PEGA_PWS - CIPM_v2 02272024.docx

Consolidated Intake and Processing of Mail

VA-23-00058525

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration (VHA) Office of Integrated Veteran Care

Consolidated Intake and Processing of Mail

Date: 26 February 2024

VA-23-00058525

Task Order PWS Version Number: 0.2

BACKGROUND

“To fulfill President Lincoln's promise to care for those who have served in our nation’s military and for their families, caregivers, and survivors”, the Department of Veterans Affairs (VA) is committed to providing Veterans and other eligible beneficiaries timely access to high-quality health services. VA’s health care mission covers the continuum of care providing inpatient and outpatient services, including pharmacy, prosthetics, and mental health; long-term care in both institutional and non-institutional settings; and other health care programs, such as Civilian Health and Medical Program of the Department of Veterans Affairs (CHAMPVA) and Readjustment Counseling.

VA also provides care to Veterans through community providers when VA cannot provide the care needed. This care is provided on behalf of and paid for by VA. Community care is available to Veterans based on certain conditions and eligibility requirements, and in consideration of a Veteran’s specific needs and circumstances.

VA provides health care to Veterans’ family members and dependents through programs like CHAMPVA. In addition to CHAMPVA, other VA Community Care programs also include the Foreign Medical Program (FMP), Spina Bifida Health Care Benefits Program (SBHP), and Children of Women Vietnam Veterans Health Care Benefits Program (CWVV).

Veterans Health Administration (VHA) supports Veterans and family members by enabling quality care in the community, coordinating benefits for family members, paying medical claims timely and accurately, and delivering a world class customer experience. Veteran and Family Member Program (VFMP) received and adjudicates Veteran Family Member and beneficiary claims. Customer Service falls under IVC and is responsible for responding to and answering questions regarding benefits.

VHA IVC manage the following operational components, to include eligibility, enrollment and claims processing for traditional community care, MISSION Act, CHAMPVA, Caregiver Stipend Program, Patient-Centered Community Care (PC3), Foreign Compensation and Pension, National VHA and Department of Defense (DoD) Healthcare Resources Sharing Agreements (RSA), National Recovery Audit, State Home Per Diem Program (SHPD), Indian Health Services and Tribal Health Program (IHS/THP), CLFMP, SBHP, FMP, and CWVV.

VA continues to become a paperless organization. VHA continues to transform internal processes, moving the organization to a digital environment to optimize services and move to a more automated claims processing environment. To continuously improve claims processing efficiency and cycle-time, VHA seeks contractor services to receive, scan and upload correspondence supporting community care processes into a digital environment.

Currently, VHA receives mail at one location.

APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

1. NARA Facility Standards for Records Storage Facilities, 36 CFR, Part 1234, Subpart B dated Jan. 2021

2. Contractor Non-Disclosure Agreements (Appendix A)

3. Mail Solution Scan Queues (Appendix B)

4. Organizational Alignment for Mail Solution Reports (Appendix C)

5. Document Conversion Rules (DCR) (Attachment A)

6. Mailing of Sensitive Personal Information VA Directive 6609

7. Knowledge Management Desk Procedures

8. NIST SP 800-88, Revision 1(r1), Guidelines for Media Sanitization, dated December 2014

9. VA Handbook 1605 Business Associate Agreements

10. VA Handbook 6500 Risk Management Framework for VA Information Systems, and applicable NIST Risk Management Framework guidance

11. VA Handbook 6500.5 Incorporating Security and Privacy into the System Development Life Cycle

12. VA Handbook 6500.3 Assessment, Authorization, and Continuous Monitoring of VA Information Systems, and applicable NIST Risk Management Framework Guidance

13. VA Handbook 6500.8 Information Systems Contingency Planning and related NIST Contingency Planning Guidance

14. VA Directive 6066 Protected Health Information (PHI) and Business Associate Agreements

15. VA Directive 6300 Records Management

SCOPE OF WORK

The Contractor shall perform paper and electronic mail conversion, workflow creation, and management services for correspondence supporting VHA care in the community. Services include the receipt, control, and digital conversion of mail source materials (mail packets and other media as described below) to standardized, indexed, and searchable portable document format (PDF) (PDF Image plus Text). The Contractor shall create a mail solution containing workflows and queues, and ensure they are setup and managed as requested by VA. The mail solution will enable VA staff with appropriate permission levels to move documents between workflows. The Contractor shall incorporate quality assurance activities and validation into multiple steps of the conversion process to ensure that VA receives images and data of sufficient quality to support its business processes. The Contractor shall also support the storage of paper mail source materials and route applicable documents, which need to be provided to VHA, in the original form.

