P09 - SOW.docx

Performance Work Statement Special Needs Grounds Transportation VA Palo Alto Health Care System Section 1: General Information

1.1 General: This is a non-personnel services contract to provide special needs ground transportation services for the VA Palo Alto Health Care System (VAPAHCS). The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.2 Hours of Operation: Work shall be provided as requested 365 days a year, 24 hours a day, regardless of distance. For long distance trips the Contractor may require 24 hours’ notice.

1.3 Period of Performance:

1.4 Place of Performance: Work will require transportation to / from three major medical centers and seven Community Based Outpatient Clinics (CBOC). Transportation will also be needed to and from Veterans’ residences, community nursing home/health care facilities, shelters, board & care homes, airports, train/bus stations, etc..

Medical Centers Palo Alto Veterans Affairs Medical Center (VAMC)

3801 Miranda Ave.

Palo Alto, CA 9430 Livermore VAMC

4951 Arroyo Rd.

Livermore, CA 94550 Menlo Park VAMC

795 Willow Rd.

Menlo Park, CA 94025

Community Based Outpatient Clinic Capitola CBOC 1350 41st Ave., Ste 102 Capitola, CA 95010 Fremont CBOC 39199 Liberty Street Fremont, CA 94538 Monterey CBOC 201 Ninth Street Marina, CA 93933

San Jose CBOC 5855 Silver Creek Valley Place San Jose CA 95138 Sonora CBOC 13663 Mono Way Sonora, CA 95370 Stockton CBOC 7777 South Freedom Rd.

French Camp, CA 95231

Modesto CBOC 1225 Oakdale Rd.

Modesto CA 95355

1.5 Type of Contract: The government will award a Firm Fixed Price Indefinite Delivery Indefinite Quantity contract.

1.6 Invoicing: All invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

VA’s Electronic Invoice Presentment and Payment System – The FSC uses a third-party contractor, Tungsten, to transition vendors from paper to electronic invoice submission. Please go to this website: http://www.tungsten-network.com/US/en/veterans-affairs/ to begin submitting electronic invoices, free of charge.

More information on the VA Financial Services Center is available at http://www.fsc.va.gov/einvoice.asp.

Vendor e-Invoice Set-Up Information:

Please contact Tungsten at the phone number or email address listed below to begin submitting your electronic invoices to the VA Financial Services Center for payment processing, free of charge. If you have question about the e-invoicing program or Tungsten, please contact the FSC at the phone number or email address listed below:

· Tungsten e-Invoice Setup Information: 1-877-489-6135

· Tungsten e-Invoice email: VA.Registration@Tungsten-Network.com

· FSC e-Invoice Contact Information: 1-877-353-9791

· FSC e-invoice email: vafsccshd@va.gov Section 2: Definitions & Acronyms

2.1 Definitions:

Base Rate. The rate paid for one-way transportation from a designated pick up point to a designated delivery point. This rate will be paid for all authorized one-way trips ordered under this contract action during all phases of the trip made on behalf of the Government. The Base Rate shall constitute full compensation for one-way trips which do not exceed 40 miles for each identified Medical facility.

Beneficiary. Veteran determined to be eligible for benefits by the VA Contracting Officer. VA official with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

Contracting Officer’s Representative (COR). VA official responsible for providing contract oversight and technical guidance to the Contracting Officer. Some of the COR’s responsibilities include certification of invoices, placing orders for service, providing technical guidance, overseeing technical aspects of the contract, and is a member of the vehicle inspection team. Contract administrative functions remain with the Contracting Officer.

Contractor. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

Discharge Services. Trips requiring transport upon beneficiary discharge from facility. These are also referred to as "add-on", based on the time frame of request. Travel coordinator will advise the Contractor as to any travel and/or time restrictions.

Dry Run. A dry run is a request for service by authorized Medial Center personnel, whereby the Contractor arrives at the designated pick-up point and no patient is transported due to a change in the Medical Center's needs and verified by VA staff. The Contractor will be entitled to the applicable base rate only when dry runs are encountered due to no fault or negligence of the Contractor.

Mileage Rate. The rate for each mile traveled beyond 40 miles during a single one-way trip. In no event shall the Contractor receive this rate for miles traveled within the specified mileage threshold.

No Patient Charge. Fee allowed to Contractor for scheduled pick-ups, which due to circumstances are beyond the contractor's control (i.e. patient refuses pick-up, patient not home, patient not medically/mentally suitable for transport, etc.). The Contractor shall not assess this charge on scheduled pick-ups that are cancelled in advance by the VA and/or the patient cancels due to being unable to arrive for scheduled appointment in time.

