P09-Performance Statement of Work-Ambulance Services WPB -as of 12-8-21 with new dates no vaccine mandate .docx

PERFORMANCE WORK STATEMENT

DESCRIPTION OF WORK

The Contractor will furnish Basic Life Support (BLS) and Inter-facility BLS and Advanced Life Support (ALS) Ambulance Services to beneficiaries of the West Palm Beach Veterans Affairs Medical Center (VA), Nursing Home Units/Community Living Center and outlying Clinics in accordance with all terms and conditions of this contract. The Contractor shall provide all supplies, materials, equipment, labor, supervision, management, and transportation to furnish BLS/ALS/Stretcher transportation to eligible VA beneficiaries located in Indian River, Saint Lucie, Okeechobee, Martin, Glades, Henry, and Palm Beach counties in Florida. The period of performance is Base One Year 2-1-22 to 1-31-23 with four option years at the discretion of the Government .

DEFINITIONS:

Administrative Officer on Duty (A0D): Administrative officer in charge after the normal business hours.

ALS Transports: Transports requiring higher level of care than BLS transport on an ambulance equipped with Advance Life Support Systems and qualified staff (must be in accordance with Specification KKK-A-1822E or later version).

ALS/BLS Service Area: To encompass the State of Florida.

Ambulance: Vehicles for emergency medical care which provide a driver compartment and a patient compartment that will accommodate an Emergency Medical Technician (EMT), Paramedic (or RN as needed). Equipment and supplies for emergency care at the scene as well as during transport, and; communication device and equipment for light rescue procedures. The ambulance is designed and constructed to afford relative safety and comfort, and to avoid aggravation of patient's condition (in accordance with Specification KKK-A-1822E, dated June 1, 2002 or later version).

BLS Transports: Transports on an ambulance equipped with Basic Life Support Systems and qualified staff that provides medically necessary basic life support services defined in the national EMS Education and Practice Blueprint.

Contracting Officer (Technical) Representative (COR): Main point of contact for normal day-to-day service matters. Works closely with the Contracting Officer in monitoring contract compliance. Furnishes technical guidance and advice and monitors the services provided by the Contractor. Advises the Contracting Officer regarding Contractor performance and recommends required contract modifications.

Durable Medical Equipment (DME): Medical equipment that is ordered by a provider for use in the home, such as walkers, wheelchairs, etc.

Travel Unit Personnel: VA Beneficiary Travel Unit employees authorized to coordinate authorized transportation at VA expense to include Transportation Assistants, Administrative Officer on Duty, Inter-Facility Transfer Coordinator and COR.

DELIVERY

A. Services shall be provided twenty-four (24) hours a day, seven (7) days a week, three hundred and sixty-five (365) days a year, including government holidays. Service will include transportation to points within a three hundred (300) mile radius of the VA, for beneficiaries located in our seven (7) county catchment areas of Palm Beach, St Lucie, Martin, Indian River, Okeechobee, Glades, and Hendry. Ambulance transportation services shall be furnished on an "as needed" basis.

B. The Contractor shall provide all manpower, equipment, materials, supplies, vehicles, fuel, and supervision necessary to perform all tasks.

QUALIFICATIONS

A. The Contractor must be licensed as both an advanced and basic life support ambulance service by the State of Florida Department of health, Bureau of Medical Services to provide Emergency Medical Services (Reference Section 401, Florida Statutes and Sections. 64-E-2, Florida Administrative Code). The Contractor must maintain licensure certification/Certificate of Public Convenience Necessity (COPCN) with the State of Florida, and Palm Beach County, as applicable, throughout the life of the contract. In the event the license/certification/COPCN lapses or expires, this could be cause for termination of the contract or discontinuance of further ordering from the Contractor.

B. The Contractor must maintain documentation demonstrating they meet all requirements of Federal, State, and County or City codes regarding operation of this type of service. Documentation shall be made available to the VA immediately upon request for the duration of this contract.

