Performance Work Statement - Water Analysis Services.docx

PERFORMANCE WORK STATEMENT

WATER ANALYSIS SERVICES

I. INTRODUCTION

A. The mission of the Robley Rex Veterans Affairs Medical Center at 800 Zorn Avenue, Louisville, KY, is to provide the highest quality health care to our nation’s veterans. To accomplish this mission, we must protect the health and safety of patients, employees, and visitors. To accomplish this mission, the Robley Rex Veterans Affairs Medical Center at 800 Zorn Avenue, Louisville, KY, (VAMC) maintains a comprehensive water safety management program (WMP) including routine sampling of PW for each building in which patients, visitors and/or staff lodges over-night, chiller plant cooling water, and Sterile Processing Water including Critical Water in accordance with VA Directives and AAMI ST108 for engineering validation of program components. To ensure compliance with these requirements, all samplers must undergo recurring training and maintain certification on file with the VAMC. Furthermore, lab certification as required by directives must be maintained on file with the VAMC.

C. Mandatory Qualifications

1. In accordance with Directive 1061 Appendix C, paragraph 2.b and the EPA, the labs MUST be certified.

(a) Laboratories that process water samples for microbiological testing must:

(1) Be accredited by a recognized regional, national or international accrediting body as follows:

a. In accordance with a laboratory accreditation standard (e.g., ISO/IEC 17025: 2017, General Requirements for the Competence of Testing and Calibration Laboratories). Examples of such accrediting bodies include the National Environmental Laboratory Accreditation Program (NELAP); the American Association for Laboratory Accreditation (A2LA); and the Environmental Microbiology Laboratory Accreditation Program (EMLAP).

b. Include Legionella testing method(s) that will be used on facility water samples in the laboratory’s scope of accreditation, as documented on the laboratory’s accreditation certificate.

(2) Demonstrate proficiency by the Centers for Disease Control and Prevention (CDC) Environmental Legionella Isolation Techniques Evaluation (ELITE) program or the Public Health England (PHE) Legionella External Quality Assessment (EQA) scheme at performing the culture of Legionella from environmental samples. Information about the CDC ELITE program and a listing of laboratories that are ELITE members can be found at https://wwwn.cdc.gov/elite/public/elitehome.aspx. The laboratory also must demonstrate proficiency at PCR detection of Legionella from environmental samples by the CDC-recognized lab conducting proficiency testing (currently the Wisconsin State Laboratory of Hygiene (WSLH)) or by the PHE EQA Legionella molecular scheme. NOTE: The method(s) used by the laboratory on the samples that the VA medical facility uses to determine Legionella positivity is to be the same method(s) used by the laboratory for proficiency testing.

(3) Be able to determine if the Legionella detected by culture in environmental samples is the species of Legionella pneumophila and, if so, if it is L. pneumophila serogroup 1.

(4) Accredited and deemed to be proficient in detecting Legionella in water samples by Polymerase Chain Reaction (PCR). A copy of this shall be provided to the COR.

(5) This accreditation must be provided to the VAMC with the proposal in response to the solicitation and annually thereafter upon award.

(b) If there is a possibility that the VA medical facility will use molecular typing to characterize environmental Legionella isolates (e.g., for potential comparison to clinical Legionella isolates during a case investigation), then the VA medical facility must plan with the testing laboratory for storage of the environmental isolate(s) at least temporarily.

2. The contractor’s personnel competencies must be evaluated before the start of work, on a change of personnel, and on an annual basis after award. Competencies must assess knowledge and understanding of both Legionella and associated health risks and water systems associated with sterile processing, demonstrate sampling techniques for various testing methods for hot and cold-water systems, record keeping, proper maintenance, disinfection, and cleaning of water systems.

(a) A copy of the competency evaluation each employee performing must be provided to the VAMC Contracting Officer and Representative. Under no circumstance shall a Sampler be assigned who has not been deemed competent.

(b) A sample competency evaluation shall be provided with the bidder’s proposal in response to the solicitation.

D. General Requirements

1. The Contractor shall ensure that services provided to the Government comply with all applicable Federal, State and local laws, statutes, regulations, and guidelines. The Contractor shall also ensure that all services provided to the Government comply with all VA- and VHA- mandated policies, procedures, standards, and requirements.

2. The Contractor has an ongoing obligation throughout the Period of Performance to timely notify the Contracting Officer immediately, in writing, upon its loss (or any of its subcontractors) of any required certification, accreditation, or licensure.

3. All employees of the service provider shall comply with VA security management program.

4. The Contracted laboratory testing shall be certified, and shall maintain all licenses, permits, accreditation and certifications required by law AAMI and VHA Directive, throughout the entire Period of Performance.