Stair Assist. Two qualified persons to assist a patient down stairs on a wheelchair or gurney. Maximum of 25 stairs.

Subcontractor. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2 Acronyms:

Section 3: Government Furnished Property, Equipment, and Services None Section 4: Contractor Furnished Items and Services The Contractor shall provide all equipment, supplies, management, supervision, and personnel necessary to assure that all services are in accordance with the contract and all applicable laws and regulations. The contractor shall ensure all work meets performance standards specified in this Performance Work Statement (PWS).

Section 5: Specific Tasks

5.1 General

A. The Contractor shall provide special needs ground transportation services for beneficiaries of the Department of Veterans Affairs facilities listed in section 1.4.

B. Toll-Free Number: The Contractor shall provide a toll free number for accepting calls from the Veterans Affairs (VA). It is estimated that 90% of all requests for services will be placed by telephone. Requests for service may also be in writing or oral from an authorized representative of the VA, and may be completed by telephone, facsimile, mail, e-mail, or in person.

C. Electronic Transmissions: The Contractor shall propose an electronic media, (e.g. facsimile, e-mail), available at all times during the contractor period to communicate requirements such as patient incidents, requests for services, special correspondence, etc. with the VA. Use of this communication system will be mutually agreed upon after award but prior to contract performance.

D. Contractor Personnel Roster: A personnel roster must be provided within seven days after the award of the contract. The contractor must provide the following employee information:

1) Name

2) Position Title

3) Work Assignments Area Any personnel changes must be submitted with two business days after the changes occur.

5.2 Scheduling

A. Beneficiary Trip Scheduling. Beneficiaries will directly contact the Contractor with a minimum of 24 hours advance notice to schedule their transportation. At the time of a trip request, the Contractor shall verify the beneficiary’s authorization, negotiate pickup time and place, and provide the caller with a reference number for reference in billing, or resolution of any questions. The form and method of communication VA authorization and eligibility status from VA to the Contractor shall be determined after direct discussion between the parties.

B. Routine Services. Trips scheduled two or more business days prior to travel Beneficiary, caregiver, or significant others can contact the contractor directly to schedule routine trips. Request for services with less than two business days’ notice to the Contractor shall be made by a member of VA staff.

C. Scheduled Trip. Refers to those trips in which the Contractor has been given advance notice (notice given by 4:30 p.m. the prior business day) of required services and a specific pick-up time. For return trips from scheduled outpatient visits, clients should not have to wait more than 30 minutes for pick up, no matter where the patient resides.

D. Short Scheduled Trip. Refers to rips that have been scheduled in advanced, repeated trips e.g. dialysis.

E. Unscheduled Trip. Refers to those trips required on an as needed basis and advance notice is not given. The following listed response times will be considered acceptable for “Unscheduled Trips” from the listed VA Palo Alto Health Care System facilities:

NOTE: Response time is defined as the time from the trip order to the pickup time.

F. Urgent Services. Unscheduled services requiring immediate action, which will be requested by VA staff. Emergent cases will be telephoned to the Contractor and followed up with form VAF-10-7078 which will be faxed to the Contractor. Comment by Michael Hodahkwen: Please send me a copy of the form that we are using.

G. Waiting. The time required and verified by authorized medical facility personnel, for the Contractor to wait at designated pick-up and/or delivery points in performing contract services.

H. Waiting Grace Period. The waiting grace period is fifteen minutes prior to time waiting charges commence. The base rate for transportation services shall include a fifteen minute waiting grace period at origin and destination.

5.3 Requests for Services

A. Prior to performance, the COR shall provide the Contractor with a list of names or position titles and phone numbers of authorized Government personnel who may request services and receive calls from Contractor regarding contract performance. This list will be updated and submitted to the Contractor as changes occur.

B. The Contractor shall ensure that requests for services are received from authorized medical center personnel or from clients pre-approved by authorized VA staff. Services rendered in response to requests from other than authorized personnel shall be at the risk of the Contractor and any cost related thereto shall be borne by the Contractor.

C. The Contractor shall normally transport only one beneficiary per trip when authorized by VA personnel. When more than one beneficiary is transported reimbursement for the second patient mileage will not be charged, however, mileage will only be paid for the longest distance over which a patient is transported.

D. The Contractor shall account for services through the use of a “trip ticket”. The trip ticket shall indicate the date and time of service call, name of beneficiary requiring services, type of transportation requested, designated pick-up and delivery points, actual time of arrival at pick-up and delivery points and actual waiting time at pick-up and delivery points, if waiting charges are claimed. Copies of trip tickets are to be provided monthly, along with the monthly invoices sent for payment. Fast-Trak and or bridge receipts should also be provided on a monthly basis.