C. The Contractor shall comply with the provisions of the Privacy Act of 1974, the health Insurance Portability and Accountability Act (HIPAA) of 1996, as well as all applicable Veterans Health Administration (VITA) regulations pertaining to fire safety and blood born pathogen, which will be provided by the COR.

THE JOINT COMMISSION STANDARDS:

A. The Contractor shall perform required services in accordance with the standards of The Joint Commission (TJC); established principles and ethics of the medical profession established by the American Medical Association (AMA) and American College of Emergency Physicians (ACEP). The Contractor shall adhere to VHA regulations and the policies, procedures, and regulations of the Medical Staff bylaws of the West Palm Beach (WPB) VA Medical Center.

B. The Contractor, upon request, shall provide quality data and information related to services provided and participate in WPB VA Performance Improvement Programs when requested to do so. Upon request, the Contractor shall also provide documentation of the competency of staff that will be providing the contracted services.

C. The contractor shall be responsible for ensuring contractor employees providing work on this contract are fully trained and completely competent to perform the required work; they shall also be required to maintain records that document competence/performance level of employees working on this contract. Upon request the contractor shall provide a current copy of the competence assessment checklist and annual performance evaluation to the Contracting Officer's Technical Representative (COR) for each contractor employee working on this contract

HEALTH INFORMATION PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

A. The Contractor shall comply with the provisions of the privacy Act of 1974, the Health Insurance Portability and Accountability Act (HIPAA) of 1996, as well as all applicable VITA regulations.

B. The Contractor shall not maintain and and/or share sensitive or patient identifiable information in any form or for any purpose, other than what is needed to perform its obligation under the established Business Agreement.

C. The Contractor is responsible for participating in all annual Information Security, Privacy and. HIPAA VA training course provided through the. VA on-line Training Management System (TMS) and providing training certificates to the COR at the start of the contract and then annually.

CONTRACTOR PERSONNEL

A. The Contractor shall ensure that the following personnel (Emergency Medical Technicians (EMT), Paramedics, and Non-Emergency Attendants/Drivers) requirement are met:

1. Ensure and certify that personnel performing the services required under this contract are properly licensed and fully trained in the use of the vehicle and equipment that will be used in the carrying out of contracted services.

2. The Contractor shall ensure minimum staffing requirements as mandated by the State of Florida is met. Each vehicle shall be operated with sufficient personnel for adequate patient care, at least one of whom shall be an. Emergency medical Technician (EMT).

B. Contractor must maintain records of each employee as to character and physical capabilities of performing the services of a driver and/or attendant.

1. A record of each employee as to character, physical capabilities, and qualifications Performing the duties of an ambulance driver or attendant must be maintained at the Contractor's establishment and made available for inspection upon request of the Contracting Officer or COR.

2. A roster of Paramedics, Registered Nurses: (RN), Emergency medical Technicians (EMT), and Non-emergency Attendant Drivers (EMT's and LPN's if used to provide these services) shall be furnished to the Contracting Officer or COR upon request, and shall contain the following information:

· Name

· Paramedic or EMT license number

· Driver's license number

· Date of initial training

· Date of refresher training

USE OF SUB CONTRACTORS

The Contractor is free to subcontract services in order to satisfy the VA’s requirements.

A. All companies utilized as subcontractors are subject to approval of the VA and must meet all requirements of this contract.

B. The Contractor shall disclose use of any subcontractors and ensure all certification and training requirements are in compliance with Federal, State and County regulations governing ambulance services.

C. The Contractor shall be responsible for all subcontracting services provided under this contract.

D. Subcontractor's invoices hall not be submitted directly to the VA, but rather shall be incorporated as part of the primary Contractor's regular invoicing.

TRAINING

A. Emergency Medical Technicians providing emergency services on this contract must meet the following training requirements:

1. Have completed training in accordance with the standard published by the U.S. Department of Health and Human Services (PL 93-154) and follow Florida Statutes (401.2701) requiring a minimum of 110 hours, with at least 20 hours of supervised clinical supervision including 10 hours in a hospital emergency department. EMT's must also meet ongoing recertification requirement standards determined by the State of Florida.

2. Evidence of the "equivalent" training program successfully completed by the EMT must be submitted to the Contracting Officer, immediately upon request.

3. The EMT must be certified, licensed or otherwise officially recognized by the local, State, or regional government or public entity where the emergency ambulance service is operated or by which it is governed. Current and updated certifications of EMT's providing service under this contract must be submitted to the Contracting Officer.

B. Paramedics providing emergency services on this contract must have the following Qualifications:

1. Have completed the required all emergency medical technician and paramedic recertification training. The rules shall provide that al recertification training equals at least 700 hours of training that provide didactic and skills practice components, including a field internship experience aboard an advanced life support permitted ambulance. The paramedic must be certified, licensed or otherwise officially recognized by the local, State, or regional government or public entity where the emergency ambulance service is operated or by which it is governed.

2. Must possess EMT — P Card.

3. Evidence of the "equivalent" training program successfully completed by the Paramedic with a copy of the State of Florida Certification Certificate must be submitted to the Contracting Officer or COR.

C. Drivers: Drivers providing service under this contract shall have a valid ambulance personal license with a driver designation as required by Federal, State, and local law.

1. Contractor shall ensure each ALS and BLS driver who operates a permitted vehicle meets qualifications listed in Section 401.281, F.S. and shall be responsible for assuring that its drivers are knowledgeable and competent in emergency vehicle operations and thoroughly familiar with the vehicles assigned.

2. Ambulance drivers must complete at least a 16-hour course of instruction on driving an authorized emergency vehicle, as defined by Section 316.003 (1), F.S., which must include at a minimum, classroom and behind the-wheel training.

3. Attendant/driver must have successfully completed standard and advanced first aid courses including use of cardiopulmonary resuscitation techniques (CPR) of the American Red Cross, U.S. Bureau of Mines, or equivalent; be able to safely use all associated equipment, such as wheelchair lifts, and fire extinguishers; and been fully briefed and trained in passenger assistance techniques. Proof in the form of a current certificate that first aid training has been successfully completed must be available upon request

4. All contractor employees must be enrolled periodically in "refresher" continuing education or advanced training programs as approved and required by the State of Florida, Department of Health Bureau of Emergency Medical Services. Such refresher training shall be submitted to the contracting officer upon request for verification of compliance. In no instance may this continuing education training be less frequent than every two years.

VEHICLES

A. The ambulance used under the terms of this contract shall be licensed and meet the minimum requirements governing emergency vehicles that are mandated by Florida Department of Health, Bureau of Emergency Medical Services. Licensure must be maintained in current status throughout the term of the contract and a copy of updates provided accordingly.

B. The contractor must have an adequate number of vehicles to meet the requirements of this contract, along with the evidence of satisfactory vehicle inspection prior to use under this contract.

C. Every ambulance operated must have at least two personnel, At least one person shall be licensed in cardiopulmonary resuscitation or first aid and the person in the emergency compartment shall be certified as an emergency medical technician-basic.

· BLS vehicles are required to have a minimum of an Emergency Medical Technician (EMT) attending the patient and a drive meeting minimum ambulance driver requirements in 401-281, Florida Statutes.

· ALS vehicles are required to have at a minimum a paramedic attending the patient and an EMT, meeting requirements as a driver.

D. Vehicles and equipment used in the performance of this contract must be clean, orderly, and in excellent operating condition at all times, and records of maintenance/preventive maintenance must be made available for inspection upon request.

E. All vehicles shall be smoke free and have "No Smoking" signage posted.

F.The Contractor shall notify the Contracting Officer of any vehicle and equipment added/changed after award of contract.

G. The Department of Veteran Affairs reserves the right to thoroughly inspect Contractor vehicles prior to award and at any time during performance of any awarded contract. Mechanical defects noted at the time of inspection must be corrected and the ambulance(s) re-inspected prior to use under the contract.

AMBULANCE MEDICAL EQUIPMENT:

A. Every ambulance in service under this contract shall be equipped as required by the State of Florida and carry at least the minimal equipment necessary for the type of service to be provided, as determined by standards adopte4d by the. State of Florida. Ambulances and medical equipment maybe subject to periodic inspection by the CDR.

B. Each emergency care vehicle shall have patient compartment facilities, oxygen and suction systems and equipment, environmental climatic equipment communications and additional systems equipment accessories and supplies as required by the applicable codes, rules and regulations established by Federal, State and Local regulating authorities. When a patient is transported with VA owned equipment, the equipment shall be returned to the VA within 24 hours in the same condition as it was released.

INSURANCE COVERAGE:

Throughout the effective period of this contract, the Contractor shall possess insurance coverage in the minimum amounts to satisfy contract clause 852.237-71, Indemnification and Insurance, or Florida State requirements, or Palm Beach County requirements, whichever is higher. Any lapse in required coverage could result in discontinuance of further ordering. Prior to the start of contract performance, the Contractor must submit to the Contracting Officer their certificate of insurance coverage evidencing required levels.

ORDERING SERVICE:

A. VA Transportation Assistants, Administrative Officer on Duty (AOD), or the Inter-facility Transfer Coordinator will make requests for services. ALS or BLS mode of transport shall be discussed and determined by the Contractor and the VA clinical personnel. The Contractor will transport per its policies and standard industry practices. If mode of transport differs from what was agreed upon, the Contractor must submit documentation explaining the reasons for the alternate course of action.

B. Authorized personnel will place scheduled and unscheduled transportation requests via telephone to the Contractor's dispatch office. The request for services shall specify the originating point, final destination, and any special needs required. Only travel specified is authorized. The Contractor is responsible for providing all routing directions to drivers prior to arrival at the pickup location.

C. When transporting patient(s) leaving the healthcare facility, the Contractor may be required, if necessary to transport a maximum of three (3) items, to include boxes, luggage, and/or durable medical equipment at no additional cost to VA. The Contractor shall only be responsible to transport belongings that are clean, contained in appropriate packaging, the size and weight of which one person can reasonably handle.

D. When transporting patients to a VA Community Nursing Home, upon arrival at the nursing home, the driver shall give the VA Nursing Home Packet that accompanies the patient to the responsible Nursing Home staff member. The driver shall sign and date the packet's signature form. If there are any discrepancies between the address liste4d on the Nursing Home Packet and the address listed in the trip request, the drive shall clarify the correct destination address with the VA Travel Office, or AOD if after hours.

E. When transporting a patient to a local non-VA hospital, upon arrival at the hospital, the driver shall give the hospital the copy of the medical information accompanying the patient and a copy of the ambulance run sheet listing history of present illness vital signs, and medical actions or medications provided during transport.

RESPONSE TIME:

A. Response time will be calculated from the receipt of the telephonic request for service. At the time of the request, the Contractor shall acknowledge their ability to provide the service within the requested response time. If the Contractor cannot provide the service for any reason, they must notify the VA staff person requesting the service of their inability to provide the service.

B. Response times will be based upon whether the transportation requested is Standard, STAT or non-medical transport. Unless otherwise agreed upon, a Standard response time within 30-minutes. A non-medical transport response time is within 45-minutes of the scheduled pick-up time. A non-medical transport is non-life threatening e.g. patient discharge to home. If not scheduled, the Standard transport time will be followed. A STAT response time is within 15-minutes or sooner from the time of the request. A STAT transport could be life threatening if response time is delayed.

C. If the Contractor fails to furnish service within the required response times, the VA reserves the right to obtain this service from another source and could be deducted from their billing invoice. Repeated failure to meet required response time may result in termination of the contract, or discontinuance of further orders. Response time will be calculated from the Contractor's receipt of the telephonic/fax request for service.

ORIGIN AND DESTINATION:

Patients may be transported to or from any designated location within the defined service area, encompassing the State of Florida. All transports will be between VA facilities or between the VA facility and a facility that provides care under VA auspices (i.e., Contract Nursing Home, Community Outpatient Clinic, Non-VA hospital) and/or between the home of the beneficiary receiving travel services and the VA facility. The VA staff will specify the points of origin and the destination of every trip. Refer to Section Delivery.

WAITING TIME:

Patient waiting time shall not exceed 15-minutes. There shall be no payment or reimbursement for "waiting time" and the Contractor shall not invoice for such.

PATIENT CONDITION UPON ARRIVAL:

Upon arrival at the patient pick-up point, if the Contractor determines the condition of the patient scheduled for pick-up is different than what was stated on the Travel Request, the Contractor shall notify the Inter-facility Transfer Coordinator or Administrative Officer on Duty (AOD) for further instruction.

TRIP DOCUMENTATION:

A. The Contractor shall document each transport with an appropriate document that specifies the date, patient name and identification number, time of pick-up, destination, time of drop off, mileage, and any notes regarding issues particular to the specific transport, including recording oxygen, cardiac monitoring, and other services provided (i.e., material items, supplies).

B. The Contractor shall include a copy of this form with all invoices and also provide the trip documentation form upon request by the VA. These forms will serve as documentation of the transport and will be a source document for reconciliation of the Contractor's request for payment.

CANCELLATION:

A. At the time of the request, Contractor shall acknowledge their ability to provide the service within the requested response time. If the Contractor cannot provide the services for any reason, they must notify the VA staff person requesting the service of their inability to provide the service.

B. The Contractor shall not charge the VA a cancellation fee when cancellations are made prior to the ALS/BLS vehicle embarking upon the dispatch.

NON – PICK UP OF PATIENTS

A. When ambulance service under the terms of this contract involves a trip to or from a VA facility, but due to unforeseen circumstances the patient is not available for pickup; the Contractor shall collect for the trip at the rates applicable under the pricing portion of this contract.

B. The VA reserves the right to substitute beneficiaries requiring service at any time during the performance of the contract to prevent "Unloaded Trips", delays and cancellations. There shall be no additional charge to the VA when such changes occur.

ESCORT:

Subject to limitations of current regulations, the VA reserves the right to have an escort, such as a relative, or care provider of the beneficiary or VA staff accompanies the beneficiary when the VA determines that such an escort is in the best intere4st of the beneficiary. Contractor shall pick up and escort the patient to his/her appropriate ward, nursing home, clinic or to the Travel office when requested. The VA will also be the final judge in determining when an escort is required; there shall be no additional charge to the A when escorts are authorized to travel with beneficiary. Contractor shall only be required to transport escort with patient and shall not be required to return the escort back to the point of origin.

INVOICE PROCEDURES:

A. The Contractor shall use an itemized billing format, with the resources furnished when submitting ambulance service invoices.

B. Invoices will be submitted to the West Palm Beach VAMC within 30-days after contracted services have been provided. Invoices will specify the patient name; date of service, pick-up and delivery point, VA trip authorization number and an itemized list of charges allowed under the contract.

C. VA will review and reconcile invoices with trip ticket and travel logs. Unauthorized charges will be suspended pending investigation. Unauthorized charges are those that are being disputed or have not been pre-approved by authorized VA personnel, and that are not allowable under the contract. A final determination will be made within 30-days, after notifying the Contractor of charges being suspended. However, if an item or service is required on a trip that is not specifically listed in the pricing section of this contract, the Contractor shall not withhold use of that item or service on that particular trip, and the pricing for that item/service will be negotiated afterwards.

INSPECTIONS:

During the effective period of the contract, VA reserves the right to thoroughly inspect and investigate the establishment, facilities, business reputation, and other licensure and qualifications of the contractor.

INCIDENT/ACCIDENT REPORT:

A. Any adverse events involving the welfare of a VA beneficiary while in the care of the Contractor during transport shall be recorded and reported to the COR during normal business hours or to the AOD after normal business hours (4:30 p.m. to 8:00 a.m.) within 24-hours of the event.

B. The Contractor shall make initial contact immediately after the event via telephone, fax, or email notifying VA of any incident, accidents, or medication or transfusion errors involving injury to VA patients during transport. VA will provide POC's and telephone numbers after contract award and prior to service start.

C. The Contractor must prepare and submit a detailed incident report with all information necessary to conduct a full review (date, time, patient, place of pick-up, place of incident, names of parties involved, a detailed summary of events, etc.) with recommended/ implemented corrective action within 24 hours of such incident to the Contracting Officer with a copy to the Chief, Medical Administration Service, West Palm Beach VAMC.

PATIENT RIGHTS:

A. The Contractor shall be courteous to VA beneficiaries under their care. Any substantiated mistreatment of patients in the performance of this contract may be cause for termination of the contract, or discontinuance of further orders. VA reserves the right to request driver removal from transporting VA patients if mistreatment is substantiated. Drivers must be courteous and considerate of all patients they are transporting.

B. The Contractor shall notify the COR, in writing within 24 hours of any complaints made by the patients regarding service issues, providing recommendations for improved services.

SAFETY REQUIREMENTS:

In order to protect the lives and health of patients, the contractor shall take such safety precautions as the Contracting Officer or COR may determine to be reasonably necessary. The Contracting Officer or COR will notify the contractor of any safety non-compliance and the action to be taken. The Contractor shall, after receipt of such notice, immediately correct the conditions to which attention has been directed. If the Contractor fails or refuses to comply promptly, the Contracting Officer may issue an order stopping all or any part of the work and discontinuance of further orders.

INFECTION CONTROL:

A. Contractor employees shall receive ongoing training on universal precautions and infection control as appropriate to their duties. Contractor drivers and attendants shall use universal precautionary measures at all times for the prevention and control of the spread of infectious agents to all persons.

B. The Contractor shall delay using drivers and/or attendants who have the cold, flu, Chickenpox, measles, or have been around someone who is sick on trips until well or no longer symptomatic.

DISPOSAL OF HAZARDOUS WASTE:

Contractor employees shall be trained on how to handle bio-hazardous waste during transport and how to properly dispose of bio-hazardous waste in designated containers, including how to dispose in designated containers when ()mite at West Palm Beach VAMC. The Contractor shall not dispose of any bio-hazardous materials at any location on the premises except at specified by the Contracting Officer.

CONTRACTOR'S QUALITY CONTROL PROGRAM (QCP):

The Contractor shall establish and maintain a complete QCP to assure the requirements of this contract are provided as specified, during the life of the contract. The Contractor's QCP shall include the following:

A. An inspection plan covering all services required by this contract. The inspection plan must specify the type of inspections (i.e., scheduled, unscheduled), areas for inspection, frequency of inspections and documentation of inspections, and who will conduct the inspections, with his or her title specified.

B. On-site records of all inspections conducted by the Contractor. The inspection records must note findings and necessary corrective action taken, the timeframe, and follow-up responsibility/issues. VA reserves the right to request copies of any and/or each inspection.

C. Internal procedures for updating medical service protocols. The Contractor must have established internal procedures for updating medical service protocols that have been revised, requires changes and/or incorporation of new protocols since licensing. The changes to processes, equipment, and/or protocol that may affect performance of contract must be communicated in writing to the Contracting Officer.

D. Methods for identifying and preventing deficiencies. The Contractor must have quality improvement mechanisms in place that allows the business to evaluate the quality of services performed by using established methods for identifying and preventing deficiencies before the level of performance becomes unacceptable. Specific organizational monitoring functions and areas must be identified with levels of responsibility associated, noting intermediate supervisory responsibility and overall management responsibility for ensuring total acceptable performance.

E. On-site competency records of each employee. The Contractor must have employee records available on-site that identifies the character, physical capabilities, certifications, and ongoing training records of each employee performing services under this contract.

F. A log or trip ticket to account for all requests for service. The contractor must use a log or trip ticket to account for all requests for services. The log shall indicate the date and time of service call, name of beneficiary requiring service, type of transportation requested, designated pick-up and delivery pints, actual time of arrival at pick-up and delivery points. The trip ticket shall also contain a patient trip evaluation section, which should be completed for ongoing monitoring of customer comments.

G. On-site records for tracking of customer complaints and actions taken. The Contractor shall keep on-site records for tracking customer complaints or problems with the procedures or initiatives implemented for correction and/or elimination of the problem before negative effects caused interruption of performance on contract.

H. Drug Testing Policy. The Contractor shall have internal policies and procedures for addressing drug and alcohol abuse.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

A. The Contractor is subject to the provisions of the Privacy Act of 1974 and the Health Insurance Portability and Accountability Act (HIPAA) as well as all applicable VA laws and regulations. Contractor shall insure the confidentiality of all patient and employee information and shall be held liable in the event of a breach of confidentiality.

B. Any person, who knowingly or willingly discloses confidential information from VA Medical Center, West Palm Beach patient records, except for the intent of this contract may be subject to fines up to $20,000.00.

C. The Contractor shall keep confident all patient information entrusted to its care. Employees of the Contractor shall not disclose to any unauthorized person, firm or corporation knowledge entrusted during performance, except as outlined in the contract which relates to the following, but not limited to:

1. Names of patients.

2. Patient demographics.

3. Social Security Numbers.

4. Date of Birth

D. All contractor personnel shall observe the requirements imposed on sensitive data and information by law, Federal regulations, VA statutes and policy, Veterans Health Administration (VHA) policy and guidelines and the associated requirements to ensure appropriate screening of all personnel (e.g., Privacy Act of 1974, Public Law 93-579, the requirements of the FPM 731, Subchapter 2 under E.O. 10450, etc.). In accordance with FPM Chapters 731 and 7s 5 CFR Ch. 1 (1-1-95 edition) and Executive Order 10450, the security risk level assigned is considered Low Risk (LR) equating to noncritical sensitive defined as "These positions have potential for MODERATE to SERIOUS impact involving duties of considerable importance to the VA or a program mission of the VA".

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

A. Contractor/subcontractor shall request logical (technical) or physical access to. VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

B. All Contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information.

C. The Contractor or subcontractor must notify the Contracting Officer immediately when an employee working with access to VA information is reassigned or leaves the Contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the Contractor or subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

A. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/ subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's, rights to use data as described in Rights in Data-General, FAR 52.227-14(d) (1).

B. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

C. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from. VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

D. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

E. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

F. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) Part 12 If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

G. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

H. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

I. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The Contractor/ subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

J. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

SECURITY INCIDENT INVESTIGATION

A. The term "security incident" means.an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

B. To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/ subcontractor considers relevant.

C. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

D. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any, incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIMITED DAMAGES FOR DATA BREACH

A. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the Contractor/ subcontractor processes or maintains under this contract.

B. The contractor/subcontractor shall provide notice to VA of a "security incident" as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from anon-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

C. Each risk analysis shall address all relevant information concerning the data breach, including the following:

a. Nature of the event (loss, theft, unauthorized access);

b. Description of the event, including:

(1) Date of occurrence;

(2) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

c. Number of individuals affected or potentially affected;

d. Names of individuals or groups affected or potentially affected;

e. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

f. Amount of time the data has been out of VA control;

g. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

h. Known misuses of data containing sensitive personal information, if any;

i. assessment of the potential harm to the affected individuals; Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

j. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

D. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages at the current market rate per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

a. Notification;

b. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; (3) Data breach analysis;

c. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

d. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and;

e. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With a 10 work-day notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

MISCELLANEOUS:

Contractor employees shall conduct themselves in a professional manner at all time while on VA premises or when providing service to VA beneficiaries.