5. The Contracted Lab will respond to basic inquiries and clarifications of sample results within 24 hours of inquiry from the COR. This does not include extensive consulting engagements, or in-depth discussions with committees such as water safety committee.

6. Should a sample leak, become damaged or get lost in transit to the laboratory, the Contractor will, at no cost to the Government, conduct a resample and submit for analysis.

7. Contracted Lab will notify VA COR within 24 hours of a positive Legionella culture via Email.

8. A copy of the field data will be provided to the Station Representative at the time of sample collection.

9. No photography of VA premises is allowed without written permission of the contracting officer.

10. Workers are subject to rules of Medical Center applicable to their conduct. Execute work in such a manner as to interfere as little as possible with work being done by others.

11. Parking for Contractor and its employees shall be in designated areas only. Service provider to coordinate with Contracting Officer’s Representative. Parking shall be first-come first-serve. Loading dock access is only through coordination with Warehouse Supervisor and only for loading or unloading supplies.

12. Per VA Directive 1085, smoking, vaping and smokeless tobacco are prohibited on the grounds of VA facilities, including in vehicles. This Directive applies to the contractor and their employees and subcontractors.

III. SCOPE OF WORK for this Blanket Purchase Agreement (BPA)

A. QUARTERLY POTABLE WATER LEGIONELLA VALIDATION TESTING (SAMPLING)

1. The contractor will provide all labor, materials, and equipment necessary to complete environmental Validation Testing of the potable water.

2. Legionella environmental testing shall occur at a minimum of once per Federal fiscal year quarter within the first month of the quarter. The laboratory will provide a report indicating the analytical results for each sample submitted. Results will be calculated in terms of colony forming units (CFU/mL). All samples shall be properly preserved, and protocol records kept for final QA/QC. Results shall be provided within 10-14 days of sample receipt emailed in PDF format to the client point of contact.

3. The contractor shall collect water samples for testing from at least:

a. Eight (8) Hot-water distillate outlets,

b. Two (2) Hot-water pure locations; no mixing valve present,

c. Eight (8) Cold-water distillate outlets, and

d. Two (2) from an ice machine or other pure cold-water source with no mixing valve present.

For a total of 20 samples per quarter and 80 samples per year per building listed in appendix A. Total anticipated to be 160 sample points per year plus any emergent tests.

4. Additional samples within the routine quarterly sample group may be required as determined by the COR for an additional per sample charge. Submit the additional per-sample charge in the bid proposal. A minimum of two weeks advance notification shall be provided if additional samples are required to be included with routine quarterly samples.

5. At the time of sampling, the contractor shall test and document the following for each sample: water temperature, level of residual biocide, and pH. The laboratory shall use:

a. Legionella 11731 ISO spread plate method for Legionella pneumophila and non-pneumophila species:

(1) Measures L. pneumophila serogroup 1, L. pneumophila serogroup 2-15, and non-pneumophila species.

(2) Inoculated at the laboratory – overnight shipment recommended.

(3) Limit of Detection (CFU/ml) = 1

(4) Reports: 10 days after laboratory receives samples.

6. Emergent Retests

a. Additional emergent retest samples may be required following corrective action for a positive routine quarterly sample. This shall be collected with 48 hours. Submit the additional emergency per-sample charge in the bid proposal.

b. Due to the critical nature following the initial culture method a rapid response is essential. For retest sampling the laboratory shall use a multi-reaction (multiplex) real-time PCR (rtPCR) for the detection of Legionella pneumophila sg 1, Legionella pneumophila sg 2-15, and non-pneumophila species, Dipslide culture method, and a standard Legionella 11731 ISO spread plate method.

(1) rtPCR results are expected 1-2 days after sampling.

(2) Dip Slide method shall report results within 2-5 days for Legionella detection.

(3) Legionella 11731 ISO spread plate method shall meet the requirements of paragraph B.5.a above.

B. AIR CONDITIONING COOLING TOWER LEGIONELLA VALIDATION TESTING

1. Quarterly Samples. Sample the Chiller Plant System for Legionella by culture methodology within seven (7) days of startup notification by VAMC, and each quarter during periods when the cooling tower is operational or operational-ready at sample points identified in Appendix B. Startup sample may count as one quarterly sample. Quarterly samples may be coordinated with building samples in section III.A.

a. Results shall be provided within 10-14 days of sample receipt emailed in PDF format to the client point of contact.

2. Bi-Week Tests. Conduct HPC testing from a water sample taken from the cooling tower system sumps at least every two weeks that the unit is operational in accordance with VHA DIRECTIVE 1061(4). VA USRO shall collect the specimen using contractor supplied containers and express (2-day shipping) mail to lab for analysis using contractor supplied sample containers and pre-paid packaging.

a. Results shall be provided within 2-5 days of sample receipt emailed in PDF format to the client point of contact.

