P09 - SOW - Patient Satisfaction Survey - Draft.docx

STATEMENT OF WORK (SOW)

PERFORMANCE WORK STATEMENT (PWS)

PART 1: GENERAL INFORMATION

1. Introduction: The Department of Veterans Affairs requires non-personnel services contract to provide VA North Texas Health Care System (VANTHCS) and South Texas Veterans Health Care System (STVHCS) with systematic surveys of patient experiences. VANTHCS and STVHCS will develop and implement a process to provide timely, actionable, and accessible patient satisfaction data from the facility/division-level to the unit/clinic-level to prioritize improvement efforts throughout VANTHCS and STVHCS catchment areas. The primary goal is to improve patient satisfaction by having a survey service provide real-time feedback, identify, root cause of dissatisfaction and offer solutions for progress. VANTHCS serves over 205,000 enrolled Veterans in 38 counties in North Texas and 2 counties in Oklahoma. STVHCS serves over 114,193 enrollees across 35 counties in the Southern market of Texas. Health care services are delivered through an integrated system of medical centers, community outpatient or outreach clinics, community living centers, domiciliaries and residential rehabilitation treatment programs. Locations included for services identified include:

· VA North Texas Health Care Systems – See Attachment A-1

· South Texas Veterans Health Care System – See Attachment A-2

The service will consist of the utilizing current outpatient satisfaction survey instruments that includes customized questions for each health care system (HCS) as well as questions that permit comparison to other VA, non-VA facilities, and teaching facilities. The primary goal is to improve patient satisfaction by having a service that provides real-time feedback and identifies the root cause of dissatisfaction and offers solutions for progress.

2. Background: A comprehensive outpatient satisfaction measurement service is necessary to successfully meet Veteran expectations as measured by VA Performance Measures and Monitors.

3. Scope: The contractor shall provide all necessary personnel, supervision, labor, equipment, materials and disposal necessary to perform systematic surveys of patient experience as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract. The primary objective of this contract is to increase patient satisfaction in VANTHCs and STVHCS outpatient clinics and services, including the emergency department by providing clinic staff with real time feedback on patient perceptions that will enable employees to improve their performance and deliver excellent care.

· The Contractor shall provide systematic surveys to key service areas including:

· Customization of survey instrument (from existing vendor surveys and/or CAHPS instruments), including a process for survey administration and collection,

· An interactive platform for survey response data that does not require local software installation,

· A response data analytics and reporting system,

· Support/training/coaching

· The Contractor should be able to benchmark both VA and commercial health care facilities

· The Contractor should be able to provide medical practice reports (i.e. provider-level data) which is critical information for patient experience improvements.

· The Contractors should be able to also provide nursing quality measurement solutions, quality indicators and nurse engagement surveys at the unit level.

4. Period of Performance:

5. Specific Tasks and Deliverables:

· Schedule: The Contractor shall contact each patient by the location’s preferred method of delivery. This contact may occur by mail, email or point in time surveys to patients within 3 business days of receipt of the patient information from VANTHCS and STVHCS. The contractor will perform all necessary tasks to provide the quarterly reports within 10 days of the end of each quarter.

· Scanned surveys shall be viewable by each HCS staff electronically within 48 hours of receipt of the completed survey.

· Federal Holidays: Contractor shall not be required to perform services on Holidays (and any other day specifically declared by the President of the United States to be a national holiday).

· *Note if the Holiday falls on a Saturday or Sunday, then our office is closed on the closest weekday (Friday or Monday).

· Contracting Officer Representative (COR): The responsibilities of the person named as the COR will be explicitly stated in the COR Delegation of Authority memorandum to be issued at time of award.

· The Contractor must use collected data to benchmark using information gathered from other health care institutions that use the same survey instruments. The service must include a point in time (kiosk) survey tool that allows for immediate feedback (within 24 hours), accessible through an on-line Contractor portal. The database used must include information gathered from both commercial and VA hospitals, including the University Health Consortium teaching facilities and must allow for inclusion of customized questions for each location. This service must fulfill the American Nurses Credentialing Center (ANCC) guidelines for survey instruments that allow for hospitals to achieve Magnet Status. Guidance given on the ANCC website states that hospitals should “choose the highest quality tool that is statistically significant, at the broadest level nationally, with largest cohort to get the greatest comparative value.” Contractors must ensure all survey benchmarking, reporting, and analysis will allow hospital to acquire/maintain Magnet Status. The results will be used to gain insight on the opinions of veterans who use our services. The information will include a detailed, comprehensive assessment of patient satisfaction within VANTHCS and STVHCS.

