P11. Sources Sought Notice - 36C25625Q1544.pdf

Sources Sought Notice

*= Required Field Sources Sought Notice

SUBJECT* Prescription Services

GENERAL INFORMATION

CONTRACTING OFFICE’S ZIP CODE* 77056-5643

SOLICITATION NUMBER* 36C25625Q1544

RESPONSE DATE/TIME/ZONE 10-06-2025 2:00 PM CENTRAL TIME, CHICAGO,

USA

ARCHIVE 60 DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS N

PRODUCT SERVICE CODE* Q517

NAICS CODE* 456110

CONTRACTING OFFICE ADDRESS Department of Veterans Affairs

Network Contracting Office 16

5075 Westheimer Road, Suite 750

Houston TX 77056-5643

POINT OF CONTACT*

Contracting Officer

Caleb Parker

Caleb.Parker@va.gov

PLACE OF PERFORMANCE

ADDRESS Veterans Health Care System of the Ozarks

1100 North College Avenue

Fayetteville, AR 72703-1944

DESCRIPTION

THIS IS A SOURCES SOUGHT NOTICE ONLY. This is not a solicitation for bids, proposals, proposal abstracts, or quotations. The purpose of this Sources Sought Notice is for market research to obtain information regarding the availability and capability of all qualified sources to perform or provide a potential requirement. The responses received from interested vendor will assist the Government in determining the appropriate acquisition method.

The Department of Veterans Affairs (VA), Network Contracting Office 16 (NCO 16) is seeking to identify potential qualified vendors capable of providing the requirement. This requirement is for the Veterans Health Care System of the Ozarks located at 1100 North College Avenue Fayetteville, AR 72703-1944.

The North American Industry Classification Code (NAICS) is 456110 (Pharmacies and Drug Detailers), and PSC code Q517 (Medical – Pharmacy Services), with a size standard of $37.5 Million.

REQUESTED RESPONSES:

All responsible vendors and interested parties please respond to this source sought announcement if you can fulfill the requirements. Responses to this source sought shall include the following information:

1. Your company name, address, contact person name, phone number, fax number, e-mail address(s), UEI number, number of employees, and company website if available.

2. If you are an GSA/FSS contract holder are the referenced services available on your schedule/contract? Provide your company GSA/FSS contract number and contract expiration date, if applicable.

3. If you are a NASA SEWP V contract holder are the referenced services available on your schedule/contract? Provide your company NASA SEWP V contract number, contract group, and contract expiration date, if applicable.

4. Is your company a contract holder on any other federal contract? If so, please provide the contract number.

5. Socio-economic status of business such as but not limited to (Service-Disabled Veteran Owned Small Businesses (SDVOSB) or Veteran Owned Small Businesses (VOSB) SDVOSB/VOSB, 8(a), HUB Zone, Women Owned Small Business, Small disadvantaged business, or Small Business HUB Zone business, Large Business, etc.).

6. Is your company considered small under the NAICS code identified in this source sought announcement?

7. Is your company a service provider for the services being offered? If so, can you provide documentation confirming authorization to provide the referenced services being offered per the Statement of Work?

8. If your company is a large business, do you have any designated distributors? If so, please provide their company name, telephone, point of contact and size status (if available).

9. Vendors are requested to submit estimated market research pricing with their responses. The estimated pricing will be considered when determining the procurement strategy for the future solicitation. (e.g., if Contracting Officer determines that capable small businesses cannot provide fair and reasonable pricing, then the solicitation will not be set-aside).

Lack of documentation proving your business can conduct the services being offered or all questions not being answered within this notice will result in your response not being taken into consideration. Phone calls will not be accepted.

CONTACT INFORMATION AND RESPONSE DUE DATE:

Please email all responses to caleb.parker@va.gov. Please respond to this source sought notice no later than 10-06-2025, 2:00 PM Central.

DISCLAIMER: This source sought is issued solely for informational and planning purposes and does not constitute a solicitation. Responses to this notice are not offers and cannot be accepted by the Department of Veterans Affairs to form a binding contract. Respondents are solely responsible for all expenses associated with responding to this source sought notice.

PERFORMANCE WORK STATEMENT

URGENT/EMERGENT PRESCRIPTON FILLING SERVICES

Veterans Healthcare System of The Ozarks (VHSO)

1100 North College Ave.

Fayetteville, AR 72703

A. GENERAL INFORMATION

1. Pharmacy Prescription Services for Urgent/Emergent Needs.

2. Scope of Work:

a. Contractor to provide Pharmacy Prescription Services. These services shall entail the Contractor providing a network of pharmacies to insure urgent/emergent prescriptions (up to a 14-day supply, 7-day supply of Opioid pain medication), screening and counseling services for prescriptions prescribed by community care providers from non-VA eligible Urgent Care, Non-VA Emergency Departments, and Non-VA Hospital discharges. All other prescriptions will not be covered under this gap coverage.

