P09 Final SOW.docx

I. SCOPE OF WORK

The STVHCS Audie L. Murphy VA Hospital is seeking a contract for Reference laboratory services. The purpose of the resulting contract will be to provide a Blanket Purchase Agreement (BPA) for Reference Laboratory Fee Basis testing for the South Texas Veterans Health Care System (STVHCS), Audie L. Murphy Division located at 7400 Merton Minter Blvd., San Antonio, TX 78229-4404. Contractors shall provide in accordance with the specifications outlined below a full range of referral laboratory services to include patient testing, courier services and the ability to interface with the current VA Vista and CPRS systems for the Audie L. Murphy VA and Kerrville VA laboratories, for a Base + 4 option year contract period.

Services at minimum must include:

Daily transportation of clinical laboratory specimens from the STVHCS facilities to the Contractor's laboratory(s), the performance of analytical testing as defined by the Contractor's reference test manual and the required testing listed on Attachment A, the reporting of analytical test results and consultative services as required to assimilate the full scope of its laboratory operations to STVHCS and any supplies needed to ship specimens according to Federal and State Requirements of Category A and B Specimens.

NOTE: Attachment A and B contain an estimate of required testing based upon prior history of actual volumes and is not a guaranteed minimum. This list serves only as the base guideline of tests required by the STVHCS. Vendor should be able to provide pricing guidelines for all other tests not listed on Attachment A and B.

All requirements and provisions defined in the specifications of this solicitation shall apply to any laboratory, i.e. branch, division, Subcontractor, etc. performing reference testing on behalf of the Contractor.

II. DESCRIPTION OF SERVICES

Requirements/Services to Be Provided:

A. Specimen Testing

i. The Contractor shall provide timely (defined by the minimum and maximum turnaround times detailed in the description of requirements) and appropriate testing of patient specimens as requested by STVHCS facilities.

ii. The STVHCS facilities reserve the right to select other testing methodologies than offered by the Contractor's laboratory for appropriate reasons, i.e. better clinical quality, research studies or those determined for performance at STVHCS centers of excellence. STVHCS facilities that identify such a testing methodology not meeting their testing criteria must submit a request for review to a STVHCS adjudicating panel with sufficient justification to warrant an exemption from the contract. These rare test exemptions will be re-referred to another reference laboratory and the costs borne by the requesting STVHCS facility.

iii. The STVHCS facilities reserve the right to identify testing issues with the Contractor’s laboratory test results due to inconsistent results and/or testing accuracy (i.e. positive blood culture that has a final report of no growth, false positive screen that is reported as negative, inconsistent gram stain result when compared to the final report, etc.).

iv. The STVHCS reserve the right to identify testing concerns with the Contractor’s laboratory due to testing delays (i.e. no notification of sample issues, reports not labeled correctly, or an increase noted in the number of corrected reports, etc.).

v. In order to minimize the number of tubes drawn, the contractor, annually, shall evaluate each site commonly ordered tests, working with the individual sites, develop test order numbers that shall combine applicable tests; therefore, reducing the number of reference test samples drawn.

B. Sample Processing

i. Each STVHCS facility will provide laboratory specimens properly collected identified with both the Patient’s Identification (as utilized by each facility) and requested tests. For those specimens that require special handling, the Contractor shall provide at no additional charge an adequate supply of specimen collection materials for such testing that is destined to the commercial reference laboratory for analysis (i.e. dry ice, stabilizing tablets, ice packets, 24-hour collection container with preservatives, special collection tubes, etc.).

ii. The Contractor shall be responsible for transporting and storing specimens in such a manner as to ensure the integrity of the specimen. Safety Data Sheets will be provided to sites as appropriate for supplies containing hazardous chemicals (e.g. boric acid tablets, acids).

C. Transportation Services for the VA Facilities

i. The Contractor shall provide reference testing transportation services between the STVHCS and contracted laboratory. Service shall include minimally one (1) pick-up per day at each facility. Time frames as follows: Monday - Friday excluding federal holidays (holidays for the purpose of the attachment shall be defined as: New Year's Day, MLK Day, President’s Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day and Christmas Day). STAT pick-ups shall be Monday through Friday between 8:00 am and 5:00 pm. Pick-ups and deliveries may be needed on an as needed basis. Facility shall notify Contractor of the need for each unscheduled pick-up by phone. The contractor must provide procedures and points of contact for STAT, as needed pickups for the Facility to follow. The Contract must transport all laboratory samples correctly (i.e. frozen, room temperature, refrigerated) so that specimen integrity is not compromised.