E. All patient transportation requests shall be placed against schedule, and shall be verified against invoices and trip ticket. When ordering services, the VA medical facility will provide the following information:

1) Mode of transportation required;

2) Required date and time of arrival;

3) Name of beneficiary;

4) Pick-up and delivery point;

5) Type of equipment required;

6) Last four of the patient's Social Security Number;

7) And any other special instructions;

F. The Contractor shall notify VA staff of any address changes from clients existing address of record prior to providing service.

5.4 Contractor Personnel Requirements

A. The Contractor’s conduct shall be in business-like manner at all times while on VA premises. The Contractor shall furnish an identifying badge with name, function, and a photograph of the employee. The Contractor personnel shall wear an appropriate and professional uniform. The Contractor shall meet the qualifications as specified in the contract, as well as any qualifications required by Federal, State, County and local government entities from the place in which they operate.

B. Within seven days after receipt of award notification, the Contractor shall provide evidence of required training, certifications, licensing and any other qualifications of any personnel performing services under this contract. The initial documentation shall be provided to the Contracting Officer.

C. During the period of performance, if the Contractor proposes to add-on or replace personnel to perform contract services, the Contractor shall submit the required evidence of training, certifications, licensing and any other qualifications to the Contracting Officer Representative (COR). At no time shall the Contractor utilize add-on or replacement personnel to perform contract services who do not meet the personnel qualifications of this contract.

D. Contractor shall be responsible for using appropriate driver screening and selection criteria when employing drivers. Such screening shall include but not limited to testing drivers for prohibited drug use and alcohol misuse; a criminal background check, to the maximum extent permitted by state law.

E. Drivers shall have a valid operator's license in accordance with Federal, State and local government requirements for their place of operation for the services they perform, be capable of administering oxygen and have successfully completed the Standard and Advanced First Aid Course of the American Red Cross and Basic Life Support Cardiopulmonary Resuscitation (CPR) training or equivalent and be capable of providing necessary assistance.

F. Drivers shall have the following before they provide any services related to this contract:

1) Health examinations including annual Tuberculosis (TB) skin test result;

2) Either received the Hepatitis B vaccine series, or is immune as a result of acquired infection, or have been offered and refused the vaccinations.

3) Received Measles-Mumps-Rubella (MMR) vaccine. Combined vaccine (MMR) is the vaccine of choice if individuals are likely to be susceptible to more than one of the three diseases and is required for all persons born after 1956.

4) A negative Purified Protein Derivative (PPD) within the last six months, or if a known reactor, a negative chest X-ray within the past year.

5) A history of Varicella (chicken pox) or, if unknown, results of a Varicella antibody test. If non-immune, must be vaccinated with Varivax (chicken pox).

6) Received training in Universal Precautions and Blood Borne Pathogens, Hazardous Material Management, and Life Safety Management (fire preparedness).

5.5 Contractor Equipment, Vehicles and Inspection

A. The VA reserves the right to inspect contractor's equipment and vehicles or require documentation of compliance with contract specifications, State laws, rules, regulations and guidelines governing transportation vehicles. VA inspections of contractor equipment will not constitute a warranty that the contractor's vehicles and equipment are properly maintained.

B. The VA reserves the right to restrict the Contractor's use of equipment and vehicles that are not in compliance with contract requirements. The restriction of such equipment and vehicles shall not relieve the contractor from performing in accordance with the strict intent and meaning of the contract and without additional cost to the VA.

C. Vehicles shall meet all current applicable Federal, State and local specifications and regulations including, but not limited to, licensing, registration, and safety standards.

D. Vehicles shall be clean and maintained in good repair in accordance with manufacturer's instructions and specifications, at all times during the performance of this contract.

E. The contractor shall not be permitted to borrow medical equipment from the Medical facilities. Contractor shall at no time and under any circumstances exchange equipment with VA. At no time will the Contractor leave vehicles on VA premises unless a pick-up or delivery is in process.

F. Contractor is responsible for supplying all needed appropriately sized wheelchairs, including leg extensions (as needed) unless wheelchairs are provided by Medical Facility or patient.

G. Contractor is responsible for a system that provides drivers with directions/guidance in all vans.

5.6 Contractor Vehicles

Vehicles shall contain at a minimum, the following:

A. Loading platform shall be integral to the vehicle and made of a least thirteen gauge steel. Platforms shall have raised edges, be counter balanced, self-adjusting to curbs and sidewalks, and self-storing. When not in use platform shall be securely stored so as not to block the vision if the driver or inconvenience the patient.