· Assembly of data collected and professional analyses of the data is included in the services. The Contractor will provide quarterly reports of patient satisfaction in written form, also available through Contractor on-line web portal, within 10 days of the end of each quarter for each medical center and for the VISN (roll-up of all medical center data). The information will include quarterly comprehensive, detailed assessments of our patient’s experiences while they are served at individual medical centers and clinics. The quarterly reports will also include a summary for all outpatient clinics and services, including the emergency department surveyed. A sample of the quarterly report must be included the Contractor’s proposal. The on-line web Contractor portal must allow for the creation of customized Ad Hoc reports created by VANTHCS and STVHCS staff using collected data HCS outpatient clinics and services, including the emergency department will be utilizing the service. They require full customization and specialty comparisons, including detailed findings and a full set of data queries available on-line and in hard copy.

· The Contractor will provide the ability to query on-line data to evaluate satisfaction of services by stop code, patient care unit, site/specialty, survey receipt date, dates of services clinician, and demographics in a timely manner. Please provide access to a Contractor on-line portal (web access) that demonstrates this ability in proposal. Government is not allowed to download a Contractor program to our information technology network.

· Specific deliverables are as follows:

· Typesetting of VANTHCS and STVHCS outpatient clinics and services, including the emergency department with customized questions for each facility location. Survey questions must be approved by each participating facility prior to distribution.

· Typesetting of VANTHCS and STVHCS inpatient services to include Community Living Center, acute inpatient Behavioral Health , Medicine and Surgery bed units. Survey questions must be approved by each participating facility prior to distribution.

· Printing of survey, cover letter with the logo of the respective medical center with the Director’s electronic signature block, and the postage paid return envelopes.

· Include all first-class postage out and back

· Data entry for completed surveys

· Scanning of all surveys for daily viewing by selected VANTHCS and STVHCS staff

· Contractor on-line web portal that allows for the creation of customized Ad Hoc reports created by VANTHCS and STVHCS staff using collected data and Contractor created quarterly reports

· Access to program for on-line data analysis of VANTHCS and STVHCS patient data by defined queries

· A survey tool that measures patient satisfaction with the following indices:

· Front-line staff courtesy and helpfulness

· Scheduling ease and accuracy

· Speed of registration process and length of wait

· Nursing staff (LPN, RN) courtesy

· Provider courtesy, quality of explanations, amount of face-to-face time with patient

· Office operations (hours of operations, cleanliness, etc.)

· Sensitivity to the patient’s needs (scheduling, privacy concerns, convenience of office hours)

· Ability to add custom questions to the survey tools for each location

· On-line and/or in person education sessions/training for staff working with the program and accessing the data and reports.

· Annual Client Conference (10 participants) includes hotel and conference fee to be completed for the base year and 4 options years.

· On site data interpretation annual visits to each facility’s Executive Team

· Unlimited customer service phone support during business hours

· Subscription to newsletter/information on patient satisfaction, best practice, etc.

· Patient comments will be transcribed verbatim and available to VANTHCS and STVHCS via the Contractor on-line portal

· Hard copies and business reply pre-paid envelopes for the purposes of handing inpatient Mental Health surveys.

· Pre-paid envelopes to mail mis-directed surveys to the contractor.

6. Schedule for Contract Tasks and Deliverables:

· The Contractor will be expected to contact each patient by the location’s preferred method of delivery. This contact may occur by mail, email, or point in time surveys to patients within 3 business days of receipt of the patient information from VANTHCS and STVHCS. The contractor will perform all necessary tasks to provide the quarterly reports within 10 days of the end of each quarter. Scanned surveys can be viewed by VANTHCS and STVHCS staff electronically within 48 hours of receipt of the completed survey.

· Method of Evaluating Deliverables:

· VANTHCS and STVHCS medical center staff will evaluate all deliverables and review the resulting data. These reviews will involve scrutiny of the data, viability of the information, and utility of the service in helping improve service to our veterans, as well as the concurrence and/or changes required to proceed with the work as noted in the contractor’s submissions. A Quality Assurance Surveillance Plan (QASP) will be used to assure the success and failure of the vendor for meeting expectations. VANTHCS and STVHCS staff will access the clinic account that checks the number of names/contacts sent from the outpatient clinics and services, including the emergency department compare to the number of surveys delivered, and analyze data from returned and processed surveys.

· Part III: Miscellaneous

· Place of Performance: Analysis and input of all survey data will be performed by the Contractor at their respective work site.