ii. Two (2) months after the awarded contract is in operation, the STVHCS facilities may exercise the right to adjust the transportation schedule with respect to the timetable and the number of daily pick-ups. A modified courier schedule for each facility may then be established.

iii. The Contractor shall provide specimen pick-up/delivery services regardless of the number of specimens picked up. Contractor must define procedures for urgent transportation services and shall be equal to the routine level services and be available 24 hours per day, seven days per week including all Government holidays, and any other day specifically declared by the President of the United States to be a National holiday.

iv. Response time for emergency transportation services shall be within 1 hour of notification of specimen availability. These services shall be provided at a negotiated expense rate per unit of service. If not otherwise defined in this contract, the services will be considered included at no additional charge. A unit of service is defined as a call for urgent transportation regardless of the number of specimens included in the transport.

v. Urgent testing services shall be available for all procedures deemed necessary on an emergent basis. This service shall be provided at a negotiated expense rate per test, as specified at the time of solicitation. If not otherwise defined in this contract, the services will be considered included at no additional charge. The test results will be reported within four (4) hours from the time the specimen is collected/picked up by the Contractor.

vi. The contracted commercial reference laboratory shall be responsible for ensuring that all transport personnel are trained and follow the storage requirements for all laboratory specimens. They must ensure that their competency is regularly assessed in appropriate safety and packaging procedures suitable for specimen type and distances transported. This shall include issues such as adherence to regulations for the transport of biohazards, use of rigid containers where appropriate, handling of Category A and B specimens, aware of the importance of temperature control, and equipped with the knowledge of notification procedures in case of accident or spills, etc. The contracted commercial reference laboratory shall submit evidence of their training and annual competence programs initially and each renewal year. During the term of this contract, this program may need to be updated and/or revised to comply with regulatory requirements. This documentation shall be made available to the STVHCS facilities upon their request.

vii. Upon each pick-up or delivery of reference testing specimens by the Contractor, a shipping manifest shall be provided detailing specimen identification, source and destination information.

viii. It shall be the responsibility of the contracted commercial reference laboratory to ensure that the contracted/sub-contracted transport personnel comply with all policies and procedures for tracking specimens. These policies and procedures will be mutually agreed upon between STVHCS and the Contractor and shall include, but may not be limited to, documentation of dispatch and receipt of specimens, condition of specimens upon receipt, definition of transport personnel, etc.

ix. Transportation/ Courier services shall be extended to all new STVHCS facilities acquired during the contract period at a negotiated cost. When additions occur, a bi-lateral contract modification will be executed.

D. Reporting of Results

i. A report is defined as a printed final copy of the laboratory testing results or host-to-host electronic transmission of test results. This report as defined by the individual facility shall be received by either: computer interface, fax, and /or messenger delivery. Specifications outlining the requirements of this computer interface including computer hardware, maintenance and supply requirements are defined in the Telecommunication Requirements section of this solicitation.

ii. Each test report shall at minimum indicate the following information:

· Patient's name and/or identification number

· Physician's name (if supplied)

· VISN 17 medical record number or laboratory accession number (if supplied)

· VISN 17 submitting facility name

· Patient's location (clinic/ward) (if supplied)

· Test ordered

· Date/time of specimen collection (when available)

· Date/time test completed

· Test result

· Reference intervals

· Toxic and therapeutic ranges, if applicable

· Flagged abnormal test results

· Reference laboratory specimen number

· Name of testing laboratory, if other than Contractor

· Any other information the laboratory has that may indicate a questionable validity of test results

· Unsatisfactory specimen shall be reported with documentation supporting its unsuitability for testing

iii. Test results shall be received within 24 hours following specimen pick-up either by hard copy or electronic report transmission. It is recognized that certain test procedures will require a longer turn-around time than 24 hours. The Contractor shall provide a list of the estimated turn-around time for any tests that require longer than 24 hours to complete.

iv. Notification of a test result that has been identified in the commercial reference Contractor laboratory as a critical or alert value shall be communicated by telephone to the submitting VISN 17 laboratory upon verification of the critical or alert test result. A hard copy result must follow any telephonic reporting either by fax or computer-generated report.

v. Contractor shall provide daily, by 12:00 PM, a report listing all incomplete specimens and their processing status.

vi. The Contractor shall state their policy and any associated fees for repeat testing if requested by the provider.