B. Side and rear loading doors shall be operational from both inside and outside vehicle.

C. Vehicles shall have clamp cleats or belts to firmly anchor wheelchair/scooters and prevent movement in any direction.

D. Steps shall be treated with non-skid material.

E. Vehicles shall have safety belts for all occupants.

F. Vehicles shall have working heating, air conditioning, and adjustable temperature controls.

G. Vehicles shall contain four emergency flares and warning lights, and one 5 pound ABC rated fire extinguished with fire extinguisher tag showing record of inspections.

H. Vehicle shall contain a First Aid Kit and Band-Aids, gauze, elastic bandages, sterile gauze pads, triangular bandages, cleansing wipes, tape, scissors, eye pads, and ammonia inhalants. All items shall be packed in sterile containers.

I. Vehicles shall have two blankets.

J. Vehicles shall have on board supplies to provide infections control precaution procedures.

K. A two-way radio that must be fully operational at all times during contract performance. Using maps and or directional type devices shall be used.

L. The Contractor shall provide all medications required while in transport, sheets and blankets and other equipment and supplies required for use while in transport, for direct patient care.

M. The Contractor shall be required to transport non-ambulatory veterans on gurneys and litters who are not in need of emergency transportation or medical attention, but who needs to be in the recumbent position.

N. The Contractor shall be required to provide wheelchairs, with leg braces (as needed) on all vehicles. Vans shall be equipped with a wheelchair at all times.

5.7 Contractor Performance

A. In the event, the Contractor is unable to perform services or have services performed as required, the Contractor shall immediately notify the VA Travel Section and provide a justification for non-performance. The VA will re-procure services that cannot be performed by the Contractor. The Contractor shall indemnify the VA for excess re-procurement cost, which may result from the Contractor's inability to perform the required service or for non-response during off business hours. Payment of re-procurement costs shall not relieve the Contractor from any other provision in this contract. The VA will be the sole judge in determining when services will be re-procured. The failure of the Contractor to perform services within the required time frames and in accordance with terms and conditions may result in termination of the contract in accordance with FAR clause 52.212-4(m).

B. If the VA determines immediate transportation is essential to prevent loss of life or serious bodily harm, transportation services may be procured without referral to the Contractor. In this rare situation, no charge shall be levied against the Contractor.

5.8 Escort

A. The VA reserves the right to have an escort, such as a relative, or care provided of beneficiary or VA staff accompany beneficiary when the VA determines that such an escort is in the best interest of the beneficiary.

B. The VA will also be the sole judge in determining when an escort is required. There shall be no additional charge to the VA when escorts are authorized to travel with beneficiary. The Contractor shall only be required to transport escort with patient and shall not be required to return the escort back to point of origin, unless requested by authorized VA staff.

5.9 Substitution of Beneficiary

A. The VA reserves the right to substitute the beneficiary requiring services at any time during the performance of this contract, to prevent delays, cancellations, or dry runs. There shall be no additional charge to the VA when such changes occur.

5.10 Tolls

A. Transportation services listed in this PWS do not include ferry, bridge, or road toll charges. Any legitimate toll charges shall be limited to ONE WAY ONLY and shall be listed separately on the Contractor's invoices.

5.11 Dry Runs

A. The Contractor shall be entitled to the applicable base rate only when dry runs are encountered due to no fault or negligence of the Contractor, order of services must have been requested by authorized Medical Center personnel.

B. In the event that the VA makes a determination that a previously scheduled trip may be cancelled, and a vehicle has already been dispatched to the designated pick-up point, the VA will notify the Contractor to cancel the order. For orders that are cancelled while the Contractor is already more than half way in route before being notified in route to the designated pick-up, the Contractor shall be entitled to receive 50% of the base rate for the trip, as provided in price schedule. This charge shall not include any mileage charge.

C. This charge shall not be allowed if authorized VA personnel cancelled the trip within one hour of the scheduled pickup time.

D. Should the Contractor arrive at the destination before VA cancels the order, or if the Contractor is unable to perform a scheduled pick-up for reasons beyond the Contractor's control, e.g., incorrect address, or patient absence, or patient refusal, then the Contractor shall receive 100% of base rate for a one-way trip as provided in the schedule, and applicable mileage if outside contract Mileage Threshold areas of coverage.

E. The Contractor shall report all dry runs at time of occurrence and verify with VA staff before driver is allowed to depart location.

F. The Contractor shall not charge dry run for trips if driver arrives too late to allow patients to keep scheduled clinic appointment.