C. STERILE PROCESSING WATER TESTING

1. Conduct monthly critical water sampling at the generating point and points of use in accordance with ANSI/AAMI ST108:2023, Water for the processing of medical devices, tables 5 and 6.

2. Perform quarterly analysis of utility water at the generating point and points of use in accordance with ANSI/AAMI ST108:2023, Water for the processing of medical devices, tables 5 and 6. This may be done in conjunction with a monthly critical water sample.

3. Monthly Critical Water and Quarterly Utility Water points of use listed in Appendix C for approximately 140 samples per year.

4. Emergent Retesting as required. The contractor shall provide proposed pricing for point of use retesting as needed based on results of routine critical water samples.

5. Results shall be provided within 5 days of sample receipt emailed in PDF format to the client point of contact.

D. BID LINE ITEMS – To be priced individually.

1. Base Bid – Routine and Emergent water sampling per the PWS for buildings listed in Appendix A, Chiller Plant points listed in Appendix B, and SPS points listed in Appendix C.

Points of Generation and points of use.

b. Hours of Work. Services shall be provided during normal business hours: 0800 – 1630, Monday – Friday. Excluding all government holidays

c. Site visit will be coordinated with the Contracting Officer Representative.

2. Ordering Periods, Total Two (2)

Offeror shall submit pricing for two additional Ordering Periods in the Base Bid Format above.

Points of Generation and points of use (includes 12 retests)

at first point of use, steam, and Medivators.

Points of Generation and points of use

at first point of use, steam, and Medivators.

Appendix A

Inpatient/Lodging Buildings (Main Bid Item)

Table A.1. Louisville, Zorn Campus Buildings

475,198

14,428

Sample points selected by VA are randomized with focus in patient care areas for points defined in paragraph III.A.3.

Appendix B

Table B.1. Zorn Campus Chiller Plant System Legionella Sample Points

Appendix C

Table C.1. Sterile Processing Sample Points of Use Zorn Campus

* Medivators are considered under utility water ** Loop in, Loop out.

*** Two locations: SPS Basement and 5th Floor.

M = Monthly Critical Water Q = Quarterly Utility Water

Table C.2. Frequency for water quality monitoring at water generation system.

NOTE 1. The recommendations for frequency of testing in this table are the recommended minimum frequency. If problems or issues arise with the water quality, it may be necessary to increase the frequency until they are resolved.

NOTE 2. When using these tests, the user should carefully follow the manufacturer’s written IFU for accurate results. When measuring Critical Water levels, the water sample must be filled to the brim for these test kits, sealed and, if the sample is hot, allowed to cool to room temperature before testing. Testing within 15 minutes of sample collection prevents carbon dioxide absorption that can result in an inaccurate pH.

Table C.3. Frequency for water quality monitoring at point-of-water-use.

NOTE 1 The recommendations for frequency of testing in this table are the recommended minimum frequency. If problems or issues arise with the water quality, it may be necessary to increase the frequency until they are resolved.

NOTE 2 Test type needed to measure Critical Water and Steam levels. Steam condensate must be filled to the brim, sealed, and allowed to cool before testing to prevent carbon dioxide absorption.

NOTE 3 Steam Sample by drawn by VA.

Appendix D. Past Performance Worksheet

1. Name of Contracting Activity, Government Agency, Commercial Firm or other Organization:

2. Contracting Activity Address:

10. Place of Performance:

11. Description of Work (Use a continuation sheet if necessary):

B. Instructions to bidders: Read the PWS thoroughly. Award shall be made to the best value, as determined to be the most beneficial to the Government. Failure to provide the requested information detailed within the PWS shall be considered non-compliant and your quote could be removed from the evaluation process.

1. Offeror quotes shall be evaluated under FAR Part 13.106-2(b) -- Evaluation of Quotations or Offers. Therefore, the Government is not obligated to determine a competitive range, conduct discussions with all contractors, solicit final revised quotes, and use other techniques associated with FAR Part 15. The contracting techniques associated with FAR Part 15 are not mandatory.

(1) Offeror shall complete the Price Schedule as shown in this PWS, with offerors proposed contract line-item prices inserted in appropriate spaces. It is understood that a line item contains all efforts necessary to complete that item including travel, mail, testing, etc.

(2) Ensure your representations and certifications are complete in the System for Award Management (SAM)(https://www.sam.gov). Otherwise, you will need to fill out solicitation Clause 52.212-3 "Offeror Representation and Certifications -Commercial Items” and submit with the quote. Federal Acquisition Regulations require that federal contractors register in the SAM database at http://www.sam.gov and enter all mandatory information into the system. Award cannot be made until the contractor has registered. Offerors are encouraged to ensure that they are registered in SAM prior to submitting their quotation.

b. Past Performance:

(1) Provide one (1) but not more than three (3) references of work, similar in scope and size with the requirement detailed in the SOW. References must include contact information; brief description of the work completed, and contract # (if relevant). Please utilize– Past Performance Worksheet for your references and please submit as part of your quote submission. References may be checked by the Contracting Officer to ensure your company can perform the full scope of the PWS. The Government also reserves the right to obtain information for use in the evaluation of past performance from any, and all sources.

c. Technical: The offeror’s quote shall be evaluated to determine if the organization has the experience and capabilities to provide the requested services IAW the PWS in a timely efficient manner.

(1) Contractor shall demonstrate their corporate experience and approach to meet all requirements stated in the PWS.

(2) Contractor shall demonstrate that their technicians meet the qualification standards stated in the PWS.

(3) If you are planning to sub-contract some of this work, please provide the name and address(s) of all subcontractor(s) (if applicable) and a description of their planned subcontracting effort. Include certifications where applicable.

II. REFERENCES

A. The Water Safety Management Plan is based upon the principles and requirements specified within this Performance Work Statement as well as the VA requirements and national standards, regulations, and policies listed below:

1. VHA Directive 1061(4) as amended October 21, 2024. https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=9181

2. ASHRAE Guideline 12-2023, Managing the Risk of Legionellosis Associated with Building Water Systems. https://www.ashrae.org/technical-resources/standards-and-guidelines/read-only-versions-of-ashrae-standards.

3. OSHA Safety and Health Topics: Legionellosis (Legionnaires' Disease and Pontiac Fever) https://www.osha.gov/SLTC/legionnairesdisease/index.html

4. Safe Drinking Water Act (SDWA) http://water.epa.gov/lawsregs/rulesregs/sdwa/index.cfm

5. Department of Veterans Affairs Engineering Standard ES-2019-001 Cooling Tower Water Systems. https://imlive.s3.amazonaws.com/Federal%20Government/ID293504132959832944226088339409599925869/Standard%20Document%20ES-2019-001%20Cooling%20Tower%20Water%20Systems%2012-02-21.pdf

6. ANSI/AAMI ST108:2023, Water for the processing of medical devices.

7. ASHRAE 188-2021, Legionellosis: Risk Management for Building Water Systems (ANSI Approved).

8. Department of Veterans Affairs GD-1061-3.0 Routine Environmental Sampling of Building Potable Water Systems for Legionella and Other Parameters in Water in Accordance with VHA Directive 1061. https://vaww.hefp.va.gov/sites/default/files/files/2021-04/Guidance%20Document_Routine%20Legionella%20Testing%20for%20Buildings_April%202021.pdf

9. The C&A requirements do not apply, and a Security Accreditation Package is not required.

B. Definitions

1. Utility Water. Water that comes from the tap that may require further treatment.

2. Critical Water. Water that is extensively treated to ensure micro-organisms, inorganic, and organic materials are removed.

3. Steam. water that is heated via a boiler or steam generator until it changes from liquid phase to vapor phase. Steam can be fed from a central location within the hospital such as a boiler plant or created via a steam generator within a sterilizer.

4. Point of Use. Refers to the closest point in the distribution loop where the water is exposed to a medical device during processing or the distal fixture in a potable water loop.

5. Potable Water Analyzer (PWA). Refers to continuous monitoring analyzers connected to the potable water system.

6. Conductivity Analyzer (CA). Refers to the continuous monitoring analyzers connected to Sterile Processing System (SPS) Critical Water systems.

7. Potable Water (PW). Water that has been treated and delivered in a manner so that it meets EPA guidelines intended for direct or indirect human consumption. This is often referred to as City Water and serves as the source of utility water.

8. Total Heterotrophic Aerobic Bacteria (THAB). For this PWS, the term is interchangeable with Heterotrophic Plate Count (HPC), Standard Plate Count (SPC), Aerobic Plate Count (APC), and Total Plate Count (TPC). This is the microbiological testing method used to estimate the total count of aerobic heterotrophic bacteria in water. HPC method does not indicate the specific heterotrophic bacteria present or their sources. Instead, HPC testing indicates the culturable organisms present.

9. Schematic Diagram. A schematic diagram is a picture that represents the components of a process, device, or other object using abstract, often standardized symbols and lines. Schematic diagrams only depict the significant components of a system, though some details in the diagram may also be exaggerated or introduced to facilitate the understanding of the system and aid in troubleshooting. This is more detailed than a block diagram that provides an overview of a system.

VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language. a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA.The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language. a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following: (1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language. a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following: (1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach involving any VA sensitive personal information the contractor/subcontractor processes or maintains under the contract; the contractor shall pay liquidated damages to the VA as set forth in clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs.