Performance Work Statement.docx

Performance Work Statement

1. Purpose: The Rocky Mountain Regional VA Medical Center (RMRVAMC) and its associated Community-Based Outpatient Clinics (CBOCs) require contracted non-emergency wheelchair transportation services. The contractor shall provide all vehicles, personnel, management, supplies, and necessary reporting for the provision of timely and safe transport services for Veterans in wheelchairs. These services shall be made available as needed, including weekends and holidays.

2. Background: The RMRVAMC main campus is located 1700 N. Wheeling St. Aurora, CO 80045., serving over _224,296_ Veterans, primarily from the _Eastern Colorado area and it’s 13 Community-Based Outpatient Clinics. The hospital has 211 inpatient beds and sees approximately 5,516 inpatient admissions and 992,032 outpatient visits a year. Veterans served within this facility live within the following counties and zip codes.

Zip Codes

County Names

JEFFERSON

3. Acronyms AC – Authorized Caller CO – Contracting Officer COR – Contracting Officer’s Representative DOL – Department of Labor IAW – In Accordance With OO – Ordering Officer PWS – Performance Work Statement QASP – Quality Assurance Surveillance Plan QC – Quality Control Plan TB – Tuberculosis TJC – The Joint Commission VTS – Veteran Transportation Service WC – Wheelchair

4. Scope/Requirements

4.1. Type of Service

4.1.1. The contractor shall provide non-emergency wheelchair transportation services on an as-needed basis in accordance with all federal, state, and local regulations.

4.1.2. Occasionally a Veteran will need to be transported with VA staff and equipment; the contractor shall return VA Staff and equipment to the original place of pick-up.

4.2. Transport of Miscellaneous Items with the Patient

The Contractor may also be required to transport patient luggage, medical records, medication, and comfort items from pickup points to destination at no additional cost to the Government while also transporting the patient. The luggage to be transported will be restricted to suitcase and valise types. When patients are transported to the Rocky Mountain Regional VA Medical Center, destination is deemed to be the ER, Admissions, the clinic, or service within the hospital, or directly to the ward as instructed by VA Staff.

4.3. Contractor Personnel: Contractor personnel shall be courteous and always conduct themselves in a businesslike manner while providing services under this contract.

4.3.1. Drivers & Other Personnel:

4.3.1.1. Drivers and other medical personnel (as applicable) shall at all times meet the qualifications specified in this contract as well as all applicable federal, state, and local government laws, regulations, and standards. Drivers and other medical personnel (as applicable) shall be certified, licensed, or otherwise officially recognized by the local, state, or regional government or public entity where the service is operated or by which it is governed.

4.3.1.2. If the contractor wishes to add or replace personnel throughout the life of the contract, it shall provide evidence of required training, certifications, licensing, and any other qualifications to the Contracting Officer’s Representative (COR) for review.

4.3.1.3. All drivers shall have a valid driver’s license in accordance with state requirements for their place of operation and the services they perform. If the contractor wishes to add or replace drivers throughout the life of the contract, it shall provide a valid driver’s license to the COR.

4.4. Contractor Equipment, Vehicles, and Inspection

4.4.1. Vehicles shall meet all applicable federal, state, and local regulations and specifications, including but not limited to licensing, registration, and safety standards.

4.4.2. The VA reserves the right to inspect the contractor’s equipment and vehicles or require documentation of compliance with state laws, rules, regulations, and guidelines governing transport vehicles. VA inspections of contractor equipment do not constitute a warranty or guarantee that the contractor’s vehicles and equipment are properly maintained. The VA reserves the right to restrict the contractor’s use of equipment and vehicles in the performance of this contract which are not in compliance with contract requirements. The restriction of such equipment and vehicles shall not relieve the contractor from performance in accordance with the contract nor necessitate additional cost to the VA.

4.4.3. Vehicles shall be clean and maintained in good repair in accordance with manufacturer’s instructions.

4.4.4. The contractor shall not borrow or exchange supplies, equipment, and/or medications with the VA. Equipment attached to or in use by the patient at time of pick-up may remain with the patient during transport to ensure continuity of care. Medical Control Authorities are responsible for maintaining and supplying medication during patient transport. All VA equipment and unused medications must be returned to VA during patient drop-off or as promptly as feasible within 24 hours.

4.4.5. The contractor shall furnish qualified personnel as required by contract specifications to accomplish all the services under this contract.

4.4.5.1. The contractor personnel performing services for the VA shall, at all times, conduct themselves in a professional manner, and be identified by having the company name, and employee name affixed to the uniform. The Contractor shall be responsible for furnishing all vehicles, uniforms, nametags and/or badges for performance of services under this contract. Employee identifications shall be worn in clear view above the waist. The contractor personnel shall not smoke/play loud music originating from any device in vehicles while transporting VA patients.

