PERFORMANCE WORK STATEMENT - PWS - DRAFT.doc

PERFORMANCE WORK STATEMENT

SOBER LIVING ENVIRONMENT (SLE) REQUIREMENTS

1.0 GENERAL: Addiction Recovery Treatment Services (ARTS) at VA Northern California Health Care System (VANCHCS) requires contractors to provide Sober Living Environment (SLE) services as part of the overall continuum of care for Veterans with substance use disorders (SUD). The goal of ARTS is to assist Veterans with substance use disorders in their recovery efforts to live a life free of addiction. ARTS provides a full spectrum of care from outpatient to intensive outpatient and referrals to residential SUD services. ARTS seeks the support of a contractor to provide a quality SLE to support the in-person attendance of an Intensive Outpatient Program (IOP) program based in Lodi, California with potential for expansion to other facilities. SLE’s are residential environments with sufficient supportive services to meet Veteran needs and ultimately facilitate recovery and improvement of their overall health status. Contractor must be licensed by the State of California. These veterans may present with a serious mental illness, chronic health conditions or past legal problems in addition to addiction.

2.0 BACKGROUND: Through ARTS, VA provides assessment, case management and treatment services to Veterans and facilitates their access to a broad range of medical, mental health, and rehabilitative services provided by the VA. The purpose of this solicitation is to obtain offers from Contractors within the VANCHCS catchment that can provide a SLE for Veterans with SUD. Providers in VANCHCS identify Veterans requiring this level of care using the American Society of Addiction Medicine’s (ASAM) Patient Placement guidelines. The Contractor will be required to provide a therapeutic and recovery-oriented milieu and attendant services targeting the underlying contributors to presenting substance use disorders that impacting veteran stability, mental health and at times housing status. Contractors shall not be required to provide detoxification or other hospital level treatment or services.

3.0 PERIOD OF PERFORMANCE:

Base Period of Performance: 1 September 2026 – 31 August 2027 Option Year 1: 1 September 2027 – 31 August 2028 Option Year 2: 1 September 2028 – 31 August 2029 Option Year 3: 1 September 2029 – 31 August 2030 Option Year 4: 1 September 2030 – 31 August 2031

4.0 HOURS OF OPERATION: The Contractor will be required to provide services during the work hours defined below. The Contractor will not be required, except in case of emergency or when fulfilling attending responsibilities, to provide services during off-duty hours as defined below.

The Contractor shall furnish each veteran referred for care the following services, room and board, 24 hours per day, 7 days a week (Sunday through Saturday) and including holidays.

Sun Mon Tue Wed Thu Fri Sat

24hrs 24hrs 24hrs 24hrs 24hrs 24hrs 24hrs

5.0 POINTS OF CONTACT:

TBD

6.0 CO RESPONSIBILITIES:

6.1 The Contracting Officer (CO) is the only person authorized to approve changes or modify any of the requirements of this contract. The Contractor shall communicate with the CO on all matters pertaining to contract administration. Only the CO is authorized to make commitments or issue any modification to include (but not limited to) terms affecting price, quantity or quality of performance of this contract.

6.2 The CO shall resolve complaints concerning Contractor relations with the Government employees or patients. The CO is final authority on validating complaints. In the event the Contractor effects any such change at the direction of any person other than the CO without authority, no adjustment shall be made in the contract price to cover an increase in costs incurred as a result thereof.

6.3 In the event that contracted services do not meet quality expectations the best remedy will be implemented, including but not limited to, a targeted and time limited performance improvement plan; increased monitoring of the contracted services; consultation or training for Contractor personnel to be provided by the VA; replacement of the contract personnel and/or renegotiation of the contract terms or termination of the contract.

7.0 COR DUTIES AND RESPONSIBILITIES:

7.1 The Contracting Officer’s Representative (COR) will be appointed by the CO and a copy of the appointment letter outlining the responsibilities of the COR will be provided to the Contractor.

7.2 The COR shall be the VA official responsible for verifying the contract compliance. After contract award, any incidents of Contractor noncompliance, as evidenced by the monitoring procedures, shall be forwarded immediately to the CO.

7.3 The COR will be responsible for monitoring the Contractor’s performance to ensure all specifications and requirements are fulfilled.

7.4 The COR will review and certify monthly invoices for payment. If, in the event the Contractor fails to provide the services in this contract, payments will be adjusted to compensate the Government for the difference.

7.5 All contract administration functions will be retained by the VA.

8.0 SERVICES

8.1 STANDARD AMENITIES & DIRECT SERVICES: The contractor shall furnish each Veteran referred for care under this contract with the following standard services:

8.1 SOBER LIVING ENVIRONMENT ROOM & BOARD: Room and Board shall be accessible to the Veteran 7 days a week and 24 hours per day. Accommodations will include a bed and linens (towels and bed sheets), as well as other furnishings such as a dresser or other means of secure storage. At least three nutritious meals, 7 days a week will be provided for Veterans. Suitable alternative meal options must be made available to reasonably accommodate those with special, medically required dietary restrictions. In addition, nutritious snacks of nourishing quality (e.g. fruits), should be available between meals and before bedtime for those requiring or desiring additional food, when it is not medically contraindicated. There will not be more than a 14 hour span between evening meal and breakfast of the following day. Food shall be prepared, served and stored under sanitary conditions. The facility may provide storage space in an onsite refrigerator for Veterans to store personal food. The facility shall establish and maintain sanitary procedures for washing dishes, cleaning equipment and work areas, and disposing of waste.

8.2 LAUNDRY: Laundry facilities or service must be available at no cost for residents to tend to their laundry needs.

8.3 Care Planning: The program will engage the veteran in a collaborative assessment of needs, including barriers to recovery goals, and create an initial written care plan to begin addressing those concerns within 72 hours of program admission. Special attention will be taken to address Veterans flagged for High Risk Safety issues (HRS). Care plans for Veterans identified during the admission eligibility authorization review with HRS concerns should be completed in collaboration with VA Staff.

8.3.1 Case Management: Individual case management and/or professional counseling efforts are expected to flow from the initial written care plan. At a minimum, Veterans are expected to engage in individual case management/counseling meetings three or more times per month. Case management and/or counseling are expected to be substantive work focusing on the needs identified during the initial assessment and care planning process. Progress notes documenting case management/counseling activities should demonstrate, at a minimum, consistent focus on substance use disorders, and engagement in physical and mental health care services. Other areas of focus may include self-care, adaptive coping strategies, financial/budget planning, and employment preparation if indicated.

8.3.2 Recovery: The program environment should be conducive to positive social interaction and the fullest development of the Veteran’s rehabilitative potential. Foster mutually supportive and recovery-oriented relationships between residents/staff through peer-based interactions, house meetings and/or other social activities. Provide non-clinical recovery support services. Encourage residents to attend mutually supportive, self-help groups and/or outside professional services (i.e. services at VA, 12-Step, etc.).

8.3.3 Medication Management: Medications and narcotics shall be properly stored, controlled, issued and recorded in compliance with physician orders. Contractor shall submit their plan to ensure safe and effective management of medications within the facility as an element of their proposal in response to this solicitation.

8.3.4 Group Activities/House Meetings: Structured group activities and or regular house meetings should be available to Veterans admitted. At a minimum, Veterans should plan to attend two or more such activities per week. Examples of appropriate group activities include: peer support group, life skills discussions, Alcoholics Anonymous, and Narcotics Anonymous.

8.4 Discharge Planning: Developing an effective after-care plan and promoting of ongoing recovery efforts will be the discharge goal for every Veteran. The program is expected to assist with the formulation of an initial discharge plan within five days of admission. The plan should clearly identify objectives and tasks, including dates for completion of each, and should be updated on an ongoing basis throughout the episode of care to accurately reflect progress. The final discharge plan should specifically list what services (through VA or other agencies) the Veteran will engage in upon leaving the contracted program.

8.5 VA Coordination: The Contractor is expected to collaborate regularly with the identified VA Mental Health Treatment Coordinator (MHTC) and other VA providers as necessary to ensure proper coordination of care, services, and resources for the benefit of individual Veterans, and the program in general.

8.6 Transportation: The Contractor shall support the Veterans with finding solutions for their local transportation needs (e.g. to scheduled meetings, appointments, etc.) At a minimum, the Contractor will be expected to transport Veterans to scheduled Intensive Outpatient Program (IOP) appointments at the VA and help the Veteran by providing information and instructions necessary to enable Veterans to utilize public transportation as needed. If VA or contractor staff determines that adequate public transportation is not available or appropriate for a Veteran, the Contractor shall engage Veteran in problem solving effort to identify and utilize alternative methods of transportation.

9.0 ADMINISTRATIVE FUNCTION & PROCEDURES

9.1 COMMUNICATIONS: Contractor is expected to have a reliable, working phone line for VA inquiries. Messages left for the program by VA Staff are expected to be returned as soon as possible during normal business hours Monday through Friday. This includes calls from VA proper or the Liaison to the program. Written correspondence, such as eligibility authorizations, extension requests, incident reports, and discharge reports shall be promptly delivered as denoted in their respective sections below.

9.2 ADMISSIONS: It is understood that the type of Veterans to be cared for under this contract will require services over and above the level of room and board. To be eligible for placement in SLE contract beds, all Veterans must be assessed and referred by VANCHCS ARTS staff and be eligible and registered for VA services.

The initial SLE referral period for a Veteran is typically 45 days, depending upon the needs of the Veteran as mutually determined by the Veteran, the Contractor’s staff, and VA MHTC and ARTS Program Director or Designee. An extension of the initial referral period, up to no greater than 90 days, may be authorized by the VA ARTS Program Director or Designee provided that there is clear clinical indication using ASAM criteria and available funds.

All service periods must be authorized in Veterans electronic medical record by Program Director or Designee and communicated to the COR via additional signer for tracking purposes.

The VA is responsible for determining eligibility of Veterans prior to admission to Contractor bed for services. A Release of Information (ROI) should be obtained from the Veteran and written authorization from VA Staff is required (hard copy, or fax are acceptable) and shall be provided to the Contractor for each Veteran referred for services under the contract. If there is an urgent need to admit a Veteran and VA Staff are not available to provide a written approval in a timely manner, verbal authorization will be acceptable, provided written evidence of authorization is obtained at the next feasible juncture. No admissions at VA expense can occur without written/verbal approval. For the Contractor to receive payment for any services provided, the admission must be coordinated by VA staff (i.e. Veterans may not by-pass referral from VA providers and self-refer). Written documentation of eligibility verification, signed by an authorized VA Staff, shall be obtained by the Contractor as soon as possible for each Veteran referred for services under the contract for inclusion in the Veterans program file. Compliance with the procedures described above will be monitored regularly as denoted in the QASP.

A list of VA Staff authorized to approve admissions under the contract shall be provided to the Contractor upon award of the contract. VA Staff may be added or deleted from the list during the term of the contract at the discretion of VA. The Contractor shall be provided an updated list of authorized VA Staff whenever such changes are made.

It is understood that payment for services provided beyond the initial authorized service period may not be authorized, unless an extension is approved in writing by the VA.

9.3 DOCUMENTATION: An individual case record will be created for each referred Veteran. Case records must be maintained in security and confidence. The C&A requirements do not apply, and a Security Accreditation Package is not required.

Individual case records shall include:

9.3.1 Reasons for referral.

9.3.2 All essential identifying data relevant to the resident and his/her family

9.3.2.1 including a socio-cultural assessment, weekly progress reports or notes, and

9.3.2.2 Documentation of any case management interventions or patient care conferences.

9.3.3 Copies of any medical prescriptions issued by physicians, including orders,

9.3.3.1 If any, for medications to be taken.

9.3.4 Case management notes including Care Plan with attendant goals and

9.3.4.1 documented activity indicating Veteran and Case Manager are actively working on

9.3.4.2 identified goals, including formulation of plans for sustained recovery efforts

9.3.4.3 And discharge.

9.3.5 Final summaries on each resident who leaves the program, to include reasons for leaving, the resident’s future plans, and follow-up locator information.

9.3.6 Extension approval(s) if applicable.

9.4 ABSENCES AND CANCELLATION: The contractor shall notify the VA of any unauthorized absence of a Veteran admitted to the Contractor’s facility. Should a Veteran absent himself/herself from the Contractor’s facility in an unauthorized manner, payment for services for that Veteran may only be continued for a maximum period of 24 hours if the bed is held, provided there is an active outreach attempt on the part of the Contractor’s staff to return the Veteran to the facility and there is a reasonable belief that the Veteran will return. If there is no reason to believe the Veteran will return, or 24 hours have passed with no further contact from the Veteran, that Veteran should be discharged from the program. Absences of any Veteran from the facility in excess of 24 hours will not be reimbursable. Authorized, or “excused” absences shall be permitted, at the discretion of the Contractor, for a period of up to 14 days if necessary, however, it is understood that no further payment will be authorized beyond the initial 24 hours of such an absence.

9.5 CRITICAL INCIDENT REPORTING & EMERGENCY RESPONSE: The contractor shall notify the VA immediately when any adverse critical incident involving a Veteran admitted to the program occurs. The identified VA Liaison (typically MHTC), ARTS Program Director or Designee, or COR should be contacted immediately by phone to report such an incident (M-F 8am to 4:30pm); if the incident occurs outside these hours, contact is made as soon as possible by telephone within those hours. A written report to the VA Liaison and/or COR should follow within 24 hours. Contractor shall maintain a copy of all critical incident reports in the involved Veteran’s record.

9.5.1 Falls, Slips or Trips (including on ice or snow)

9.5.2 Assault (to Veteran or Staff)

9.5.3 Elderly/Dependent Adult Abuse or Neglect

9.5.4 Sexual Assault

9.5.5 Fire (Veteran Involved)

9.5.6 Medical Emergency (911 Calls)

9.5.7 Hospitalization

9.5.8 Suicide or Suicide Attempt

9.5.9 Homicide

9.5.10 Death

9.5.11 Infection Control (Bed Bugs, TB exposure, etc.)

9.5.12 Use of any psychoactive substances

9.5.13 Observation/ Possession of Weapons

9.5.14 If Medications are Lost, Stolen or Mis-Used.

9.6 DISCHARGES: The Program is expected to assist with the formulation of an initial discharge plan within five days, that includes a housing plan if applicable, identified objectives and target dates for task completion(s), and for which progress shall be evaluated and documented on an ongoing basis for the duration of the veteran’s admission.

At the time of discharge, whether planned or unplanned, the program will follow the appropriate procedure for handling and documenting Veteran discharges. This includes: notifying the identified VA MHTC or designee within 24 business hours that a discharge has occurred. A written report of the discharge that contains follow up contact information for the veteran, a summary of goals completed/not completed, should be submitted to VA MHTC or designee within 48 business hours of discharge.

9.7 CONTRACTOR PERSONNEL: The contractor shall have sufficient personnel to carry out all of the policies, procedures, and duties required for service delivery and administrative oversight.

The Contractor must identify each person functioning as “Key Personnel” under this contract, and provide to the VA a description of the services to be provided by such person, together with a resume summarizing that person’s relevant skills, experience and where applicable, licensure or certification. Key personnel should be considered anyone in the service delivery line who will provide direct services to veterans, as well as the administrative staff charged with overseeing those services. This information should be submitted with any formal proposal packages in response to this solicitation. Additionally, back up personnel are to be identified for the case that key personnel cannot be reached.

The VA reserves the right to refuse or revoke acceptance of key personnel and request alternatives if personal or professional conduct, or lack of required skills or experience, jeopardizes patient care or interferes with the regular and ordinary operation of the facility.

Once work has begun under this contract, Contractor personnel shall be expected to treat referred Veterans with dignity and respect and abide by standards of conduct mirroring those prescribed by current federal personnel regulations.

Temporary substitutions of key personnel shall be permitted in accordance with the Contractor’s contingency plan. The Contractor’s contingency plan to be utilized if personnel leave Contractor’s employment or are unable to continue performance in accordance with the terms and conditions of the resulting contract should also be submitted as part of the proposal package in response to this solicitation.

10.0 FACILITY

10.1 GENERAL REQUIREMENTS: It is the responsibility of the Contractor to properly maintain its facilities and the VA shall have no responsibility for paying or reimbursing the Contractor for such expenses. The contract facility must:

10.1.1 Have a current occupancy permit issued by the local and state governments in the jurisdiction where the facility is located.

10.1.2 Be in compliance with existing standards of State safety codes and local, and/or State health and sanitation codes.

10.1.3 Meet the requirements of the Americans with Disabilities Act (ADA) pertaining to handicapped accessibility in effect on the date of contract award.

10.1.4 Be licensed under State or local authority.

10.1.5 Where applicable, be accredited by the State or other recognized accrediting body (Joint Commission, Commission on Accreditation of Rehabilitation Facilities (CARF)).

10.1.6 Be equipped with operational air conditioning /heating systems

10.1.7 Be kept clean free of dirt, grime, mold, or other hazardous substances and damaged noticeably detract from the overall appearance

10.1.8 Be equipped with first aid equipment and written disaster plan that is written in coordination with local emergency response unit.

10.1.9 Have an aggressive on-going plan to address bed bug infestation. This policy must be a part of your written response to this solicitation. On-going bed bug infestation will be grounds for immediate discharge of Veterans from the facility

10.2 The contractor facility must meet fire safety requirements, as follows:

10.2.1 The building must meet the requirements of the applicable residential occupancy chapters of the current version of NFPA 101, National Fire Protection Association's Life Safety Code. Any equivalencies or variances must be approved by VANCHCS Director

10.2.2 Fire exit drills must be held at least monthly. Residents must be instructed in evacuation procedures when the primary and/or secondary exits are blocked. A written fire plan for evacuation in the event of fire shall be developed and reviewed annually. The plan shall outline the duties, responsibilities and actions to be taken by the staff and residents in the event of a fire emergency. This plan shall be implemented during fire exit drills.

10.2.3 A written policy regarding tobacco smoking in the facility shall be established and enforced.

10.2.4 Portable fire extinguishers shall be installed at the facility. Use NFPA 10, Portable Fire Extinguishers, as guidance in selection and location requirements of extinguishers.

10.2.5 Requirements for fire protection equipment and systems shall be in accordance with NFPA 101. All fire protection systems and equipment, such as the fire alarm system, smoke detectors, and portable extinguishers, shall be inspected, tested and maintained in accordance with the applicable NFPA fire codes and the results documented.

10.3 INSPECTION: Prior to the award of any contract and annually thereafter during any subsequent contracted performance periods, a multidisciplinary VA team consisting of an ARTS Clinician, dietitian or nutrition and food service professional, VA Police, and a Safety and Occupational Health Specialist, as well as any other subject matter experts determined necessary by the medical center director, COR, ARTS Program Director, shall conduct a survey of the Contractor’s facilities to be used to provide Veterans food, shelter, and clinical services to assure the facility provides acceptable level quality care in a safe environment. Additional inspections may also be carried out, announced or unannounced at any other time as deemed necessary by VA.

The contractor will be advised of the findings of the inspection team. If deficiencies are noted during any inspection, the contractor will be given a reasonable amount of time to take corrective action and to notify the Contracting Officer that the corrections have been made. A contract will not be awarded until noted deficiencies have been eliminated. Failure by the Contractor to take corrective action within the reasonable time provided will be reported to the VA Contracting Officer. If corrections are not made to the satisfaction of the VA, the Contracting Officer will be notified and shall be the final arbiter on the necessary resulting consequences and action.

The inspection of the Contractor facilities will include inspection for conformity to the current Life Safety Code, and will also include the following:

10.3.1 General observation of residents to determine if they maintain an acceptable level of personal hygiene and grooming.

10.3.2 Assessment of whether the facility meets applicable fire, safety and sanitation standards.

10.3.3 Determining whether the facility is in attractive surroundings conducive to social interaction and the fullest development of the resident's rehabilitative potential.

10.3.4 Observation of facility operations to see if appropriate organized activity programs are available during waking hours (including evenings) and degree to which a high level of activity is observed in the facility, such as individual professional counseling, physical activities, assistance with health and personal hygiene.

10.3.5 Seeking evidence of facility-community interaction, demonstrated by the nature of scheduled activities or by information about resident flow out of the facility, e.g., community activities, volunteers, local consumer services, etc.

10.3.6 Observation of staff behavior and interaction with residents to determine if they convey an attitude of genuine concern and caring.

10.3.7 Inspecting the types of meals and other nutrition provided to residents to see if appetizing, nutritionally adequate meals are provided in a setting, which encourages social interaction and if nutritious snacks between meals and bedtime are available for those requiring or desiring additional food, when it is not medically contraindicated.

10.3.8 Making a spot check of Veterans’ records to ensure accuracy with respect to Veterans’ length of stay and services provided to the Veterans.

All Department of Veterans Affairs inspection findings for residential facilities furnishing treatment and rehabilitative services to eligible Veterans shall, to the extent necessary, be made available to all government agencies charged with the responsibility of licensing or otherwise regulating or inspecting such institutions.

11.0 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

The contractor shall provide the COR with a written report detailing program activities on a quarterly basis in accordance with the QASP. The report should contain, at minimum, the following information:

11.4 Total Number of Veterans Served

11.5 Discharge Outcomes (e.g. # or % of veterans discharged to VA follow-up care vs those not.)

11.6 Data from QASP Compliance Tool

11.7 Other pertinent information, such as: quality improvement projects, changes in staffing or business practices, systems or resource concerns, etc.

These reports, along with all other identified QASP performance standards, shall be reviewed with the Contractor quarterly by the COR, or designee, and maintained in the contract administrative file.

The Contractor is expected to prepare a separate, annual report, summarizing program data over the past year of performance, for submission to the VA Liaison at the time of the annual clinical inspection.

See attachment: QASP

SECURITY CLAUSES

1.

GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3.

VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

c. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

d. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

e. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

f. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

g. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

h. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

4.

SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the Contracting Officer’s Technical Representative (COTR) and simultaneously, the designated Information Security Officer (ISO) and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA Office of Inspector General (OIG) and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5.

LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information (SPI). If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) Date of occurrence;

(b) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (Made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

6.

TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

7.

SECURITY Requirements for Unclassified Information Technology Resources The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

8.

Security Accreditation Package The C&A requirements do not apply and a Security Accreditation Package is not required.

9.

Records Management Language

The following standard items relate to records generated in executing the contract and should be included in a typical Electronic Information Systems (EIS) procurement contract:

1. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

2. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

6. The Government Agency owns the rights to all data/records produced as part of this contract.

7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

8. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

10. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

(End of Performance Work Statement)