This Consolidated Mail Intake Solution (CMIS) shall be hosted in an environment operated and controlled entirely by the Contractor and shall be fully functional in a production environment within 90 calendar days after TO award date. The CMIS shall provide a secure method for the VA to retrieve processed documentation programmatically through a file retrieval web service. This connectivity will be approved via an Interconnection Security Agreement and Memorandum of Understanding (ISA/MOU) and documented via a mutually signed Interface Control Document (ICD). All electronic communications containing PHI with VFMP will be conducted in a secure manner, utilizing FTP (File Transfer Protocol), cloud-to-cloud file migration service, or file transfer web service based on available contractor capability. All interfaces shall be encrypted in compliance with Federal Information Processing Standard (FIPS) 140-3, Security Requirements for Cryptographic Modules, which superseded FIPS 140-2 and became effective September 22, 2019. See FIPS 140-3 Transition Effort | CSRC (nist.gov) for additional information regarding the U.S. Department of Commerce National Institute of Standards and Technology (NIST) transition from FIPS 140-2 to 140-3 Modules. The Cryptographic Module Validation Program (CMVP) tests and validates modules for meeting FIPS 140-3 requirements as described at this Cryptographic Module Validation Program | CSRC (nist.gov).

APPLICABILITY

This TO PWS is within the scope of Sections 4.1 Program Management, Strategy, Enterprise Architecture, and Planning Support, 4.4 Test & Evaluation (T&E), 4.6 Enterprise Network, 4.7 Enterprise Management Framework, 4.8 Cyber Security, and 4.9 Training of the Basic T4NG PWS.

ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (PoP) shall be 12 months from date of TO award, with four (4) 12-month option periods and two (2) Optional Tasks, to be executed at the Government’s discretion. The overall PoP shall not exceed 60 months.

PLACE OF PERFORMANCE

Efforts under this Task Order (TO) shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

Work shall be conducted during core business hours, which are defined as 8:00am to 5:00pm (Central Standard Time), to exclude Federal Holidays. No work shall be performed Outside the Continental United States (OCONUS). Contractor planned maintenance outages, to every extent possible, shall be performed during non-business hours.

TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is two (2) three-day trips to Denver, CO or Washington, DC (possibly one during each PoP.) The Government estimates that the Contractor will include five (5) personnel for each trip. Anticipated locations include the following:

1. Ptarmigan at Cherry Creek , 3773 Cherry Creek North Dr., Denver, CO or other Denver location, as needed.

2. 810 Vermont Ave., Washington, DC or other Washington, DC location, as needed.

CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Zero laptops

2. Zero desktops The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

VA Enterprise Cloud Operational Tools (VAECOT) comprised of a suite of COTS cloud management tools as identified in the VA Technical Reference Guide Enterprise Development Environment (EDE) and Tools as identified in the VAEC Technical Reference Guide.

If required, the Government will provide VA network access, email addresses, and access to specific applications necessary to perform the tasks in this PWS.

The VA COR will provide the following Government Furnished Information (GFI) for performance of this TO:

a. Access to VA Project Management Tools and Repositories including but not limited to:

i. JIRA

ii. GitHub

iv. VA standard project management tools not specifically called out above

b. VA Account and Network Access if required (VPN via Citrix Access)

c. VA email account (if required)

SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply to this effort. Specific TO requirements relating to Addendum B, Section B4.0 paragraphs j and k supersede the corresponding T4NG Basic PWS paragraphs, and are as follows,

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than one (1) day.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within one (1) day.

It has been determined that protected health information may be disclosed or accessed, and a signed Business Associate Agreement (BAA) shall be required.

The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the Request for Task Execution Plan (RTEP) and shall comply with VA Directive 6066.

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

Contractor Key Personnel A skilled, experienced professional is essential for accomplishing the work to be performed. This individual is defined as “Key Personnel” and is the person detailed below. His/her resumé shall be submitted and marked by the vendor as “Key Personnel.” Substitutions shall only be accepted if in compliance with the “Substitution of Key Personnel” provision identified below. Additional Key Personnel may be proposed by the vendor.

Title: Senior Contract Project Manager (CPM) Qualifications: The Contractor shall provide a CPM that meets the below qualifications.

The CPM is a technical expert with subject matter expertise with a minimum five years of experience in Mail receipt and digital conversion. They must be an expert in leading a team of diversified staff and have a proven record in managing programs related to healthcare mail processing.

The CPM shall have experience providing oversight to the daily operational management of a mail processing solution and managing the resolution of technical and business defects and inefficiencies.

The CPM shall have experience providing oversight to all design, development, testing and release work for technical changes, coordinating with customers, stakeholders, and internal technical support.

The CPM’s experience shall demonstrate top level customer service skills and experience coordinating operational support and change management. The CPM shall have experience interfacing with staff to document, track and resolve operational problems.

The Contracting Officer may notify the Contractor and request immediate removal of any personnel assigned to the TO, by the Contractor, that are deemed to have a conflict of interest with the Government or if the performance is deemed to be unsatisfactory. The reason for removal will be documented and replacement personnel shall be identified within three business days of the notification. Employment and staffing difficulties shall not be justifications for failure to meet established schedules.

SUBSTITUTION OF KEY PERSONNEL

All Contractor requests for approval of substitutions hereunder shall be submitted in writing to the COR and the Contracting Officer at least 30 calendar days in advance of the effective date, whenever possible, and shall provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete resumé for the proposed substitute, and any other information requested by the Contracting Officer necessary to approve or disapprove the proposed substitution. New personnel shall not commence work until all necessary security requirements have been fulfilled and resumés provided and accepted. The COR and the Contracting Officer will evaluate such requests and promptly notify the Contractor of approval or disapproval in writing.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

The Contractor shall plan, monitor, and control the tasks outlined in this PWS. The Contractor shall follow VA project management methodology as well as industry standards.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

At a minimum the following items shall be incorporated into the CPMP:

· Change Control Plan

· Communications Plan

· Configuration Management Plan

· Integrated Master Schedule (IMS)

· Integration Plan

· Logistics Plan

· Quality Management Plan

· Requirements Management Plan

· Risk Management Plan

· Scalability Plan

· Service Rollout Plan

· Staffing Plan

· Stakeholder Management Plan

· Subcontractor Management Plan

· Technical/Management Plan

· Training Plan

· Work Breakdown Structure (WBS) Deliverable:

A. Contractor Project Management Plan

SPECIAL REQUIREMENTS

Within 60 calendar days of TO award, the Contractor shall have ready processing, conversion, storage space and security processes consistent with applicable VA security regulations including security requirements provided in VA Handbook 6500 and the National Archives and Records Administration (NARA) storage requirements of 36 CFR, Part 1234, Subpart B, with no exceptions made for the waivers discussed within 36 CFR, Part 1234, Subpart B. While NARA certification is not required, the Contractor shall maintain compliance with the referenced NARA requirements. The Contractor shall provide a completed Facility Standards for Records Storage Facilities Inspection Checklist (Appendix B of 36 CFR, Part 1234, Subpart B), which shall include documentation of a certified fire-safety detection and suppression system for each facility wherein source materials are received, stored, or otherwise handled as part of the end-to-end conversion process.

Within 60 calendar days of TO award, the Contractor shall have scheduled and jointly conducted with VA or its agents, an audit to assess compliance with the NARA storage requirements. The Contractor shall also complete any remediation activities required by the audit within those 60 calendar days of receipt. The Government requires annual review of facility and certification documentation to ensure compliance with established regulations.

Contractor facilities not utilized to store physical source materials, either temporarily or long term, are exempt from the Facility Standards for Records Storage Facilities Inspection Checklist but are required to meet the remaining applicable security regulations described in this section. Where an initially exempt facility is later transitioned for the purpose of maintaining, storing, or handling VA physical source materials, the Contractor, prior to introducing physical source materials into the facility, shall (1) inform VA of its intent; and (2) provide VA with evidence the facility is compliant with the referenced NARA requirements.