4.4.5.2. Each driver shall possess a driver’s license that is valid for the class of vehicle driven. Evidence of a special transportation service vehicle permit, or endorsement issued by the commissioner of public safety.

· Be at least 18 years of age and have not less than one year of experience as a licensed driver; and

· For the past three years:

· Have not had a driver’s license canceled or suspended.

· Have a driving record clear of convictions for operating a motor vehicle or motorcycle without insurance.

· Have a driving record clear of convictions for driving a motor vehicle without a valid current license for the class of vehicle driven

· Have a driving and criminal record clear of convictions for driving under the influence of alcohol or a controlled substance.

4.4.5.3. The contractor personnel will ensure that the patient is secured before the vehicle moves and during transport.

4.4.5.4. Drivers shall have a valid driver’s license, in accordance with Federal, State, and local government requirements for their place of operation for the services they perform.

4.5. Transportation Request

4.5.1 VetRide or VA-Approved Transportation Software Utilization:

The contractor agrees to utilize the VetRide Vendor Portal or VA-Approved Transportation Software with every patient transported under this contract.

Department of Veteran Affairs will provide the software and access to the VetRide Vendor Portal or VA-Approved Transportation Software for the vendor/contractor in this contract. The Contractor will utilize the VetRide Vendor Portal or VA-Approved Transportation Software fully as instructed:

a) Receive and respond to electronic trip requests

b) Receive, use, and ensure the use of the Vendor pass by the driver.

c) Submit claims via the electronic VetRide Vendor Portal or VA-Approved Transportation Software system.

d) All invoices must be submitted within 30 calendar days of date of service in accordance with 38 CFR 70 to be considered timely submission. The contractor’s invoice must be submitted to include:

i. Contract Number

ii. Date of Service

iii. Authorization number(s) (if applicable)

iv. Pick-up and drop-off location of the patient

v. Base Rate

vi. Name (Last, First and Middle Initial (if any)) and Full Social Security number (Box 1a) of patient transported

vii. Date of Birth and Sex

viii. Documentation of circumstances when billing for waiting time

ix. Any miscellaneous charges for which the contractor is expecting reimbursement i.e., Toll charges, waiting time, etc.

x. VA authorizing official’s name

e) Unauthorized charges will be reviewed by the Contracting Officer Representative (COR) or Program Manager as to the validity of the charges and as to whether the payment will be made. A final determination will be made within 30 days after notifying the Contractor of the charges which are being suspended.

4.5.1.1. A transportation request is defined as one incidence of a request for one-way service. No more than one patient will be transported per order unless approved by an authorized VA staff. Transportation requests will be made through VetRide or VA-Approved Transportation Software Utilization. Contractors must have the capability to receive orders, update ride status, and input trip costs and other required data through this portal. Contractors must have dedicated staff available to monitor this portal 24/7. Rocky Mountain Regional VA Medical Center Travel Program Staff will be available to assist with account setup and training for the Contractor’s Staff. In the event VetRide or other VA-Approved Transportation Software Utilization is down, other methods of communication (i.e., telephone, facsimile) will be used to place Transportation requests.

4.5.1.1.1. Rocky Mountain Regional VA Medical Center Travel Program Staff/or authorized VA employees will work with the Contractor the following business day to reconcile any transportation requests that were placed outside of VetRide or VA-Approved Transportation Software Utilization.

4.5.1.1.2. The Contractor must update VetRide or VA-Approved Transportation Software Utilization with any data and/or notes in real time that deviate from the original order such as invoicing for additional mileage due to a road closure, wait time, reason for no load, etc. Rocky Mountain Regional VA Medical Center Travel Program Staff/or authorized VA employees may place a “hold” on payment of this order until it has been reconciled.

4.5.1.2. Only the following VA staff are authorized to place, cancel, or make changes to transportation requests:

Contracting Officer’s Representative (COR)

The Contracting Officer will furnish the Contractor with the names of individuals above, who are authorized as Authorized Callers by separate memorandum upon issuance of the contract. The Contracting Officer will update this list throughout the life of the contract as Authorized Callers change.

Authorized Callers are responsible for issuing and administering orders placed under this contract. Authorized Callers have no authority to modify any term of this basic contract. Any deviation from the terms of the basic contract must be approved in writing by the Contracting Officer responsible for this contract. The Contractor shall accept orders against this contract only from the Contracting Officer and/or authorized callers. Fulfilling orders from persons other than the Contracting Officer or Authorized Caller may result in loss or delay in payment for supplies/services provided under such orders.