· Period of Performance: The term of the resulting contract will be active for one year. Four option years are to be included.

· Government Furnished Property: Government furnished property will not be provided to the contractor. All equipment required by the contractor will provided at their expense.

· Qualification of Key Personnel: Key contracting personnel involved in execution of the surveying service will be required to demonstrate appropriate knowledge, experience, and expertise regarding survey methodology and data analysis. Key personnel will also be required to participate and pass a Government administered security review.

· Payment Requests: All requests for payment must be submitted to:

Department of Veterans Affairs Financial Services Center P.O. Box 149971 Austin, TX 78714-8971

· The Contract Number and Purchase Order Number MUST be referenced on all invoices.

· Vendor payment inquiries may be made by contacting the Austin FSC at 866-372-1141.

7. Key Personnel and Temporary Emergency Substitutions:

· During the first ninety (90) days of performance, the Contractor shall make NO substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment. The Contractor shall notify the Contracting Officer, in writing, within 15 calendar days after the occurrence.

· The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the Contracting Officer. Proposed substitutes shall have comparable or better qualifications to those of the persons being replaced. The Contracting Officer will notify the Contractor within 15 calendar days after receipt of all required information of the decision on the proposed substitutes. The contract will be modified to reflect any approved changes of key personnel.

PART 2 : GENERAL/TECHNICAL REQUIREMENTS

1. General Requirements:

· The contractor shall provide a project management plan that will include, but is not limited to:

· work breakdown structure,

· schedule,

· risk management plan,

· configuration management plan,

· implementation plan,

· information security/privacy plan,

· training/coaching plan,

· quality assurance and control plan,

· transition plan,

· close-out plan.

· Any solution that is proposed by the contractor must be based on a Commercial Off The Shelf (COTS) platform (or cost effective customized platform) that can be customized for specific needs.

· The platform(s) shall be hosted by the contractor’s server(s).

· Any system maintenance shall be performed outside of business hours.

· The expected volume of individuals to be surveyed at full-implementation is estimated to be approximately 600,000 per year based on volume of eligible encounters.

· Benchmarking capabilities within the healthcare industry

· The contractor shall have the ability to administer surveys in multiple languages.

· On-line and/or in person education sessions/training for staff working with the program and accessing the data and reports.

· Annual Client Conference (10 participants) includes hotel and conference fee to be completed for the base year and 4 options years.

· On site data interpretation annual visits to each facility’s Executive Team.

· Unlimited customer service phone support during business hours.

2. Technical Requirements:

· The Contractor will provide all services associated with preparation, distribution and collection of the survey instruments and data. The contractor will be expected to use quantitative and qualitative data analyses in accomplishing the tasks and provide quarterly written reports which will include action plans and recommendations to improve patient satisfaction. The Contractor must make information available through a Contractor on-line web portal.

· A sampling of the patient population to ensure statistical significance will be surveyed at each outpatient clinic; however, an individual patient that has visited an outpatient clinic within one year of each other will not be surveyed again in the same time frame. The historical data on patient visits (encounters) for each Health Care System is provided in Attachments A-1 thru A-2.

· Up to 25% increase in the number of patients that require survey services may occur during the anticipated 5-year contract period. The historical number of unique patients and clinics follows for the 2 separate VISN 17 locations follows.

3. Systematic Survey Development:

· The Contractor shall provide a systematic process based on industry standards to survey patients, family members and Care Givers regarding their healthcare experience. The Contractor shall propose existing surveys, including the use of CAHPS-based tools where applicable. The Contractor solution shall provide:

· The ability to add VA specific questions.

· The ability to modify survey tool(s).

· The ability to collect, input and report comments (free text) from respondents.

4. Systematic Survey Platform:

· The Contractor shall provide a platform based on COTS industry standards to allow collection of respondent’s healthcare experience. As part of the platform, the Contractor solution shall provide:

· The ability to administer surveys through multiple modes of collection (e.g., phone, email, postal mail, and by paper).

· A process to contact the respondent within 3 business days of obtaining the list of potential respondents.

· Rigorous quality assurance and quality control processes on sampling, response collection, mailing, data entry, and reporting.

· Survey responses shall be uploaded into a vendor-managed database within 3 business days of response receipt to be accessed by the Government (see Section 5.6 below for more details).

· The vendor-managed database system will be refreshed at least daily to display newly received responses.

5. Systematic Reports and Analytics:

· The Contractor shall provide the assembly and professional analysis of the data collected.