The Contractor shall store, maintain, and handle VA paper mail and perform any electronic processes supporting the end-to-end conversion process, within non-public, controlled spaces, accessible only by authorized personnel who have had VA privacy and security awareness training and proper background investigations. The Contractor shall ensure security personnel closely monitor the facility. The Contractor shall limit access to controlled spaces by use of approved physical access devices, lock and key, or security alarms after hours. The Contractor shall maintain strict control of documents taken in or out of any facility.

The Contractor shall provide VA or its agent with physical access to the source materials at any time during normal operating hours. The Contractor shall allow VA or its agent to perform oversight of storage conditions and operations at any time during normal operating hours.

Deliverable:

A. Facility Standards for Records Storage Facilities Inspection Checklist

REPORTING REQUIREMENTS

In support of this TO, VA requires reporting above and beyond the T4NG Quarterly Progress Reports at the T4NG basic contract level.

The Contractor shall deliver Monthly and Annual Progress Reports throughout the TO PoP, NLT than the 5th calendar day of each month. The Monthly Progress Report shall include an out brief to the VA PM. The content contained in the reports shall be representative of performance requirements as outlined in the PWS. VA will work with the Contractor to develop the content for the reports to ensure relevant datasets are accurately defined and captured. The Contractor shall maintain a lessons-learned diary and deliver as a part of the Monthly Progress Report. The Monthly Progress Reports shall include, at a minimum:

A. Operational Report (budget, hiring {gain/loss report}, etc.)

1. Trends over time B. Productivity Report (process definition, equipment types, etc.)

1. Trends over time C. Quality Report (metrics, measurement, maintenance procedures, etc.)

1. Trends over time

2. Performance issues with mitigation strategies D. Contractor Privacy and Security Training Report E. Contractor Staff Roster F. Deliverable Matrix (status of all PWS deliverables for the reporting period) The Annual Progress Report shall include an out brief to the VA PM. The content contained in the Annual Report shall be a year over year summary of the items included in the Monthly Progress Reports.

Deliverables:

A. Monthly Progress Reports B. Annual Progress Reports

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Consolidated Intake and Processing of Mail.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) business days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) business days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

PRIVACY & HIPAA TRAINING

Annually, the Contractor shall complete TMS training for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed or electronics copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix of the VA Handbook 6500.6, “VA Information and Information Systems Security/Privacy Language”.

Additional future training classes may be required, which will be identified by the COR. The Contractor shall ensure completion of these classes for itself and its subcontractors. Any person who does not complete required VA training will not be granted access to VA information, VA information systems, or the VA network.

These online courses shall need to be taken through the VA’s online Talent Management System (TMS) at: https://www.tms.va.gov/secureauth35/. To self-enroll, click the “Create New User” button on the red bar and complete the assigned training. The COR shall provide the Contractor with the appropriate information to complete self-enrollment. Technical issues with TMS should be directed to the TMS help desk at vatmshelp@va.gov or 1-888-496-0463.

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate B. Signed or Electronic copies of Contractor Rules of Behavior C. VA HIPAA certificate of completion

WEEKLY/MONTHLY UPDATE MEETING

The CPM shall participate in and facilitate weekly and monthly update meetings. Weekly and monthly meetings shall be set up in advance, considering availability of VA Program Management Office (PMO) staff, providing phone dial-in and/or teleconferencing or web conferencing. The Contractor shall provide Weekly and Monthly Meeting Agendas, respectively, prior to the meeting. The Contractor shall facilitate the meeting, track action items, describe any risks associated with performance, schedule, or other concerns during this meeting, and deliver Weekly and Monthly Meeting Minutes following the meeting. Meeting Minutes shall include current statuses of all open issues and any upcoming service development and service implementation activities.