Non-authorized VA employees and private agencies (e.g., nursing homes) are not considered authorized to place transportation requests.

4.5.1.2.1. All patient pick-up(s) and drop-off(s) shall be authorized via “orders” which shall only be issued by the designated Authorized Caller. When placing orders for services, the Authorized Caller shall contact the designated contractor point of contact(s) to provide the following information:

· Mode of transportation required,

· Required time of arrival

· Name of the beneficiary,

· Pick-up and delivery point,

· Last four of the patient's Social Security Number, and

· Any other special instructions

4.5.1.3. For ALL Transports – an Audit system will be put in place by the VA to include the COR or designee, Beneficiary Travel Department staff, and clinical staff to ensure appropriateness of the order and timeliness of the response.

4.5.1.4. The need for wheelchair transportation service required will be discussed and determined by VA clinical personnel and the contractor. The contractor shall transport the patient per its policies and standard industry practice. If the type of transportation service differs from what was agreed upon by the VA and contractor, the contractor shall submit documentation to the VA explaining its rationale.

4.5.1.5. The VA may authorize an escort (e.g., spouse, relative, guardian, etc.) to accompany the patient during transport if it is practicable and, in the patient’s, best interest. The contractor shall allow the escort to accompany the patient at no additional cost.

4.5.1.6. The contractor shall have sufficient vehicles and personnel to provide services for up to four (4) simultaneous transportation requests. Transports required is specific to Veterans who occupy/utilize a manual or electronic wheelchair.

4.5.1.7. The number of transports under normal operating conditions will typically range from 10-30 transports each weekday and significantly less on weekends and holidays. The number of actual transports may vary throughout the life of the contract.

4.5.1.8. The patient may bring with her or him up to three (3) liters of oxygen. The contractor shall be responsible for providing adequate and safe storage of the oxygen tanks during transport.

4.5.1.9. Response Times*

4.5.1.9.1. Orders that are scheduled by 7pm local time the day before the required services are defined as scheduled in advance. With the exceptions found below, the contractor shall arrive on time for all orders scheduled in advance.

4.5.1.9.2. For all add-ons (not scheduled in advance) transportation requests, with pick up at Rocky Mountain Regional VA Medical Center: The contractor will be allotted up to a sixty (60) minute response time from time of order placement for transportation requests that are not previously scheduled in advance.

4.5.1.9.3. For transportation requests which do not have a pick-up at Rocky Mountain Regional VA Medical Center:

a. Pick-up appointment times shall be agreed upon by the VA and contractor at time of order placement and be reasonable based upon travel distance, speed limits, and weather conditions.

b. The contractor’s patient pick-up time cannot be more than 15 minutes prior to the schedule pickup time nor 15 minutes later than the scheduled pickup time for transportation requests scheduled in advance.

* The contractor shall not be held liable for nonperformance caused by an occurrence beyond the reasonable control of the contractor and without its fault or negligence such as, acts of God or the public enemy, acts of the Government in its sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, and unusually severe weather. The contractor MUST notify the VA with as much advance notice as possible should any of these occur.

4.5.2. Cancellations

4.5.2.1. For trips in which the contractor is notified of cancellation before the vehicle is dispatched, there shall be no charge to the Government.

4.5.2.1.1. A “no show” is defined as a transportation request which is cancelled after the contractor has dispatched a vehicle, the vehicle is enroute, or has arrived at the pick-up location, and there is no longer a requirement for patient transportation. The contractor may request one-way reimbursement for no-shows. No-show reimbursement shall be based upon the base rate for the service requested and the one-way mileage accrued enroute to the pick-up location at time of cancellation. Mileage for no- show cancellations shall be confirmed by the contractor and reported to the VA as soon as possible from time of cancellation.

4.5.2.2. For transportation requests OUT of Rocky Mountain Regional VA Medical Center ONLY – The contractor will immediately dispatch a vehicle upon receipt of the order (including transportation requests in which the final destination may change prior to pick up due to the critical condition of the patient). When the contractor is notified of a cancellation prior to arrival at the Rocky Mountain Regional VA Medical Center campus, there shall be no charge to the Government.

4.6. Pick-Up/Drop-Off/Reporting Procedures

4.6.1. Driver personnel shall pick up and deliver patients at specified locations (e.g., front door of Rocky Mountain Regional VA Medical Center Entrance). These locations will be specified by VA staff when an order is placed and communicated to the transport personnel.