These prescriptions will require contractor override by the COR (or designee) as the provider writing the prescription will not be a VA provider. The COR (or designee) will ensure the beneficiary is eligible for the prescription services prior to approval to the contractor for filling the prescription.

PERIOD OF PERFORMANCE:

Base Period: November 28, 2025 – November 27, 2026

Option Period 1: November 28, 2026 – November 27, 2027

Option Period 2: November 28, 2027 – November 27, 2028

Option Period 3: November 28, 2028 – November 27, 2029

Option Period 4: November 28, 2029 – November 27, 2030

The prescription authorization voucher qualifier will be required to be altered routinely (up to on a monthly basis) to prevent unintended use of this coverage.

b. Fayetteville Veterans Affairs Medical Center (VAMC), Fayetteville, Arkansas, has a requirement for pharmacy services, specifically filling an estimated 1300 prescriptions per year under the above criteria.

c. The areas serviced will be within the catchment area of the Veterans Healthcare System of the Ozarks. These areas should have pharmacy in-network coverage in these areas and span the locations as detailed below.

Fort Smith, AR 72903 Ozark, AR 72949

Fayetteville, AR 72703 Springfield, MO 65807

Harrison, AR 72601 Joplin, MO 64804

Jay, OK 74346 Bella Vista, AR

Branson, MO 65616

d. The contractor shall provide prescription filling services to include traditional prescription screening, dispensing, and counseling services (by a licensed pharmacist) to eligible veterans presenting authorized prescriptions from providers. These prescriptions will require an approval process determined by the COR or delegate in coordination with the contractor. Pharmacy delivery charges are not covered, and the contractor will not be reimbursed for any delivery charge in the event the pharmacy provides a delivery service.

(1) Printed drug information will be provided to each patient to supplement verbal instructions. These services will require a medication history and check for allergies, interactions, and therapeutic duplications.

(2) Contractor’s staff and facility must meet all applicable federal and state requirements for performing services under this contract.

e. The contractor shall fill and dispense non-controlled and controlled substance prescription medications via two routes:

(1) The contractor shall fill and dispense controlled substance prescription medications prescribed only via state approved means. Opioid medications (pain medications) may only be filled for up to 7-day supply. Non-controlled medication prescriptions may only be filled for up to 14-day supply with no refills.

f. The purpose of this contract is to provide prescription-filling services (first fill) for acute conditions deemed to be urgent/emergent by the prescribing medical provider and in accordance with the VA National Urgent/Emergent formulary. Acute conditions included but not limited to cough, infection, colds, pain, and other severe medical conditions that drug therapy treatment must be started within 14 days of a patient’s visit or prescription date.

g. Prescriptions will be filled and dispensed only for medications listed in the current VA National Urgent/Emergent Formulary or other approved formulary provided by the COR or designee. An updated formulary will be provided, at minimum, semi-annually to the contractor or as updates are required. Only those medications that are on the National Urgent/Emergent Formulary or Approved Non-Formulary medications will be dispensed under this contract.

h. At a minimum, the contractor will have a facility located within proximity of the following areas listed in section c above. Each facility shall be handicapped accessible, https://www.va.gov/formularyadvisor/urgent-emergent-formulary https://www.va.gov/formularyadvisor/urgent-emergent-formulary https://www.va.gov/formularyadvisor/urgent-emergent-formulary have handicapped accessible ramps, have handicapped parking spaces available and have seating for patients waiting for prescriptions.

i. All prescriptions shall be filled for the quantities as written, not to exceed a 14-day supply except for those products that the manufacturer’s package size prohibits dispensing in a smaller quantity (e.g., inhalers, insulin vials) or which the manufacturer requires to be dispensed in the original container.

j. No refills of prescriptions will be allowed. The contractor may only accept new prescriptions.

k. Contractor will not mail filled prescriptions to the patient.

l. Medical supplies, injectables and prosthetic items are not included in this contract except for the emergency supply of insulin vials and syringes.

m. Prescriptions filled under this contract shall be, to the extent permitted by law, the least expensive drug product the pharmacy has in stock. Generic drugs shall be dispensed whenever possible. Generic drugs shall be dispensed if, in the professional judgment of the pharmacist, the substitute product is available, safe, effective, and to the greatest extent possible, contains the same chemical ingredients of the same strength, quantity, and dosage of the brand name. All generic products used must be in compliance with Federal and State requirements. The generic name must be indicated on the drug label for all medications.

n. Pharmacies authorized to fill prescriptions under the contractor’s plan must agree to the following conditions:

(1) The contractor and its contract pharmacies shall keep all information concerning VA beneficiaries confidential and shall not release or disclose information to any person, except as authorized in writing and according to all applicable laws. The Privacy Act of 1974, public Law 93-579 applies to this contract.