The Contractor shall include, at minimum, the following topics:

A. Risk register review with mitigation strategy and status B. Quality status/issues with resolution plan C. Service status/issues with resolution plan D. Staffing status/issues with resolution plan E. Schedule status/issues with resolution plan F. Performance status/issues with resolution plan (performance improvement plan/remediation plan) G. Plans for coming weeks (including performance improvement plan/remediation plan efforts) H. Business Associate Agreement, Memorandum of Understanding, and Interconnection Security Agreement (ISA) I. All action items (status (pending, closed, other), duration, and resource assignments) J. Contractor corporate/resource email distribution list with updates monthly The Contractor shall capture, track, and report action items and risks weekly. Capturing, tracking, and reporting shall be electronic via a Government approved enterprise change management, risk/issue tracking tool (e.g., JIRA or similar). The Contractor is not required to develop and implement a new tracking tool to satisfy this requirement. Use of an existing solution is acceptable so long as the tool meets the following minimum requirements, and its use is approved by the VA PM:

A. Action items and risks are organized and enumerated B. The tool displays the data related to each action item/risk Deliverables:

A. Weekly Meeting Agenda B. Monthly Meeting Agenda C. Weekly Meeting Minutes D. Monthly Meeting Minutes

CHANGE CONTROL SUPPORT

VHA will establish a Change Control Board (CCB) as part of the change control process to adjudicate proposed change requests. VHA anticipates the CCB will conduct routine meetings on a monthly basis. The Contractor shall participate in these CCB meetings when requested by VA and may do so on a virtual basis. The participation shall include at least one representative with the authority to make commitments on behalf of the Contractor. The Contractor shall support the CCB in assessing the level of effort and the impact of proposed change requests.

VHA will manage the change control process. Proposed change requests may include managing and implementing changes which may include, at a minimum:

A. Service enhancements B. Shipping guidance C. Constructive custody D. Document Conversion Rules (DCRs) (Attachment A) E. Indexing F. Document Type and Date of Receipt Guide G. Disposition H. Interfaces with Government system(s) I. Graphical Self-Service Report Generation (other than ad hoc reports)

CONTINUITY OF OPERATIONS PLAN (COOP)/DISASTER RECOVERY (DR) PLANS

The Contractor shall develop, maintain, and test service continuity, contingency, and disaster recovery plans for all services performed under this TO. In providing these services, the Contractor shall:

A. Prepare and deliver COOP and DR Plans to ensure the orderly recovery from a disaster that may render all or part of a service facility, system, or equipment inoperable B. Coordinate with interfacing systems to verify integration of procedures and planning C. Develop measures to protect all services, equipment, and data for which the Contractor is responsible from potential environmental threats D. Ensure services and equipment for which the Contractor is responsible are operational and restore any lost capabilities and data after the occurrence of a disaster E. Conduct and participate in semi-annual COOP/DR exercises F. Provide COOP/DR exercise results Deliverables:

A. Continuity of Operations (COOP) Plan B. Disaster Recovery (DR) Plan C. COOP/DR exercise results

Mail Receipt The Contractor shall receive paper mail directly from VHA, VHA partners, the United States Postal Service (USPS), and directly from Veterans, their families, and their representatives.

The Contractor should anticipate the receipt of mail including both printed and handwritten content from:

A. Paper B. Photographs Mail may also include electronic format source materials including but not limited to:

A. CD/DVD

B. Flash drives C. Other alternate media In addition to mail received via the US Postal Service (USPS), VA may also ship to the Contractor facility mail received directly at VA facilities.

VA anticipates that the volume of paper mail received by the Contractor will vary by day, week, and month. VA will collaborate with the Contractor to mitigate the impact of this variation to the extent that it does not impact VA business operations.

The Contractor shall maintain the ability to receive mail at least once daily either directly from USPS delivery or any other carrier VA or a Veteran or Veteran’s representative selects to use for mail and shipments, or upon Contractor pick-up from the USPS site. The Contractor shall receive source material daily with fewer than three (3) calendar days of disruption within a 365-day period. The Contractor shall establish facilities, equipment, processes, and personnel to meet this requirement. This requirement applies to all disruptions for which VA is not responsible and excludes all Federal Holidays. Due to the sensitive nature of the content, the Contractor shall take receipt of materials shipped by VA during the delivery periods of VA’s national contract carrier, which is currently United Parcel Service (UPS), or from the USPS. In addition, the Contractor shall take receipt of materials shipped by alternative carriers utilized by VA entities OCONUS, where UPS and/or USPS may not be available or utilized. Any changes to VA’s national carrier will be communicated to the Contractor by the Contracting Officer.