E. Customer Service

i. The Contractor shall provide in response to this solicitation with a detailed plan describing their customer service strategies for STVHCS if Contractor's specimen processing personnel are located on site at the facility or if they are not located on site at the facility. This plan shall address the capability and/or availability of the commercial reference laboratory Contractor to provide the following services and, if applicable, specify how this service will be accomplished, by whom, and within what timeframe:

ii. Telephone Inquiries:

Telephone inquiries are divided into four major categories with additional subcategories defining the type of inquiry and the VA minimum time expectation for meeting this service.

· Specimen Collection Routine inquiries where the reference laboratory performs the actual testing - if further clarification of the collection requirements are needed, shall be addressed at the time of the inquiry.

Esoteric inquiries, where the information on the availability and/or requirements of the questioned test requires further research, shall be addressed within ½ hour of the initial inquiry.

· Testing

Status of Ordered Testing - inquiries regarding the status of pending orders shall be addressed at the time of the inquiry.

Esoteric inquiries where information is requested regarding methodology, correlation, interferences, reflex tests, etc. shall be addressed within two (2) hours of the initial inquiry.

· Technical Expertise

Test utilization inquiries where information is required as to the most appropriate test to be ordered shall be addressed within two (2) hours of initial inquiry.

Result interpretation inquiries shall be addressed within four (4) hours of initial inquiry.

Consultative services where information is required regarding the clinical significance of the test or inquiries by the provider into what is the best test to order for more effective patient care shall be addressed within twenty-four (24) hours of the initial inquiry.

Computer interface questions where information is required to update, maintain, and support the services of the host-to-host linkage between the VA and the Contractor shall be addressed within two (2) hours of the initial inquiry.

iii. Account Follow-up

a. Account follow-up that requires information general in nature yet specific to the account, e.g. test pricing, courier service problems, specimen results discrepancy issues, equipment repair, supply ordering, etc. shall be addressed within four (4) hours of the initial inquiry.

F. Data Management System

i. Test ordering is easily accomplished through a menu that is intuitive, has minimal options and uses a mouse or touch screen. Upon selection of the test, the computer shall alert (flag) the user to the type of specimen required and the storage conditions. It should also alert the user to the location of the laboratory that will be performing the test.

ii. Test definitions, test information and test requirements are complete, available, and easily accessible.

iii. The status and the results of testing are available within published timeframes and easily retrievable using varying options. Examples of these options are through a patient search, a sort by timeframe, a sort by test, a sort of incomplete tests, etc. Incomplete tests shall have an indication of the pending time until completion. Alert messages are generated when testing is delayed beyond published timeframes, when specimens require additional testing (reflex), or when specimens are cancelled due to unacceptability.

iv. Reports of test results shall be immediately available upon verification of the test result. The computer must be able to print test results upon request and reprint retrospective test results according to a defined timeframe.

v. Shipping manifest is generated that identifies the specimens sent to the commercial reference laboratory, transportation conditions, and testing ordered.

vi. The ordering of specimen collection and transportation supplies is accomplished through direct on-line ordering.

vii. Current STVHCS contracted price information is available through the computer or through other electronic modes.

G. Notification Requirements

i. The notification of critical values shall be determined by each individual facility.

ii. The notification of rejected samples shall be determined by each individual facility. The Contractor needs to specify the process their facility performs in trying to locate additional sample before rejecting a test.

iii. Telephone notification of specimens cancelled due to unacceptability, i.e. volume, specimen container identification, loss of specimen, etc. shall be determined by each individual facility.

iv. A hard copy test catalog shall be published on an annual basis and enough copies shall be distributed to each account within the STVHCS. Addendums/ updates to the test catalog shall be made available (either electronically or in hard copy) to each STVHCS account in a reasonable timeframe (no less than two weeks) prior to the effective change of the test so that adequate preparations can be made to facilitate the test transition. The test catalog shall include all test information as required by the regulatory requirements of the College of American Pathologists and/or other laboratory credentialing. A reference guide to test interpretation must also be available.

H. Specimen Storage

The Contractor shall store the specimens a minimum of seven (7) to ten (10) days after the test is reported if subsequent action is necessary (i.e. problem solving, add-on test, and/or repeat testing). The Contractor shall state their specimen retention time.