(2) Representatives of the VA are authorized to visit the premises of any pharmacy filling VA prescriptions under the contractor’s plan during business hours for the purpose of auditing and evaluation, which may include the inspection of clinical records.

(3) All adverse drug events reported to the contractor’s pharmacies by beneficiaries of the VA will be reported to Pharmacy Services, Fayetteville, Arkansas. Adverse drug events include dispensing errors, drug allergies, and adverse drug reactions.

(4) Pharmaceutical care provided to beneficiaries under this contract shall meet all standards applicable to Medicaid recipients in the State where the services are provided, and standards set forth in the current Joint Commission accreditation manual for Ambulatory Care/Pharmaceutical Services

o. Contract pharmacies shall maintain a log of VA prescriptions filled under the patient profile and be able to produce proof of dispensing to the Veteran patients. The log is preferably electronic but can be written. A copy of the log shall be readily accessible for random audit.

p. Contractor must have a minimum of two licensed pharmacies accepting its plan in each of the following areas listed under section c above. It is the intent of the Veterans Administration that the contractor has more than two in all areas to provide patients with more choices and additional access to pharmacies.

q. As services are needed for new CBOC’s in the VA Medical Center, Fayetteville, AR primary service area, and additional pharmacies will be added to this contract.

When a new CBOC is to be opened, the contracting officer will notify the contractor. At that time, the contractor shall submit a listing of proposed pharmacies for that area to the contracting officer. The contracting officer shall approve additional pharmacies for that area. The contracting officer shall approve additional pharmacies via a supplemental agreement to the contract.

r. The Government reserves the right to fill any prescription covered under this contract using its own resources and/or staff.

s. The contractor must provide an option to refresh the billing information up to on a monthly basis as to limit misuse of the program. This may be described as alteration of the billing codes used by the pharmacy vendors to restrict use without express authorization by the VHSO Pharmacy Service.

3. Invoicing and Payment

a. The contractor shall submit monthly invoices in arrears within thirty (30) calendar days from the last day of the previous month. The monthly invoice shall contain at a minimum the following information:

(1) Name and ID (Social Security Number) of Patient

(2) Name, strength, quantity, and NDC of medication dispensed

(3) Date dispensed

(4) Cost of medication

(5) Dispensing fee

(6) Assigned prescription number

(7) Name of VA provider or non-VA provider writing the prescription (VA provider and non-VA provider prescriptions should be separated on the report for auditing purposes)

(8) Contract Number / Billing group

(9) Approving VA Pharmacist

b. Payments made by the Department of Veterans Affairs (VA) under this contract shall constitute the total cost of services provided by the Contractor. Contractor hereby agrees, that in no event shall Contractor bill, charge, collect a deposit from, seek compensation, remuneration, or reimbursement from, or have any recourse against the beneficiary, the beneficiary’s family, private insurer, Medicare, or any other entity acting on the beneficiary’s behalf, for services provided pursuant to this contract. Billings rendered by the contractor to the VA for services furnished a VA beneficiary under the terms of this contract shall be billings in full.

c. Reimbursements shall be determined by the Average Wholesale Price (AWP) discounted by the applicable percentage plus the applicable dispensing fee. The total price charge to the VA shall not exceed that charged to the public and shall not exceed the price charged by the contractor’s lowest third-party reimbursement plant.

4. Services

a. The services specified may be changed by written modification to this contract.

b. The services to be performed by the contractor will be performed in accordance with VA policies and procedures and the regulations of the medical staff by laws of the VA facility.

c. The services to be performed by the contractor will be under the direction of the Chief of Staff and the Chief, Pharmacy Service.

d. Under the authority of Public Law 104-262 and 38 USC 8153, the contractor agrees to provide Health Care Resources in accordance with the terms and conditions stated herein, to furnish the services and prices specified in this contract.

5. Qualifications

Personnel assigned by the Contractor to perform the services covered by this contract shall have an active, unrestricted license in a State, Territory, or Commonwealth of the United States or the District of Columbia. The qualifications of such personnel shall also be subject to review by the VA Chief of Staff and approval by the VA Facility Director.

Each person assigned to work under this contract shall be licensed in accordance with the requirements of the State in which the services are provided.

6. Place of Performance

The work shall be performed in service areas listed in areas listed in Scope of Work (2.

Above).