Mail may be received in any form capable of delivery through the USPS. The most common forms VA currently receives are envelopes and flats; but on occasion, boxes or small packages may be received. The Contractor shall comply with established USPS procedures for handling certified or registered mail or other carrier signature procedures necessary to take receipt of source materials. Within 45 calendar days of TO award, VA will establish PO boxes to which all incoming Veteran mail is delivered by the USPS. These PO boxes will be located within a single USPS facility servicing the Contractor, regardless of the number of sites the Contractor uses. Depending upon the terms and conditions of the agreement with USPS, or any other carrier VA selects to use for mail and shipments, mail will either be directly delivered to the Contractor’s site or will be available for pickup at the closest possible USPS (or other carrier facility) site to the Contractor’s site(s).

Each piece of mail shall be checked in, logged, and assigned a date of receipt indicating the date and time it was received. For the purposes of this PWS, “received” is defined as the time the material is checked in and is trackable within the Contractor’s system. Check-in of all received mail shall occur the same day the mail was received. This assigned date of receipt endorsement shall then be applied to each piece of mail during the conversion process. As there are multiple VA lines of business, different endorsements must be used. The digital endorsement shall consist of the following:

“MM/DD/YYYY HH:MM:SS – VA (PO BOX) (e.g., 01/01/2020 08:15:45 – VA #######).

This receipt shall constitute the acceptance of the records and liability for records management by the Contractor. The Contractor shall initiate tracking of mail upon receipt.

The Contractor shall forward articles of mail that appear to have been misrouted to the Contractor to the following address: ATTN: CIPM Rejects, Health Admin Center, Suite 470, 3773 Cherry Creek North Drive, Denver, CO 80209.

In the event a box or envelope is damaged and the contents unable to be scanned, the Contractor shall replace/repackage the documents to ensure there is no potential access to or loss of VA assets or sensitive information and resend the documentation back to the original sender.

If the original sender cannot be identified, the Contractor shall notify the COR and VA PM immediately, via email, upon occurrence, detailing the damage and the specific source material(s) damaged, if any. The Contractor shall also notify the COR and VA PM immediately, via email, upon discovery that documents have been lost.

Within one (1) calendar day of discovery of a damage/loss incident, the Contractor shall complete and submit to the VA PM and COR a Damage Incident Report. The Contractor shall also photograph any mail/box for which a Damage Incident Report is completed. Photographs shall not include any sensitive information. The photograph shall accompany the Damage Incident Report submitted to the COR.

VA anticipates the following volume of mail will be sent to the Contractor per month:

· VFMP: Mail = 168,000 pages

· Logistics Mail = 40 pages All faxes will be sent from VA to the Contractor via postal mail. The Contractor will not receive any faxes directly from any source. VA anticipates that it will require document conversion services for source materials equivalent to approximately 10 million images over a period over five years (approximately 2 million images for the base year and 2 million for each subsequent option period). The volume of mail received by the Contractor for conversion will be dependent primarily on the number of claims, eligibility, and appeals supporting documents received from Veterans, beneficiaries, and providers.

Deliverables:

A. Return of Misrouted Mail B. Damage Incident Reports

POST OFFICE BOX (PO BOX) AND OTHER CARRIER MAIL

The Contractor shall receive centralized mail source materials from:

A. The USPS via Government established PO boxes or direct delivery to the Contractor’s facility B. Any other carrier a Veteran or Veteran’s representative selects to use for mail and shipments (e.g., FedEx, UPS, DHL) The PO boxes may be existing PO boxes redirected to the Contractor performance location or new PO boxes established in direct support of this TO. For the first year of performance, VA will forward via the Post Office the mail from current PO Boxes to PO Boxes at the Contractor's location. Contractor will receive the mail, open, scan/upload into the Consolidated Mail intake Solution and/or process according to the DCRs. Per section 5.7, Contractor shall retain the paper for 60 calendar days for any rescan requests, then destroy. The forwarding process will last for one year to allow for communication of the newly established shipping address.

The Government will be responsible for establishing the PO boxes at the Contractor’s physical location. The Contractor shall monitor, retrieve mail from, and develop internal processing activities to be performed on the mail. The mail received will include direct mailings from Veterans/claimants and their representatives or mail received at a VA facility, repackaged, and mailed.

The following table includes a listing of current established PO boxes and addresses supporting existing conversion and mail processing activities. The Contractor will receive mail from the following addresses prior to a new shipping address being established at the Contractor’s location:

ATTN: Director/Logistics/Com/OCIO/FOIA P.O. Box 469060 Denver, CO 80246-9060 Veteran and Family Member Program

ATTN: Foreign Medical Program P.O. Box 469061 Denver, CO 80246-9061 Veteran and Family Member Program

ATTN: Fiscal Management/Finance P.O. Box 469062 Denver, CO 80246-9062 Veteran and Family Member Program

ATTN: CHAMPVA

PO Box 469063 Denver CO 80246-9063 Veteran and Family Member Program

ATTN: Claims/Correspondence P.O. Box 469064 Denver, CO 80246-9064 Veteran and Family Member Program

ATTN: Spina Bifida/CWVV P.O. Box 469065 Denver, CO 80246-9065 Veteran and Family Member Program

ATTN: Appeals P.O. Box 460948 Denver, CO 80246-9048 Veteran and Family Member Program

ATTN: Eligibility P.O. Box 469028 Denver, CO 80246-9028 Veteran and Family Member Program

ATTN: Program Integrity P.O. Box 461307 Denver, CO 80246-1307 Veteran and Family Member Program

ATTN: Caregiver Program P.O. Box 460637 Denver, CO 80246-0637 Veteran and Family Member Program

ATTN: P2E Rejects P.O. Box 461047 Denver, CO 80246-1047 Veteran and Family Member Program

Department of Veteran Affairs Financial Services Center ATTN: Camp Lejeune P.O. Box 149200 Austin, TX 78714-9200 Veteran and Family Member Program

During the duration of this TO, VA will alert the Contractor of any changes in the PO box configuration (e.g., commissioning, decommissioning, and consolidation of PO boxes). The Contractor shall comply with established USPS procedures for handling certified or registered mail or other carrier signature procedures necessary to take receipt of source materials.

Any material received with a date stamp already applied by a VA authorized facility shall be assigned a date of receipt in accordance with the DCRs.

This receipt shall constitute the acceptance of the materials and liability for materials management by the Contractor. The Contractor shall initiate tracking of mail upon receipt.

RECORDS MANAGEMENT

A. The Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

B. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

C. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated data must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

D. [VA] and its Contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of [VA] or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, the Contractor must report to [VA]. The agency must report promptly to NARA in accordance with 36 CFR 1230.

E. The Contractor shall immediately notify the appropriate CO upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to [VA] control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the CO or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph D of this section.

F. The Contractor is required to obtain the CO's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and [VA] guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

G. The Contractor shall only use VA IT equipment for purposes specifically tied to or authorized by the contract and in accordance with [VA] policy.

H. The Contractor shall not create or maintain any records containing any non-public [VA] information that are not specifically tied to or authorized by the contract.

I. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

J. The [VA] owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which [VA] shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

K. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take [VA]-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

L. Flowdown of requirements to Subcontractors: The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract document, and require written subcontractor acknowledgment of same.

M. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

Mail Custodial Requirements

MAIL HANDLING

Mail contains Veterans’ claims, including personally identifiable information (PII), protected health information (PHI), and sensitive personal information (SPI), and shall be treated as sensitive information. The Contractor shall ensure that mail and the VA information it contains is not damaged and/or compromised in any fashion from the point of receipt through storage awaiting disposition. While in possession of paper mail, the Contractor shall be compliant with all established VA security policies to ensure that VA data are not compromised. Throughout the conversion process, the Contractor shall securely handle sensitive information, manage conversion in accordance with published DCRs without loss or damage to original source material, and work collaboratively with VA to support efficient processing of variable document conversion production rates.

Transportation of mail from PO Box addresses should be performed in accordance with VA directive 6609.

The Contractor shall have a documented process for physical inventory management and tracking of all paper mail while in the Contractor’s possession.

The Contractor shall maintain the physical arrangement (e.g., order of materials in paper mail) until conversion is complete unless otherwise directed by the DCRs.

VA anticipates the Contractor will occasionally receive sensitive, fragile, damaged and potentially hazardous mail materials. Examples include source materials damaged by water resulting in the presence of mold, or source materials exposed to extreme levels…