4.6.2. When applicable, driver personnel shall report to the Veteran Transportation Service (VTS) Dispatcher or Health Administrative Officer of the Day (HOD) to (1) announce his/her arrival to pick-up and transfer the patient.

4.6.3. In cases where driver personnel must divert to a local emergency department while performing a VA authorized transport, the contractor’s dispatcher shall notify the VA Beneficiary Travel Department or Health Administrative Officer of the Day (HOD) of the patient’s location and status as soon as this information becomes available.

4.7. Patient Welfare

4.7.1. The contractor shall be responsible for the patient’s welfare during transport. The contractor shall be held responsible for patient and/or VA property during transport. Any damaged or lost wheelchairs, walkers, crutches, or personal belongings shall be replaced at the contractor’s expense.

4.7.2. The VA requires the contractor to exercise extreme caution and care in the handling of patients.

4.7.3. If a VA beneficiary being transported declines to be properly secured or removed the securement devices himself/herself, the driver will notify the Contracting Officer’s Representative (COR) of this fact prior to departure. The contractor is not required to transport any VA beneficiary who refuses to be properly secured while being transported. In the event that the beneficiary refuses to be properly secured, they shall be returned back into the building which they came from.

4.8. Incident Reporting

4.8.1. The contractor shall notify the COR, Requestor, Program Manager, Beneficiary Travel Department, of any accidents and/or safety problems that occur while the patient is being transported. This notification shall occur within one (1) hour by telephone. A written report of the incident shall be delivered to the COR, Program Manager, or Beneficiary Travel Department, by the close of business of the next working day.

4.8.2. The COR will monitor the service provided. The contractor shall cooperate with the COR in providing information and answering questions in a timely manner. The contractor shall promptly inform the COR of any complaints received directly from patients. If warranted, the VA may conduct incident investigations and require written response from the contractor within 48 hours of request.

4.9. Invoicing

4.9.1. Each transport shall include thirty (30) minutes of wait time; the contractor may invoice for wait times in excess of this initial thirty (30) minutes. Wait time shall begin only once the contractor has both reached the pick-up address location and the appointment time has elapsed. All wait times shall be itemized and invoiced in fifteen (15) minute intervals. For partial fifteen (15) minute intervals, zero (0) to seven (7) minutes shall be rounded down to zero (0) minutes and eight (8) to fifteen (15) minutes rounded up to fifteen (15) minutes.

4.9.2. When invoicing for mileage, the contractor shall round to the nearest mile. Mileage ending in .5 or higher shall be rounded up to the nearest mile. Mileage ending in .4 or lower shall be rounded down to the nearest mile. Payment for mileage to or from the point of care shall be limited to the VA’s calculation according to the VA’s Bing Maps API determination. Bing Maps API is optimized to determine mileage based on the shortest time of travel.

4.9.3. If unloaded mileage exceeds loaded mileage, the contractor may invoice for a flat fee only if the following also occur:

· Unloaded mileage exceeds 75 miles

· The contractor does not deviate from a route to intentionally make unloaded mileage exceed loaded mileage.

4.9.4. Except for no shows and trips when unloaded mileage exceeds loaded mileage in accordance with 4.9.3, the contractor shall invoice for loaded (patient onboard) services and mileage only.

4.9.5. Upon notification of the contracting officer, the vendor must receive training and begin implementation of invoices via Vet Ride within 30 days versus VA Tungsten Network e-Invoicing network. Invoices must be submitted in the VetRide Vendor Portal or other VA approved software. These invoices shall include the following:

i. Contract Number

ii. Date of Service

iii. Authorization number(s) (if applicable)

iv. Pick-up and drop-off location of the patient

v. Base Rate

vi. Name (Last, First and Middle Initial (if any)) and Full Social Security number (Box 1a) of patient transported

vii. Date of Birth and Sex

viii. Documentation of circumstances when billing for waiting time

ix. Any miscellaneous charges for which the contractor is expecting reimbursement i.e., Toll charges, waiting time, etc.

x. VA authorizing official’s name

Payment by VA under this contract for services authorized under this contract extinguishes all liability on the part of the VA BENEFICIARY for that transportation service. UNDER NO CIRCUMSTANCES ARE VA BENEFICIARIES, THIRD PARTY INSURANCES, MEDICARE, OR MEDICAID TO BE BILLED FOR THE SERVICES PERFORMED UNDER THIS CONTRACT.

5. Period & Place of Performance

5.1. This contract’s ordering period shall be effective from Date of Award through Base + 4 Ordering Periods end date.

5.1.1. Rocky Mountain Regional VA Medical Center to include specific Atrium Clinics, Emergency Department, pavilions. The Rocky Mountain Regional VA address is: 1700 N. Wheeling St. Aurora, CO 80045.

