted by a State oversight agency; and

i. Adverse events.

A sentinel event may include, but is not limited to the following:

1. A fall resulting in death or injury;

2. Elopement resulting in a missing patient;

3. Patient abuse confirmed or under suspicion;

4. A medication error resulting in patient illness or injury;

5. Death or patient injury related to restraint (including side rails) use; or

6. Death related to an unconfirmed or suspicious cause.

When an adverse event occurs involving a CNH Veteran which is not determined to be a Sentinel Event (but that the State requires that the occurrence be reported to the State), such event is also to be reported to VA’s CNH program office. Some adverse events, such as minor medication errors without catastrophic outcomes, are managed by the CNH in the context of their quality improvement programs. It is not necessary for nursing homes to report such incidents to the CNH program office.

16. VA Actions Regarding Serious Quality of Care Deficiencies. In cases of serious deficiencies affecting the health or safety of veterans or in cases of continued uncorrected deficiencies, VA will take one or more of the following actions in accordance with the terms and clauses of the IDIQ and applicable procurement regulations:

a. Increase VA staffing monitoring until the State survey agency clears the deficiency;

b. Suspend placement of veterans in the CNH;

c. Remove or transfer veterans under the IDIQ from the subject CNH;

d. Not renew the IDIQ; and/or

e. Terminate the IDIQ.

17. VA Staff Access to CNH Records (QASP Indicator 23). All medical records concerning the veteran’s care in the CNH shall be readily accessible to VA. Upon discharge or the death of a patient, medical records will be retained by the CNH for a period of at least five (5) years following termination of care. Patient records will be maintained in conformance with the Privacy Act of 1974 (5 U.S.C. § 552a). A medical record shall be maintained for each patient, which includes at least the following:

a. VAHCS Referral Package to the CNH:

1. Copy of Physician Orders for Nursing Home Care; CPRS Notes; Discharge Summary including History & Physical information with Medication List;

Rehabilitation Progress Notes; and Veteran Demographic Record which includes next of kin information.

2. Copy of Authorization Agreement (VAF 10-7078).

b. Nursing Home Clinical Record: The CNH must maintain clinical records on each veteran in accordance with accepted professional standards and practice.

The clinical record must be: complete, accurately documented, readily accessible, systematically organized, and legible. Clinical records must contain at a minimum:

1. Sufficient information to identify the resident;

2. A record of the veteran’s assessments, including those assessments performed by services under the IDIQ with the CNH;

3. The plan of care and services including medication administration, provided by CNH staff and services provided under the IDIQ with the CNH;

4. Interdisciplinary progress notes to include effect of care provided, veterans’ response to treatment, change in condition, and changes in treatment;

5. Medical practitioner orders which are signed and dated;

6. Allergies;

7. Person to contact in an emergency situation;

8. Name of attending medical practitioner; and

9. Advanced directives if available.

c. Clinical Record Safeguards: The CNH must safeguard clinical record information against loss, destruction, or unauthorized use. If the CNH maintains a veteran’s record by computer, electronic signatures are acceptable. If attestation is done on computer records, safeguards to prevent unauthorized access and to provide for reconstruction of information must be in place.

18. Specialty Services. The CNH will assume responsibility for arranging specialty care for veterans (e.g., dental care, podiatry and ophthalmology).

19. VA Health Care System Consultation/Resources.

(a) Telephone Care Communications Systems (TCCS): For urgent same-day outpatient specialty care or for non-urgent scheduled clinic appointments/consultations, phone number 1-866-487-4243 between 8 a.m. and 3 p.m. Monday through Friday, excluding holidays. If a same-day appointment is anticipated; please call as early as possible.

(b) Admissions Conference Call Systems phone number 1-866-487-4243 :

For non-emergency consultation or /evaluation for admission to the Birmingham VA Health Care System (after initial evaluation or intervention by the nursing home physician).

(c) After hours, weekends and holidays: For urgent referrals or consultation contact the Admission Conference Call System number 205-933-8101 ext. 334462 or 226420

(d) Transportation: Necessary transportation to and from the VA hospital for clinics, evaluation or hospitalization will be arranged and paid by the VA hospital for CNH patients when requested. For Clinic appointments, call 1-866-487-4243.

20. Charitable Contributions. The CNH will not solicit contributions, donations, or gifts from patients or family members. Note: Established charitable fundraising activities of a CNH fall outside the scope of this language.

21. CNH Billing (QASP Indicator 24). Invoices for board, care and ancillary services shall be submitted promptly to the authorizing facility by the 15th calendar day following the end of the month in which services were rendered. The CNH will promptly notify the VA CNH Coordinator regarding any change in Veteran status:

discharge, transfer, against medical advice (AMA), hospitalization, death and/or any changes in payer source and any ability to complete timely billing. All invoices must include the full name and address of the CNH and shall reflect the patient’s name, social security number, number of days billed, RUG category (ies), and agreed upon RUG rate (s). Failure to include this information may result in delayed payment. The current CNH Billing Cover Sheet can be obtained from the CNH Coordinator through the GEC department at 205-440-9070.

a. Pre-approved services billed by CMS procedures or CPT codes: All services which are pre-approved by VA as additional to the all-inclusive per diem rate must be billed according to CMS procedures or CPT codes. The CNH will be reimbursed based on local guidelines and VA pricing schedules.

b. High cost drugs: For the most part any high cost medications will be pre-approved through the VA and will be provided through the VA. If in the rare case a high medication is pre-approved for additional reimbursement through the VA, corresponding billing is due with monthly invoice and outlined on the monthly invoice.

c. Invoices: Corrected invoices must be submitted for additional payment of any ancillary costs or changes to the original billing. All corrected invoices must include all items that are affected by the change and should include the CNH corrected claim form.

22. Minimum Quantities; VA Payment. It is impossible to determine the exact or estimated amount, which will be expended under this IDIQ. No obligation will be incurred by VA under this IDIQ, until authorizations are issued for nursing home care of specific beneficiaries. VA agrees to make payment on a timely basis for services rendered in accordance with such authorizations upon receipt of proper invoices submitted by the CNH as outlined in this IDIQ. VA will make payment for the day a recipient enters the CNH but not the day the recipient leaves a CNH unless entrance and departure are on the same day, then payment will be made for one (1) day.

23. VA Payments. Payments made by VA under any contract pursuant to this IDIQ, constitute the total cost of nursing home care. No additional charges will be billed to Medicare (with the exception of hospice), Medicaid, or private insurance, the beneficiary or his/her family, either by the CNH or any third party furnishing services or supplies required for such care, unless and until specific prior authorization in writing is obtained from the VA facility authorizing placement. The patient, family and any other entitlement programs (e.g., Medicare, Medicaid, etc.) will not be billed for uncovered services or costs during the VA contract period. This constitutes double-billing and Federal fraud.

a. Vendors who bill electronically using the HIPAA-compliant claims transactions must submit claims through the VA clearinghouse, Emdeon, using payer ID number 12115 for medical claims.

b. Vendors who are not able to use the HIPAA-compliant transactions are not required to do so. Supporting information for monthly invoices will be emailed to:

Wendy Pounders Birmingham VA Health Care System wendy.pounders@va.gov

Records Management Language for Contracts

The following standard items relate to records generated in executing the contract and should be included in a typical Electronic Information Systems (EIS) procurement contract:

1. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33;

Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

mailto:wendy.pounders@va.gov

2. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

6. The Government Agency owns the rights to all data/records produced as part of this contract.

7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

8. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.

Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

10. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

27. Information Security

VA Acquisition Regulation Solicitation Provision and Contract Clause

(October 2008)

SUBPART 839.2 – Information and Information Technology Security Requirements

839.201 Contract clause for Information and Information Technology Security

Due to the threat of data breach or loss of information that resides on either VA-owned or contractor-owned systems, and to comply with federal laws and regulations, VA has developed an Information and Information Technology Security clause. To be used when VA information is used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media).

In solicitations and contracts where VA Information and/or Information Technology will be accessed or utilized, the contracting officer shall insert the clause found at 852.273-75, Security Requirements for Unclassified Information Technology Resources

852.273-75 - Security Requirements for Unclassified Information

Technology Resources (interim- October 2008)

(a) The contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA personnel, regarding information and information system security. These include, but are not limited to Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130, and guidance and standards, available from the Department of Commerce’s National Institute of Standards and Technology (NIST). This also includes the use of common security configurations available from NIST’s Web site at: http://checklists.nist.gov

(b) To ensure that appropriate security controls are in place, Contractors must follow the procedures set forth in “VA Information and Information System Security/Privacy Requirements for IT Contracts” located at the following Website:

http://www.iprm.oit.va.gov/Security_and_Privacy_Requirements_for_ Contractors.asp

VA INFORMATION AND INFORMATION SYSTEMS SECURITY/PRIVACY

LANGUAGE

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, http://checklists.nist.gov/ http://www.iprm.oit.va.gov/Security_and_Privacy_Requirements_for_Contractors.asp http://www.iprm.oit.va.gov/Security_and_Privacy_Requirements_for_Contractors.asp subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program.

The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

c. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

c. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

d. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

e. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

f. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

4. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE,

OR USE

VA prohibits the installation and use of personally owned or contractor/subcontractor-owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW or contract. All of the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA-approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned

OE.

9. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix D relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

APPENDICES

APPENDIX B: VA Acquisition Regulation Solicitation Provision and Contract Clause B-1

APPENDIX C: VA Information and Information System Security/Privacy Language for Inclusion into Contracts, as Appropriate C-1

APPENDIX D: VA Handbook 6500.6, Appendix D Contractor Rules of Behavior

END PERFORMANCE WORK STATEMENT