· The Contractor shall provide quarterly reports of patient satisfaction in written form, also to be available through the Contractor online web portal within 10 days of the end of each quarter. Information includes, but is not limited to:

· Comprehensive, detailed assessments of patient experience(s) at VA facilities.

· Summary of all outpatient clinics and services; including emergency departments surveyed.

· The Contractor shall provide a sample of the quarterly report with their offer.

· The Contractor shall provide an online web portal with the ability to query online data to evaluate satisfaction of services by patient care unit, site/specialty, survey receipt date, date(s) or service(s), clinician, and patient demographics in a timely manner.

· The contractor shall provide access to their online web portal that demonstrates the required abilities with their offer.

· The Government is not allowed to download a Contractor program to our information technology network.

· The Contractor provided online web portal will allow reporting process of real-time, on-demand, 24/7 accessible data that includes:

· Benchmarking (i.e., a system that compares) with non-VA and other VA hospitals

· Benchmarking data that is updated at least every 6 months

· Aggregated standard summary reports (we will need to define what this means) by VISN, facility, division, and a work unit levels (in accordance with VA-provided Organization Charts),

· Access rights and restriction permissions for VA employees (as designated by Government),

· The ability for VA staff to customize and generate Ad Hoc reports according to selected parameters, e.g., work unit, facility, gender, respondent type, etc.,

· The ability to drill down on individual survey responses,

· The ability to extract the raw data into Microsoft Excel and Comma-Separated Values formats,

· The ability to trend and compare the data over a specific time period (i.e., day, week, month, year, etc.),

· A “dashboard” capability that provides an overview of aggregated and ranked scores, with the ability to drill down to specific parameters, and

· A process to survey the respondent within 3 business days of obtaining the list of potential respondents.

6. Evaluation of Deliverables:

· VANTHCS and STVHCS staff will evaluate all deliverables and review the resulting data (See Attachment C).

· Reviews shall involve close scrutiny of the data, viability of the information, and utility of the service in helping improve service to our veterans, as well as the concurrence and/or changes required to proceed with the work as noted in the contractor’s submissions.

· VANTHCS and STVHCS staff will access the clinic account that checks the number of names/contacts sent from the outpatient clinics and services, including the emergency department, compare to the number of surveys delivered, and analyze data from returned and processed surveys.

7. The Role of the Government will include:

· Dedicate FTEE at each site to coordinate the patient experience program including interfacing with the Contractor and working with government teams to make data-driven improvements

· Use robust in-house qualitative approaches to complement surveys

· Standardize data review and reporting structure of results

· Share information with patients and families in a standardized manner

8. Service Standards:

· Sanitation is an important facet of a multidisciplinary approach to infection control. A continuing program of soil removal that reduces disease vectors and sanitizes surfaces is an integral part of the infection control process. The Contractor shall ensure that the Calais is maintained in a state of cleanliness that fully meets all VHA, The Joint Commission, and Center for Disease Control (CDC) and Prevention standards.

· Commercial standards that meet or exceed the standards of Section 6.1 are acceptable.

9. Quality Control:

· The contractor shall develop and maintain an effective quality control (QC) program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract and shall be delivered with the contractor’s proposal. After acceptance of the quality control plan the contractor shall receive the Contracting Officer’s acceptance in writing of any proposed change to his QC system.

10. Quality Assurance:

· The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

11. Post Award Conference/Periodic Progress Meetings:

· Post-Award Kick-Off Meeting shall be scheduled for no later than 10 business days after award. Attendance shall be via telephone and include the CO, COR, and contractor POC and other relevant personnel.

· The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5.

· The Contracting Officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the Contracting Officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

· These meetings shall be at no additional cost to the government.

12. Data Rights:

· The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government.

· These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer.

· All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose.

· This right does not abrogate any other Government rights.

13. Security:

· All information must be safeguarded according to all federal, state, and local guidelines. A Business Associates Agreement (BAA) must be signed by the successful offeror and all VA Information and Information System Security Privacy safeguarding guidelines must be followed (See Attachment D).

· VA Directive and Handbook, 6500 Managing Information Security Risk: VA Information Security Program; VA Directive 6515, Use of Web-Based Collaboration Technologies; and VA Directive 6102, Internet and Intranet Services, shall be in compliance prior to activating any web portal.

· Security language specific to VA Handbook 6500 attached to solicitation.

14. Invoicing:

· Contractor shall submit invoices electronically IAW SF 1449, Block 18a.

· Service Fee line items shall be broken down in invoices to distinguish between routine service costs and extraordinary costs.