I. Performance Improvement (PI) and Quality Assurance Activities

i. The Contractor shall provide in response to this solicitation a detailed plan describing their proposal for performance improvement activities that are specific to the VISN 17 facilities identified in this solicitation. This plan shall minimally address the quality aspects representative to the testing process, i.e. pre-analytical, analytical and post-analytical variables and include a description of monitoring and evaluation activities.

ii. The Contractors PI plan shall also include a description of their procedure for responding to issues, problems and/or concerns identified by the VISN 17 laboratories and specific information as to whom and in what time frame the matters will be reconciled. The issues that may need to be addressed may be general in nature or specific to an incident or event.

iii. The Contractor shall provide the STVHCS facilities with a quarterly report of the Contractor’s PI monitors and data.

iv. The Contractor shall provide a detailed plan describing their Quality Assurance monitors to include completeness, accuracy and reliability of tests results. The quality control processes should be in place for all phases of testing. The monitors may include positive identification of patient and specimen, acceptability of specimens received for testing, accuracy of data entry of test orders, accuracy of data entry of test results, revised reports, and/or lost specimens.

v. The Contractor may offer presentations/webinars/ teleconferences of new technology updates or services.

J. Utilization Reports

i. One copy of the following reports shall be available to each STVHCS VA facility by the 20th of the month following the close of the reporting month:

a. Monthly cumulative summary alphabetically by patient for each STVHCS VA facility indicating name, test ordered, date specimen received and ordering physician

b. Monthly summary sheet by test frequency for each STVHCS VA facility listing patient name, volume of tests ordered, unit charge, total charges for this month and year to date.

c. Summary sheet listing the type and volume of testing sent to a sub-contracted reference laboratory.

ii. One copy of the following reports shall be available to the network office by the 20th of the month following the close of the reporting month:

a. Monthly summary sheet by dollar volume for each STVHCS VA facility listing tests in descending order of dollar volume with volume of tests ordered, unit charge for each test, total charges for months and year to date.

b. Summary sheet by test frequency of the entire STVHCS laboratory utilization listing by STVHCS Primary VA facility all test ordered, the volume of tests ordered, unit charge per tests, total charges and percent abnormal results for the period.

c. Summary sheet listing the type and volume of testing sent to a sub-contracted reference laboratory.

iii. The Contractor shall provide access-on-demand utilization reports – Utilization details and utilization spend report where each facility will have access to self-service customizable reports to analyze utilization patterns and costs. The ability to view these reports will make it faster and easier to identify improvement opportunities, promote clinically appropriate test selection, and track ongoing metrics to monitor progress for more uniform and cost-effective care.

iv. The Contractor shall annually provide a statistical analysis of the STVHCS VA facilities’ workload testing volumes to assist in the monitoring of ordering trends and utilization patterns.

v. The Contractor may annually offer a consultation with recommendations for each facility where they analyze the facility’s testing patterns and compare them against benchmarks by time, age and geographic site.

vi. The Contractor is encouraged to offer a spectrum of value-added incentives. Such incentives may include customer and professional service programs that assist the VISN 17 facilities with the usage of the Contractor's products in the most cost-efficient manner.

K. INVOICING:

Payment to be made monthly in arrears by certified invoices and must contain the contract number and obligation number in addition to the requirements detailed in 52.212-4 (G) to be considered valid. Invoices shall also contain a line item for each test and quantities billed for according to contract period of performance with dates of service for each patient. STVHCS will not pay for tests that are not clearly identified by accession number on the Contractors invoice.

L. WORK HOURS:

The contractor shall be responsible for providing services between the hours of 8:00 am and 5:00 pm Monday through Friday excluding Federal Holidays. Federal Holidays are as follows:

New Year’s Day, Martin Luther King Day, President’s Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, Christmas Day and any other day specifically designated as a national holiday by the President of the United States.

III. LICENSURES

Only fully licensed/accredited laboratories actively engaged in providing the specific services and laboratory testing outlined in this solicitation shall be considered. The reference laboratory shall be licensed, accredited, and inspected by the Laboratory Accreditation Program (LAP) of an accrediting agency [i.e. Commission of Laboratory Accreditation (COLA), College of American Pathologists (CAP)] with deemed status from the Center for Medicare and Medicaid Services (CMS), American Associates of Blood Banks (AABB), Joint Commission (JC), Center for Disease Control (CDC), Medicare, Food and Drug Administration(FDA) and/or other state regulatory agencies as mandated by federal and state statutes and VHA Handbook 1106.1. In addition, the reference laboratory shall be certified as meeting the requirements of the Clinical Laboratory Improvement Act of 1988 and comply with the National Standards to Protect the Privacy of Personal Health Information (HIPPA).

Copies of all relevant permits, licenses and certification of the Contractor and any subcontractor of the primary Contractor if tests and/or services are sent to another facility for testing, inclusive of any sanctions current or pending throughout the United States of America shall be supplied in response to this solicitation. In addition, as these documents for the Contractor and subcontracted facilities are reissued for accreditation, reworded, or renewed, the awarded Contractor shall supply a copy to the STVHCS facilities annually.

IV. QUALITY

The Government reserves the right to physically inspect the reference laboratory(s) prior to a contract award and at any time during the award period to ensure the reference laboratory's compliance with accreditation and quality assurance practices and requirements.

In addition, the reference laboratory shall provide the following documentation with their offer:

1. Professional Staff Curricula Vitae

2. Technical Staff Competency Skills Assessment

3. Technical and Courier Staff Shipping and Handling of Laboratory Specimens/Hazardous Materials Training and Assessment

4. CAP and/or any other Proficiency Exam Participation for the past two (2) years

5. Proficiency Examination Exception Reports for the past two (2) years

6. Policy, list of tests and associated results for critical and alert value notification

7. Description of Performance Improvement (Quality Assurance) Program/Plan

8. Current performance improvement monitors that include and not limited to demonstration of number of lost/damaged specimens, number of cancelled specimens, delays in turnaround times (including but not limited to: due to lack of staffing, lack of availability of reagents, instrumentation issues, etc.), resolution of complaints, errors in reporting patient results, and courier route delays/cancellations

9. Other Quality Assurance Monitors as defined by STVHCS.

V. TELECOMMUNICATION AND COMPUTER SERVICES:

Contractor must already have a VA nationally approved Business Partner Gateway (BPG)/Interconnection Security Agreement (ISA), which allows the contractor’s computer system to interface with the VA computer system, so that test results are imported directly into the computerized patient record system (CPRS).

The Contractor shall meet all Enterprise Cyber Security Infrastructure Project (ECSIP) requirements in order to establish an interconnection with the VA for transfer of laboratory test results directly into a VA computer system via the appropriate Laboratory Electronic Data Interchange protocol. There are three basic types of authorized connections. The ECSIP team will have the ultimate decision on which connection type is appropriate. The connection types are described below. More information can be obtained from the VA Information Security Officer at any facility or directly from the ECSIP team.

See attachment: “CHECKLIST FOR INFORMATION SECURITY IN THE INITIATION PHASE OF ACQUISITION” from the VA HANDBOOK 6500.6 APPENDIX A which must be completed with the contractor’s quote.

External users shall be classified in one of three distinct categories: 1) client-to-site VPN, 2) site-to-site VPN, or 3) Business Partner Gateways. Table 1 can be utilized in assisting users to determine which category a connection may best be identified.

1. Client-to-Site VPNs satisfy remote connectivity for small groups of external users (IE <50) that require access to VA internal resources. Non- VA users are restricted to specific internal IP addresses identified by the Contracting Officer Representative (COR). External business partners should have access to the minimum resources required to meet contractual obligations.

2. Site-to-Site VPNs are connections to external business partners, which terminate in an ECSIP gateway. These connections will then be routed across the VA WAN to the requisite VA facility resources as defined by firewall policy.

3. Business Partner Gateways (BPGs) are connections to external business partners, which terminate at the requisite VA facility and do not traverse the VA WAN. These connections will be limited in number based on CIO requirement definitions.

Table 1:

Numerous Users - Having a significant number of client-to-site user accounts to manage may justify a site-to-site VPN.

X

Persistent Connection Required - The need to maintain continuous connectivity can usually be supported with a site- to-site VPN.

High Bandwidth- A large volume of traffic may be a valid need to establish or maintain a Business Partner Gateway (BPG) connection (0 prevent certain traffic from traversing the VA WAN. As an example, a medical teaching University supported by a VA Hospital that sends large radiological images on a regular basis. This could have a detrimental impact on the VA WAN if that traffic traverses the WAN through a VPN connection.

X

Service Level Agreements- SLAs that guarantee specific levels of support to contracted agencies that could not be provided using a One-VA VPN may also justify a BPG connection.

X

High Availability- Availability of critical business processes, such as financial and medical applications, may justify maintaining a BPG to minimize the risk of financial and personal health data loss.

X

Sensitive Information- Every effort should be made to protect sensitive information. Although protection mechanisms are in place, there are still risks associated with transmitting sensitive data across any network, to include the VA WAN. Although the One-VA VPN satisfies this requirement, the sensitivity of the data may be such that additional precautions are warranted.

Server-to-Server Connections - In most cases, a site-to-site VPN can be used to support external server connections.

LAN Extensions- LAN extensions to the VA WAN may be supported with a site-to-site VPN. In order to qualify for a LAN extension, VA must control both physical AND logical security at the site.

X

Requirements- A requirement for protocols not currently supported in the VA firewall policy and would be a significant security risk 10the VA WAN is a candidate for a site-to-site VPN connection.

In addition, all Contractors shall meet the following background investigation requirements: All users with access to the data received from Department of Veterans Affairs (VA) are U.S. Citizens with a valid Contractor's license and current background Investigation or a mutually agreed upon VA level background clearance verified at the National Agency Check with Inquiries, level for laboratory technical staff and business operations staff. Anyone with administrative or programmer access to a federal computer system will have a background investigation commensurate with the level of access granted to the VA computer system as determined by the Information Security Officer in concert with Human Resources Management Staff and/or the Department of Veterans Affairs Security & Investigations Center. These staff must be operating within the borders of the U.S.A. and its territories.

Any equipment provided by the Contractor to VA which contains a storage device such that when the device is powered down, VA sensitive data remains on it shall be sanitized prior to removal from the VA premises, shall become the property of the Federal Government and remain on Federal property or shall be destroyed in accordance with Department of Veterans Affairs regulations at the time of removal (device decommissioning). Data required by the Health Insurance Portability and Accountability Account of 1996 (HIPAA) to remain on equipment located on Contractor's property shall be safeguarded in accordance with HIPAA and this information shall be destroyed in accordance with VA requirements when no longer required by HIPAA to be held by the contractor.

The reference laboratory shall meet VA information security and HIPPA requirements and shall be able to interface with the current or any new interface partner of the Laboratory Information System. The Contractor shall have all users with VA access complete the VHA Privacy and HIPAA Training and the VA Privacy and Information Security Awareness and Rules prior to starting services.

The Contractor shall notify the facility Privacy Officer immediately with the list of patient names if any breach of computer security or privacy incident is accessed.

The Contractor shall provide the following interfacing requirements:

1. LIS physical connection and translation (drivers)

2. Any required (additional) interface connection license(s)

3. Web-based electronic ordering and resulting

4. Provide documentation of successful interfacing with a minimum of 2 VA references (not within VISN 17) and 2 private sectors, other federal agencies, state or local government agencies/ institutions. References to include the facility address, telephone number, email address, and contact person’s name which can validate experience within the last three (3) years.

5. Interface shall transmit test results to the host computer via automatic upload

6. Automatic printing of laboratory results to a dedicated reference lab printer.

VI. IMPLEMENTATION TIME FRAME

The implementation of the services/requirements described in this solicitation shall be completed by the first month of the award of the contract. Failure to provide timely implementation may result in termination of the contract. The Contractor shall furnish a schedule to show a customizable implementation plan of the required services (telecommunications, interface connectivity and validation, client service support, courier/logistics, ordering, supplies, specimen processing services, reporting, quality assurance, billing, etc.)

VII. PRODUCT ADD-ONS

The Contractor and STVHCS may add new tests to the base or FSS contract over the course of the contract performance as test volumes increase or as new technology becomes available on the market. A contract modification shall be executed adding these new products to the contracted schedule of items before the Contractor can provide these products to the VISN 17 facilities. Since not all tests may be listed on the contract, due to low volume testing or facility preferences, any test that appears on the Federal Supply Schedule (FSS) fee schedule shall be billed at the FSS fee schedule amount. The Contractor shall supply a list of all tests on the FSS with their associated costs. Tests ordered from each VA facility that do not appear on either schedule shall be offered by the Contractor and will be billed at the fair open market rate. The Contractor shall send tests to another reference facility that is not offered in-house, and the Contractor shall provide the shipping at a fair market cost.

Contracting Officer Representative:

Prior to the contract award, the Contracting Officer shall designate a VA Medical Center employee as the Contracting Officer's Representative (COR). All work coordination shall be done through the COR. The Contractor shall be provided a copy of the letter of delegation authorizing the COR at the commencement of the term of this agreement. No other person shall be authorized to act in such capacity unless appointed in writing by the Contracting Officer.

The Contracting Officer is the only person authorized to approve changes or modify any of the requirements under this contract. The contractor shall communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer is authorized to make commitments or issue changes, which will affect price, quantity, or quality of performance of this contract. In the event the Contractor effects any such changes at the direction of any person other than the Contracting Officer, the change shall be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof.

GOVERNMENT INHERENT FUNCTIONS:

The contractor shall not perform inherently governmental functions. This includes, but is not limited to, determination of agency policy, determination of Federal program priorities for budget requests, direction and control of government employees, selection or non-selection of individuals for Federal Government employment including the interviewing of individuals for employment, approval of position descriptions and performance standards for Federal employees, approving any contractual documents, approval of Federal licensing actions and inspections, and/or determination of budget policy, guidance, and strategy.

GENERAL DUTIES, REQUIREMENTS, AND EXPECTATIONS:

Services provided under the terms of this contract are required to be following the American Association of Blood Banks (AABB), Federal Drug Administration, College of American Pathologists (CAP) accreditation policies, VHA Directive 1106 and all other applicable Federal, State and Government laws.

Information Systems Officer, Information Protection:

The contractor will not have access to VA Desktop computers, nor will they have access to online resources belonging to the government while conducting services. If removal of equipment from the VA is required, any memory storage devices, such as hard drives, solid state drives and non-volatile memory units will remain in VA control and will not be removed from VA custody.

Privacy Officer:

The contractor will have access to protected Patient Health Information (PHI) but will not have the capability of accessing patient information during the services provided to the VA. Contractor is required to be in compliance with the American Association of Blood Banks (AABB) and College of American Pathologists (CAP) accreditation policies and all applicable Federal, State and Government laws.

Records Manager:

There will be federal records created, maintained, used or dispositioned with this contract; regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.].

VA ACQUISITION REGULATION SOLICITATION PROVISION AND CONTRACT CLAUSE

1. SUBPART 839.2 – INFORMATION AND INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

839.201 Contract clause for Information and Information Technology Security:

a. Due to the threat of data breach, compromise or loss of information that resides on either VA-owned or contractor-owned systems, and to comply with Federal laws and regulations, VA has developed an Information and Information Technology Security clause to be used when VA sensitive information is accessed, used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media).

b. In solicitations and contracts where VA Sensitive Information or Information Technology will be accessed or utilized, the CO shall insert the clause found at 852.273-75, Security Requirements for Unclassified Information Technology Resources.

2. 852.273-75 - SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES (INTERIM- OCTOBER 2008)

As prescribed in 839.201, insert the following clause:

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

STX-HCR671-04 General Information Security Requirements /Records

1. All information and records provided to Contractor by VA, in whatever medium, as well as all information and documents, including drafts, emails, back-up copies, hand-written notes and copies that contain such information and records gathered or created by Contractor (collectively referred to as “VA information”) in the performance of this contract, regardless of storage media, are the exclusive property of VA. Contractor does not retain any property interest in these materials and will not use them for any purpose other than performance of this contract.

2. Upon completion or termination of the contract, Contractor will either provide all copies of all VA information to VA or certify that it has destroyed all copies of all VA information as required by VA in a method specified by VA, at VA’s option. Medical records of any kind including notes shall be returned to the VA. The Contractor will not retain any copies of VA information. Where immediate return or destruction of the information is not practicable, Contractor will return or destroy the information within 30 days of completion or termination of the contract. All provisions of this contract concerning the security and protection of VA information that is the subject of this contract will continue to apply to VA information for as long as the Contractor retains it, regardless of whether the contract has been completed or terminated.

3. Prior to termination or completion of this contract, Contractor will not destroy VA information received from VA or gathered or created by Contractor in the course of performing this contract without prior written approval by VA.

4. Contractor will receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in accordance with the terms of this contract and applicable federal and VA information confidentiality and security laws, regulations and policies.

5. The Contractor shall not make copies of VA information except as necessary to perform this agreement or to preserve electronic information stored on Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor needs to be restored to an operating state.

6. Contractor shall provide access to VA information only to employees, subcontractors, and affiliates only: (1) to the extent necessary to perform the services specified in this Contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of this contract, and (3) only to individuals who first satisfy the same conditions, requirements and restrictions that comparable VA employees must meet in order to have access to the same VA information. These restrictions include the same level of background investigations, where applicable.

7. Contractor will store, transport or transmit VA information only in an encrypted form, using an encryption application that meets the requirements of FIPS 140-2, and is approved for use by VA.

8. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two other situations: (i) in response to an order of a court of competent jurisdiction, or (ii) with VA’s prior written authorization. The contractor will refer all requests for demands for production of, or inquiries about, VA information to VA for response.

9. If VA information subject to the contract includes information protected by 38 USC 7332, or 5705, include the following after the last sentence of the paragraph immediately above: Contractor shall not release information protected by either 38 USC 5705 or 7332 in response to a court order, and shall immediately refer such court orders to VA for response.

10. Prior to any disclosure pursuant to a court order, the Contractor shall promptly notify VA of the court order upon its receipt by the Contractor, provide VA with a copy by fax or email, whichever is faster, and notify by telephone the VA individual designated in advance to receive such notices. If the Contractor cannot notify VA before being compelled to produce the information under court order, the Contractor will notify VA of the disclosure as soon as practical and provide a copy of the court order, including a copy of the court order, a description of the records provided pursuant to the court order, and to whom the Contractor provided the records under the court order. The notice will include the following information to the extent that the Contractor knows it, if it does not show on the face of the court order: the records disclosed pursuant to the order, to whom, where, when, and for what purpose, and any other information that the Contractor reasonably believes is relevant to the disclosure. If VA determines that it is appropriate to seek retrieval of information released pursuant to a court order before Contractor notified VA of the court order, Contractor will assist VA in attempting to retrieve the VA information involved.

11. The Contractor will inform VA by the most expeditious method available to Contractor of any incident of suspected or actual access to, or disclosure, disposition, alteration or destruction of, VA information not authorized under this Contract (“incident”) within one hour of learning of the incident. An incident includes the transmission, storage or access of VA information by Contractor or subcontractor employees in violation of applicable VA confidentiality and security requirements. To the extent known by the Contractor, the Contractor’s notice to VA will identify the information involved, the circumstances surrounding the incident (including whom, how, when, and where the VA information was placed at risk or compromised), and any other information that the contractor considers relevant.

12. Contractor will simultaneously report the incident to the appropriate law enforcement entity of jurisdiction. The Contractor, its employees, and its subcontractors and their employees will cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor also will cooperate with VA in any civil litigation to recover VA information, to obtain monetary or other compensation from a third party for damages arising from any incident, or to obtain injunctive relief against any third party arising from, or related to, the incident.

13. VA will provide the Contractor with the name, title, telephone number, fax number and email address of the VA official to whom the Contractor will provide all notices required by this Contract.

14. VA has the right during normal business hours to inspect the Contractor’s facility, information technology systems and storage and transmission equipment, and software utilized to perform the contract to ensure that the Contractor is providing for the security of VA data and computer systems in accordance with the terms of this Contract.

15. Contractor will receive, gather, back up, maintain, use, disclose and dispose of VA information only in compliance with all applicable Federal Information Processing Standards (FIPS) and Special Publications (SPs) issued by the National Institute of Standards and Technology (NIST) concerning VA information that is the subject of this contract. If NIST issues or updates an applicable FIPS or SP after execution of this contract, the parties agree to negotiate in good faith to implement the FIPS or SP in this contract.

16. A determination by VA that the Contractor has violated any of the information confidentiality and security provisions of this contract, including a violation of any applicable FIPS or SP, shall be a basis for VA to terminate the contract for cause.

17. If anyone performing this contract, including employees of subcontractors, accesses VA computer systems or data in the performance of the contract, VA may monitor and record all such access activity. If VA monitoring reveals any information of suspected or potential criminal law violations, VA will refer the matter to the appropriate law enforcement authorities for investigation.

18. Contractor shall inform its employees and other individuals performing any part of this contract that VA may monitor their actions in accessing or attempting to access VA computer systems and the possible consequences for them for improper access, whether successful or not. The Contractor shall ensure that any subcontractors or others acting on behalf of, or for, the Contractor in performing any part of this contract inform their employees, associates or others acting on their behalf that VA may monitor their access activities. Execution of this contract and any subcontract or agreement constitutes consent to VA monitoring.

19. The Contractor will ensure that all individuals who will access VA data or systems in performing the contract are appropriately trained in the applicable VA confidentiality and security requirements. Contractor may do this by requiring and documenting that these individuals have completed the VA training for its employees.

20. To the extent practicable, Contractor shall mitigate any harmful effect on individuals whose VA information was accessed or disclosed in an incident.

21. Contractor shall require subcontractors, agents, affiliates or others to whom Contractor provides access to VA information for the performance of this contract to agree to the same VA information confidentiality and security restrictions and conditions that apply to the Contractor before providing access.

22. The contractor shall abide by FAR clauses 52.224-1 and 52.224.2.

23. The contractor shall abide by FAR clauses 52.239-1 and 52.224.1-2 for Privacy or Security Safeguards

24. In the performance of any part of the work on this contract, the contractor shall utilize only employees, subcontractors or agents who are physically located within a jurisdiction subject to the laws of the United States. Contractor will ensure that it does not use or disclose Patient Health Information (PHI) received from Covered Entity in any way that will remove the PHI from such jurisdiction. Contractor will ensure that its employees, subcontractors and agents do not use or disclose PHI received from Covered Entity in any way that will remove the PHI from such jurisdiction.

VA Handbook 6500.6 Appendix C Paragraph 2 - ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

25. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

26. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

27. Contract personnel who require access to national security programs must have a valid security clearance.