7. Personnel Policy

The Contractor shall be responsible for protecting the personnel (employees, agents, or subcontractors) furnishing services under this contract. To carry out this responsibility, the contractor shall provide the following for these personnel – worker’s compensation, professional liability insurance, health examinations, income tax withholding, and social security payments. The parties agree that such personnel shall not be considered a VA employee for any purpose and shall be considered employees of the contractor.

8. Contract Monitoring Procedures

a. The Contracting Officer Representative (COR) is the Chief, Pharmacy Service and is the VA official responsible for verifying and monitoring contract compliance.

b. Any incident of contractor non-compliance as evidenced by the monitoring procedures, shall be reported immediately by the COR to the Contracting Officer.

Failure of contractor to follow procedure may result in nonpayment or delay of payment.

c. Record-Keeping Monitoring System: Contractor and VA will establish record keeping systems to verify contract performance. Data will be recorded and retrieved as necessary. The contract will be monitored and validated against monthly billings.

d. The COR will furnish a statement in writing to the Contracting Officer as the closure of the contract to include a summary of contractor actions and a statement that all requirements of the contract were fulfilled as agreed.

e. A summary evaluation of contractor performance, based upon the compliance or noncompliance of contract requirements as evidenced under the monitoring procedures shall be forwarded by the monitoring official to the Contracting Officer prior to exercising any option.

9. Hours of Work

a. The services covered by this contract shall be furnished by the Contractor 24 hours per day, 7 days per week including weekends and holidays with the primary limitation being the hours of operation for pharmacies in the Contractor’s prescription filling services network.

10. Annual Report

a. The contractor shall provide the contracting officer with an annual report showing the total number of prescriptions filled and total dollar amount per CBOC location at the end of each contract year. The Government reserves the right to negotiate lower fees and/or higher discounts should the combined total warrant lower fees and/or higher discounts. Should lower fees and/or higher discounts be negotiated, a supplemental agreement to the contract will be issued.

b. Contractor will maintain an ongoing performance measurement assessment and improvement process to assess the services provided under this contract. (e.g., customer satisfaction survey).

11. KEY PERSONNEL AND TEMPORARY EMERGENCY SUBSTITUTIONS

1. The Contractor shall assign a Program Manager/Contractor Representative to this contract.

2. During the first ninety (90) days of performance, the Contractor shall make NO substitutions of key personnel unless illness, death, or termination of employment necessitates the substitution. The Contractor shall notify the Contracting Officer, in writing, within 15 calendar days after the occurrence of any of these events and provide the information required by paragraph (c) below. After the initial 90-day period of the contract, the Contractor shall submit the information required by paragraph (c) to the Contracting Officer at least 15 days prior to making any permanent substitutions.

3. The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the Contracting Officer.

Proposed substitutes shall have comparable qualifications to those of the people being replaced. The Contracting Officer will notify the Contractor within 15 calendar days after receiving all the required information of the decision on the proposed substitutes. The contract will be modified to reflect any approved changes of key personnel.

4. For temporary substitutions where the key person will not be reporting to work for three (3) consecutive workdays or more, the Contractor will provide a qualified replacement for the key person. This substitute shall have comparable qualifications to the key person. Any period exceeding two weeks will require the procedure as stated above.

12. CONTRACT SECURITY

1. General

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA personnel regarding information and information system security.

a. The Certification and Accreditation requirements do not apply, and a Security Accreditation Package is not required.

2. VA Information Custodial Language

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, the contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self- certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer to all requests for demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for a response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer to such court orders or other requests to the VA contracting officer for response.

l. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

(1) Vendor must accept the system without the drive.

(2) VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

(3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

(4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive

m. The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact.

n. Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be preapproved and described in the purchase order or contract.

o. A statement that needs to be signed by the Director (System Owner) states that the drive cannot be removed and that (a) and (b) controls above are in place and completed.

p. The ISO needs to maintain the documentation.

3. Security Incident Investigation

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in, or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover.

4. Liquidated Damages For Data Breach

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. The contractor shall fully cooperate with the entity performing the risk analysis.

Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access).

(2) Description of the event, including:

(i) Date of occurrence.

(ii) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code.

(3) Number of individuals affected or potentially affected.

(4) Names of individuals or groups affected or potentially affected.

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control.

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); VA information, obtain monetary or other

(8) Known misuses of data containing sensitive personal information, if any.

(9) Assessment of the potential harm to the affected individuals.

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification.

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports.

(3) Data breach analysis.

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution.

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible;

and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

5. Confidentiality And Nondisclosure

It is agreed that:

a. The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by the VA which have been generated by the contractor in the performance of this task order are the exclusive property of the U.S. Government and shall be submitted to the CO at the conclusion of the contract.=

b. The CO will be the sole authorized official to release verbally or in writing any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to the order presented to the contractor shall be submitted to the CO for response.

c. Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the Contracting Officer.