· The Contractor shall submit the quarterly reports required prior to submitting each monthly invoice as stated above.

15. Reporting:

· Routine communication between the Contractor and the Government will be through the COR.

· The COR shall work with VANTHCS and STVHCS staff to determine completeness of the reports. VANTHCS and STVHCS staff will review the quarterly reports and notify the COR of any discrepancies or issues.

· The Contractor’s Project Manager will be available to address areas of concern as needed when directed by the Contracting Officer.

· The COR will be identified by separate COR Delegation Memo. The memo of designation issued to the COR details the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order (See Attachment E)

· The COR shall monitor all technical aspects of the contract and assists in contract administration

· The COR is authorized to perform the following functions:

· Assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance.

· Maintain written and oral communications with the Contractor concerning technical aspects of the contract.

· Issue written interpretations of technical requirements, including Government drawings, designs, specifications.

· Monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies.

· Coordinate availability of government furnished property, if any.

· Provide site entry of Contractor personnel.

Attachment A-1

Facility Name: VA North Texas Health Care System 4500 S. Lancaster Road Dallas, Texas 75216

CBOC Locations:

Dallas VA Medical Center

4500 S. Lancaster Road Dallas, Texas 75216

Bonham, Texas 75418

Garland, Texas 75042

Fort Worth, Texas 76119

Denton, Texas 76205

Decatur, Texas 76234

Granbury, Texas 76048

Greenville, Texas 75401

Sherman, Texas 75090

Dallas, Texas 75224

Plano, Texas 75075

Grand Prairie, Texas 75051

Tyler, Texas 75703

VA North Texas HCS Total Number of Stop Codes surveyed:

Total Number of visits (encounters) in FY 21

PODIATRY

CHIROPRACTIC CARE

Attachment A-2

Facility Name: South Texas Veterans Health Care System 7400 Merton Minter Boulevard San Antonio, Texas 78229

CBOC Locations:

Kerrville, TX 78028-5768

San Antonio, TX 78201-6521

San Antonio, TX 78229-3220

San Antonio, TX 78240-3900

New Braunfels, TX 78130-4170

San Antonio, TX 78247-1128

San Antonio, TX 78232-1662

San Antonio, TX 78228-1315

San Antonio, TX 78217-5675

San Antonio, TX 78222-3750

San Antonio, TX 78221-1418

Seguin, TX 78155-5712

San Antonio, TX 78249-2166

San Antonio, TX 78222-4911

Victoria, TX 77901-5417

San Antonio, TX 78251

South Texas VA HCS Total Number of Stop Codes surveyed:

Total Number of visits (encounters) in FY21:

PODIATRY

CHIROPRACTIC CARE

Attachment B QASP - Performance Monitors:

The Government shall use the standards below to determine contractor performance and shall compare contractor performance to the Acceptable Quality Level (AQL) in our Quality Assurance Surveillance Plan (QASP).

Attachment C VA Information and Information System Security/Privacy Language for Inclusion into Contracts, as Appropriate

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

d. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

2. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/ subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request (See Attachment F).

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA Contracting Officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/ subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA Contracting Officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/ subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

3. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

a. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent, to those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA’s network involving VA information must be reviewed and approved by VA prior to implementation.

b. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

c. Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the contractor’s systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA OCS Certification Program Office. Government-owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

d. The contractor/subcontractor’s system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA Contracting Officer and the ISO for entry into VA’s POA&M management process. The contractor/subcontractor must use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with contractor/subcontractor activities must also be subject to such assessments. If major changes to the system occur that may affect the privacy or security of the data or the system, the C&A of the system may need to be reviewed, retested and re-authorized per VA Handbook 6500.3. This may require reviewing and updating all of the documentation (PIA, System Security Plan, Contingency Plan). The Certification Program Office can provide guidance on whether a new C&A would be necessary.

e. The contractor/subcontractor must conduct an annual self-assessment on all systems and outsourced services as required. Both hard copy and electronic copies of the assessment must be provided to the COR. The government reserves the right to conduct such an assessment using government personnel or another contractor/subcontractor. The contractor/subcontractor must take appropriate and timely action (this can be specified in the contract) to correct or mitigate any weaknesses discovered during such testing, generally at no additional cost.

f. VA prohibits the installation and use of personally-owned or contractor/subcontractor owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW or contract. All of the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA-approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned OE.

g. All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per 6500.1 requirements. This must be completed within 30 days of termination of the contract.

h. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

1) Vendor must accept the system without the drive;

2) VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

a) The equipment vendor must have an…