5.12 Rates

A. The time a vehicle departs on the trip shall govern in determining whether day or night rates will apply.

B. The mileage threshold is defined as having its center point at the main VA facilities.

5.13 Patient Rights

A. The Contractor shall be courteous to VA beneficiaries and shall not smoke while transporting patients. Patients may bring a reasonable amount of equipment, such as folding wheelchair, consumable medical supplies and personal suitcase. When transporting patients to or from Medical facilities, the driver shall ensure that the patient's luggage, medical records, medications, and prosthetic devices are properly accounted for and delivered with the patient as required.

B. The Contractor shall immediately notify the VA of any incidents involving injury to VA patients during transport. In the event of an incident, the Contractor shall promptly complete and submit to the Contracting Officer, an Incident Report with all information felt to be necessary for any full review.

C. The Contractor shall notify the COR and Contracting Officer, in writing within 24 hours, of any complaints made by the patients with regards to transportation services. The Contractor may provide recommendations for improved services along with the patient complaints for the VA's review. No recommendation shall be construed as being effective until and unless it is provided as a written modification to the contract from the Contracting Officer.

D. The Contractor shall assist the beneficiary from the departure point to the vehicle and to their destination point. Upon delivery of a psychiatric patient to the patient ward, the Contractor shall obtain from the responsible staff for the beneficiary a signed receipt. The receipt shall be retained by the Contractor. If the beneficiary is to be picked up for a return trip, a trip number shall be left with the staff member identifying the beneficiary's trip number to be used when calling for pickup.

5.14 Safety Requirements

A. In order to protect the lives and health of patients, the Contractor shall take such safety precautions as the Contracting Officer, or his designate, may determine to be reasonably necessary.

B. The COR, or designated representative, will notify the Contractor of any safety non-compliance and the action to be taken. There have been previous incidents relating to the pick-up of Veterans’ where there is uneven terrain. Regarding pick-ups where there is uneven terrain and other possible physical barriers, the Contractor shall be responsible, and will take all of the appropriate safety measures, so as to ensure the safe pick-up and transport of the Veteran.

C. The Contractor shall, after receipt of such notice, immediately correct the conditions to which attention has been directed. If the Contractor fails or refuses to comply promptly, the Contracting Officer (CO) may issue an order, stopping all or any part of the work.

5.15 Interference with Normal Functions

A. The Contractor shall be required to interrupt their work at any time so as not to interfere with the normal functioning of the medical facility, including utility services, fire protection systems, and passage of facility patients, personnel, equipment and emergency and/or service carts. These interruptions should only be occasional. Any interruptions considered to be excessive should be brought to the attention of the Contracting Officer.

5.16 Contractor's Quality Control Program (QCP)

A. The Contractor shall establish and maintain a complete QCP to assure the requirements of this contract are provided as specified. An electronic copy of the QCP will be submitted in the offeror’s proposal. The QCP will be reviewed and if there are any needed clarifications, the QCP will be returned to Contractor for response. The Contractor's QCP shall include the following or have incorporated into during performance of contract, at a minimum:

1) An inspection plan covering all services required by this contract. The inspection plan shall specify the areas to be inspected on either a scheduled or unscheduled basis; how often inspections will be accomplished and documented; and the title of the individual(s) who will perform the inspections.

2) On-site records of all inspections conducted by the Contractor noting necessary corrective action taken. The Government reserves the right to request copies of any and/or each inspection.

3) The methods for identifying and preventing deficiencies in the quality of service performed, before the level of performance becomes unacceptable; organizational functions noting intermediate supervisory responsibilities; and the overall management responsibilities for ensuring total acceptable performance.

4) On-site records of all vehicle maintenance and repairs performed, on vehicles used in the performance of this contract. The methods of identifying and preventing vehicle breakdowns, and detailed procedure for alternative transportation of patients in the event of mechanical breakdown of vehicle shall be incorporated.

5) On-site records identifying the character, physical capabilities, certifications and ongoing training of each employee performing services under this contract.

B. The methods of identifying and preventing radio communication breakdowns. A detailed procedure for alternative communications in the event of electronic and mechanical breakdown of vehicle two-way radios shall be provided in the QCP.

C. On-site records of any complaints or problems, with procedures taken to allow for corrections and/or elimination before effects caused interruption of performance of contract.

Section 6: Attachments Attachment #1 Quality Assurance Surveillance Plan Attachment #2 Past Performance Survey Attachment #3 Form for Emergency Services Attachment #4 Wage Determinations (40 pages)

Appendix B

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

The C&A requirements do not apply, and a Security Accreditation Package is not required.

Appendix C

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooksas VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

6. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

7. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

9. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.