5.1.2. Rocky Mountain Regional VA Community-Based Outpatient Clinics (CBOCs):

USAF Academy, CO 80840

Alamosa, CO 81101

Aurora, CO 80018

Burlington, CO 80807

Fort Carson, CO 80913

Colorado Springs, CO 80907

Golden, CO 80401

Aurora, CO 80012

La Junta, CO 81050

Lamar, CO 81052

Colorado Springs, CO 80907

Pueblo, CO 81008

Salida, CO 81201

Colorado Springs, CO 80915

Colorado Springs, CO 80907

Denver, CO 80205

5.1.3. Veteran’s residence.

5.1.4. Local airports include Denver International Airport, Colorado Springs Airport, Pueblo Memorial Airport.

6. Quality Control Plan

6.1. Quality Control

6.1.1. The contractor shall maintain a Quality Control Plan (QCP) that contains, at a minimum, the following:

6.1.1.1. A description of the company’s organizational structure including a description of the roles and responsibilities of management and supervisors.

6.1.1.2. A description of the methods to be used by the contractor for identifying and preventing deficiencies or problems in the quality of service.

6.1.1.3. A description of the specific steps the contractor will take for corrective action if needed if a deficiency or problem in the quality of service occurs.

6.1.1.4. A description of the company’s records and tracking system used to identify up-to-date background checks, applicable certifications and tests, and training of each employee performing services under this contract.

6.1.1.5. A description of the method used to provide on-time services to meet the requirements of this contract (24/7 availability and up to 4 simultaneous transports in accordance with PWS 4.5.1.7).

6.1.1.6. A description of the methods used to identify and prevent radio communication breakdowns and a detailed procedure for alternative communications in the event of electronic and mechanical breakdown of vehicle two-way radios.

6.1.1.7. CONTENGENCY PLAN: (In case VetRide Vendor Portal is down) A description of the method/system used to log all requests for service. The contractor shall confirm that the log indicates the date and time of service call, actual time of pick-up versus the scheduled time, name of patient requiring services, designated pick-up and delivery points, mileage, and actual waiting time at pick-up and delivery points if waiting charges are claimed. The contractor shall confirm the log will be sent to the COR monthly.

6.1.2. The Government will evaluate the contractor’s performance under this contract to ensure that the contractor’s QCP is adequate, and that quality is achieved through a Quality Assurance Surveillance Plan (QASP).

6.1.3. The QASP will specify the work requiring surveillance and the Government’s method of surveillance.

6.2. Minimum Performance Standards

6.2.1. The contractor shall maintain performance standards in accordance with the standards outlined in the table below. Failure to meet the Acceptable Quality Levels (AQL) may result in termination of the contract.

6.2.2. The QASP will include the standards below as well as others derived from the successful offeror’s quality control plan.

Reference

orders

7. COVID-19 Or Other Similar Infectious Diseases

7.1. Contractor shall not refuse transports of COVID-19 positive or other similarly infected patients.

7.2. Contractor shall abide by all additional procedures and precautions that may be implemented by the VA based on VA-issued guidance and/or CDC recommendations. These procedures are subject to change throughout the life of the contract and will be incorporated via attachment (S03 VTS Patient Transport PPE and Vehicle Cleaning/Disinfection SOP).

7.3. Contractor shall have written policy of steps they will take to prevent the spread of COVID-19 or other similarly infectious diseases by their employees and/or vehicles. This policy shall, at a minimum, include procedures of screening drivers before each shift, deliberate decontamination of their vehicles and all other preventative precautions taken by Contractor employees.

7.4. Contractor shall furnish all required PPE throughout the life of the contract.

8. Conformity To Regulations

8.1 The contractor and his/her operators shall conform to all Federal, State, and local regulations governing the performance of contracted services.

8.2 VAMC facilities have been designated NO SMOKING areas in their entirety. Individuals found in violation of this no smoking policy may be subject to a $50.00 federal citation for disregarding posted safety rules and regulations. Furthermore, the contractor may be directed to stop work. The contractor is to notify all of his/her employees and/or sub-contractors of this strict enforcement policy.

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

C-18

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality- assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above- mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o.

p. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that are used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

q. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS. This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company- owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

(7) In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

(8) Contractors/subcontractors who no longer require VA access will return VA- issued property to VA. This property includes (but is not limited to) documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

4. TRAINING. This entire section applies to all acquisitions which include section 3.

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) 10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role- based information security training].

(4) The contractor shall provide the COR/CO with a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

(5) Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

5. SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO with the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise…