Product Description Wayfinding Patient Engagement Expansion (Phase 2) RFI PD.docx

Patient Engagement Expansion for VA Salem Campus TAC Number: VA-22-00032695

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration Salem VA Medical Center (VAMC)

Patient Engagement Expansion (Phase 2) for VA Salem Campus

Date: 3/3/2022

VA-22-00032695

PD Version Number: 3.0

Contents

PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Salem VA Medical Center (VAMC) requires an expansion of their existing patient engagement system to additional buildings within the Salem VAMC campus. Phase 1 of the patient engagement system is currently in progress and includes installing the patient engagement system in the following primary buildings of the Salem VAMC so that Veterans can utilize the system to navigate to appointments: building 143 (five floors), building 2 (basement and first floor), building 2a (basement and first floor), building 5 basement, building 12 basement, and building 4 (basement [Canteen]). The existing patient engagement system utilizes the Virtual Bluetooth Low Energy (vBLE) cloud and includes Juniper/Mist networking access points used to locate and guide patients throughout the medical facility, the Optical Local Area Network uses Tellabs equipment to connect all of the access points and Medrics/Inpixion wayfinding uses app/mapping software to locate and guide patients using the optical networks and access points. The wayfinding patient engagement system must also be capable of tracking devices that violate configured policies and ban them from the network. For ongoing management of the system, a reporting portal shall track system usage and advanced analytics tools. Once the wayfinding app is enabled, the facility can proactively geo-fence welcome message boards as well as give patients the ability to find their way through the hospital with wayfinding technology. This will give patients an all-in-one portal or hub to interact with when either outside or inside the VA hospital. This will allow patients to interact via a very robust mapping and app platform.

The Contractor shall provide all labor, material, and equipment to install hardware, software, configure and test this patient engagement system. The Contractor shall utilize this Product Description as well as As-Built drawings, electrical plans and documents and possible site visits as a basis for preparing a quote. The Contractor shall complete Phase 2 of the patient engagement system that shall include areas of building numbers 7, 8, 9, 10, 11, 12, 75, 76, 77 and 168 and 144 (Chapel), and remainder of building 2 (second and third floor), building 4 (first floor), building 5 (first floor/auditorium). The system is expected to go live within 9 months/270 days after the conference meeting with the awardee (pending completion of phase 1 and testing). The period of performance shall be 12 months from completion of project, with four (4) 12-month option periods.

CERTIFICATIONS AND PERFORMANCE

A. The Contractor shall be a certified partner and/or authorized distributor (and shall provide proof) for installation and key programming of all hardware and software being installed.

B. The Contractor shall be able to provide ongoing technical support of all installed hardware and software.

C. The Contractor shall provide proof of prior operational situations they have performed in this arena (Wayfinding, Wi-Fi, Networking, vBLE technology).

D. The Contractor shall supply information to Salem VA Hospital Police for background checks of daily “on-site” personnel. Only VA Personal Identity Verification (PIV) badged personnel shall be allowed “unescorted” access to the facility. The Contractor shall have at least two installation personnel capable of being VA PIV badged.

TECHNICAL REQUIREMENTS

The Contractor shall expand the turn-key Optical Local Area Network distributed access system that must use vBLE technology for patient wayfinding and shall be designed to be a fully air gapped network from the existing information technology (IT) wireless. The Contractor shall be required to add additional fiber in areas where fiber is not currently available. Coverage shall be throughout the Salem VAMC campus in all main medical buildings (buildings listed in section 1.0, except for building 4 second floor and building 5 second floor), delivering pervasive coverage for engagement.

A. The scope of this requirement includes all necessary hardware, software, installation and configuration, testing, training, sustainment, support, and warranty required for patient wayfinding services throughout the Salem VAMC main campus. This shall also include the cost of a dedicated external internet connection with suitable bandwidth for a facility of the Salem VAMC campus’ size.

B. The Contractor must provide new hardware and licenses to be a complete, fully functional patient engagement system.

C. The Contractor shall provide a one-day, virtual training for the core super users. The Contractor shall deliver Recordings of the Training and provide access to all training materials in the document library.

D. Utilizing the patient wayfinding platform, and as part of this patient engagement system, the patients shall be able to scan their appointment cards so they can find their way through the hospital (in Real Time Blue Dot location) as they move from one appointment to the next.

E. The system shall provide the ability to push notifications to the patients through the application so VA can inform them of potential flu / COVID vaccinations going on and direct them if necessary, to those locations.

F. The system shall provide the ability to track devices that violate configured policies and ban them from the network.

G. For ongoing management of the system, a reporting portal shall track system usage and provide advanced analytics tools.

H. The system shall provide the ability to geo-fence welcome message boards as well as give patients the ability to find their way through the hospital with wayfinding technology.

I. Wi-Fi Requirements

1. Access points must be capable of Wi-Fi 802.11ax Wave 2 4x4:4.

2. Access points must support integrated 802.11ac Wave 2 sensor radio for security, network and location scanning.

3. Access points must be available in internal and external antenna version.

4. Access points must be available in indoor and outdoor (IP67 rated) version.

5. Indoor access points must support an Internet of Things expansion port.

6. Indoor access points must support Power over Ethernet (PoE)-out functionality to any PoE device capable of operating in 6W or less (e.g. BT11 vBLE only access point).

7. Access points must support integrated vBLE 16-element antenna array.

8. Access points must support Dynamic Packet Capture for user experience monitoring and troubleshooting.

9. Access points must support on-demand or manual packet capture for troubleshooting.

10. Access points shall support Radio Resource Management (RRM) using both instantaneous data as well as 24-hour data collected from the site.

11. The Wi-Fi infrastructure shall support creating Personal Wireless Local Area Network (PWLAN) with security segmentation leveraging one common Single Set Identifier (SSID).

12. The Wi-Fi infrastructure shall have the option of leveraging or is Virtual Network Assistant (VNA) ready. VNA is a Natural Language Processing (NLP) artificial intelligence-driven assistant that troubleshoots network issues, provides rich insights into network operations and utilization.

J. vBLE requirements

1. Converged Wi-Fi/vBLE or vBLE only access points shall be configurable and manageable through a management portal interface.

2. The system shall support beaconing in Apple iBeacon, Google Eddystone and AltBeacon advertising format in order to be able to be used on a wide variety of patient devices.

3. Accuracy of vBLE based location/engagement is expected to be within 1-3 meters with sub-second latency.

4. The system shall automatically adapt to different devices and Radio Frequency (RF) environments.

K. The Contractor shall determine the proper network topology and appropriate amount of hardware and cable to provide the required coverage. This is to include all wiring for access points, switches, routers, and other equipment deemed necessary by the Contractor.

L. The Contractor shall protect all finished spaces and surfaces at no additional cost to the Salem VAMC. The Contractor shall be financially responsible for repairing any damage or noted deficiencies to finished spaces and surfaces that occur as a result of the Contractors (or sub-contractors) installation.

M. The Contractor shall be responsible for cable management, labeling of all network cables, cables, ports, etc. associated with the guest Wi-Fi and Wayfinding installation.

N. Existing cable trays, raceways, or j-hooks shall be used where available for cable distribution. For locations where cable trays are not available, cabling shall be fastened with appropriate fasteners to ensure a secure and neat installation. Where cable penetrates fire and smoke walls that do not have existing cable trays, proper fire sleeves shall be installed in accordance with National Fire Protection Association code NFPA-101 Life Safety Code using approved fire stop material to seal all penetrations. The only fire stop product approved by the facility is Hilti brand.

O. The locations of the patient wayfinding vBLE access points shall be detailed by the Contactor and listed in Computer-Aided Design (CAD) Drawings. The CAD Drawings shall include locations of all major network hardware components including but not limited to servers, switches, and server rack locations. The Contractor or Sub-contractor shall run all required CAT-6 or above-ceiling cabling from the access point locations to the nearest networking closet. No run shall exceed the 100M data limit. At the offeror’s request, the Salem VAMC will, to the best of its ability, supply additional documentation which could assist the offeror with a better design concept.

P. The system shall be compliant with IEEE 802.11ac standards and offer access to a wide range of patient and visitor owned devices. User devices include laptop computer systems with a variety of operating systems (i.e., Windows, Apple, Linux, etc.), as well as smart phones and tablet computers.

Q. All systems, equipment, peripherals, and components shall meet the standards delineated by applicable laws and regulations, such as Section 508 Amendment to the Rehabilitation Act of 1973 and others. In recognition and support of the “Electronic and Information Accessibility Standards” defined by Section 508 of the Rehabilitation Act, the offeror should include published accessibility self-assessments of proposed products using Voluntary Product Accessibility Templates (VPAT) and/or Government Product Accessibility Templates (GPAT) when available.

R. The Contractor shall submit a quote based on predictive survey using known vBLE technology recommendations for pervasive building coverage and detailed building plans and public Wi-Fi network infrastructure provided with this Product Description. This shall include the analysis of building floor plans and inspection of the facility.

S. The Contractor shall perform the RF test during the site visit for interference and identify optimum installation locations for access points and installation of cable runs.

T. The Contractor shall provide (separate line item) optional costing for four (4)-years of optional licensing fees, internet connection fees, applications fees and service coverage.

Deliverables:

A. Recordings of the Training B. Computer-Aided Design Drawings

PROJECT MANAGEMENT AND DEPLOYMENT PLANNING SERVICES

INSTALLATION REQUIREMENTS AND HOURS

A. The Contracting Officer’s Representative (COR), Technical Experts, and Contractor shall review the installation and operation of Phase 1 to assure the work is satisfactory before turning over the project to the operations and maintenance phase and signing a VA letter of acceptance prior to starting Phase 2.

B. The Contractor shall facilitate a design kick-off meeting with the key stakeholders, including project manager and key clinical staff, to review the design process.

C. After completion of the project (Phase 2), the COR, technical experts, and Contractor shall review the installation and operation of the system to assure the work is satisfactory before turning over the project to the operations and maintenance phase and signing a VA letter of acceptance.

POST INSTALLATION REQUIREMENTS

A. Maintenance and technical support services shall be provided for the base year and option years on an as needed basis. The Contractor must provide technical support 24x7x365, with a maximum response time of 4 hours. When required, the Contractor must provide on-site support within 24 hours.

B. The Contractor shall provide a warranty on the entire patient engagement system. The warranty period shall begin after the project has been accepted as complete by the Salem VAMC. Acceptance will not be given until training has been completed.

C. Base year services shall start after the project has been accepted as complete by the Salem VAMC. The option years will then be dated accordingly based on the base year start.

D. Post Installation Inspection will be conducted in two parts. After equipment has been installed in a given area, a verification of proper installation will be completed. This verification will include equipment and wire labeling, patch panel labeling, and wire pathways. During this inspection, the Salem VAMC inspector/s will ensure fire and smoke ratings are intact and meet code. A final post installation inspection will include functional verification of all aspects of the project. Inspections will be conducted by one or all of the following: COR, Biomedical Engineering, Safety, and any other affected Engineering Staff.

E. The Contractor shall provide (in PDF format) Heat Maps and Floor Maps showing the infrastructure layers of installed access points and kiosk locations.

Deliverables:

A. Heat Maps B. Floor Maps

SUPPORT AND MAINTENANCE

Following Contractor initial installation and configuration, the Contractor shall provide maintenance and technical support on the patient engagement system at each location to include 24x7x365 technical support, bug fixes, data fixes and enhancements, assistance with configuration setup, troubleshooting, communication of product changes and availability, and reporting and status of maintenance tickets and potential system issues. The Contractor shall address and assist with issues encountered by the PharmD’s, Infection Control Practitioners, Infectious Disease, and other facility end users with Alerts, Views and troubleshooting issues encountered with these or other functions of the system.

The Contractor shall also provide support involving the system’s infrastructure requirements to include hardware, bandwidth, and best practices accordingly and coordinate with the COR, Office of Information and Technology (OIT), and VA staff as necessary to resolve any issues.

The Contractor shall also facilitate monthly conference calls with each site to ensure optimal performance of the system.

OPTION PERIOD ONE

If exercised by VA, the Contractor shall provide licensing, internet connection, applications and service coverage, warranty, and support and maintenance for the patient engagement system as described in section 1.0 and its subtasks.

OPTION PERIOD TWO

If exercised by VA, the Contractor shall provide licensing, internet connection, applications and service coverage, warranty, and support and maintenance for the patient engagement system as described in section 1.0 and its subtasks.

OPTION PERIOD THREE

If exercised by VA, the Contractor shall provide licensing, internet connection, applications and service coverage, warranty, and support and maintenance for the patient engagement system as described in section 1.0 and its subtasks.

OPTION PERIOD FOUR

If exercised by VA, the Contractor shall provide licensing, internet connection, applications and service coverage, warranty, and support and maintenance for the patient engagement system as described in section 1.0 and its subtasks.

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

The Contractor shall ensure that information technology products are procured and/or services are performed with products that meet and/or exceed ENERGY STAR, FEMP designated, low standby power, and EPEAT guidelines. The Contractor shall provide/use products that earn the ENERGY STAR label and meet the ENERGY STAR specifications for energy efficiency. Specifically, the Contractor shall:

1. Provide/use ENERGY STAR products, as specified at www.energystar.gov/products (contains complete product specifications and updated lists of qualifying products).

1. Provide/use the purchasing specifications listed for FEMP designated products at https://www4.eere.energy.gov/femp/requirements/laws_and_requirements/energy_star_and_femp_designated_products_procurement_requirements . The Contractor shall use the low standby power products specified at http://energy.gov/eere/femp/low-standby-power-products.

1. Provide/use EPEAT registered products as specified at www.epeat.net. At a minimum, the Contractor shall acquire EPEAT® Bronze registered products. EPEAT registered products are required to meet the technical specifications of ENERGY STAR but are not automatically on the ENERGY STAR qualified product lists. The Contractor shall ensure that applicable products are on both the EPEAT Registry and ENERGY STAR Qualified Product Lists.

1. The Contractor shall use these products to the maximum extent possible without jeopardizing the intended end use or detracting from the overall quality delivered to the end user.

The following is a list of information technology products for which ENERGY STAR, FEMP designated, low standby power, and EPEAT registered products are available:

1. Computer Desktops, Laptops, Notebooks, Displays, Monitors, Integrated Desktop Computers, Workstation Desktops, Thin Clients, Disk Drives

1. Imaging Equipment (Printers, Copiers, Multi-Function Devices, Scanners, Fax Machines, Digital Duplicators, Mailing Machines)

1. Televisions, Multimedia Projectors

This list is continually evolving, and as a result is not all-inclusive.

SHIPMENT OF SOFTWARE

All software licenses shall be shipped to the points of contact (POCs) below:

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary

Alternate

SPECIAL SHIPPING INSTRUCTIONS

Prior to shipping, Contractor shall notify Site POCs, by phone followed by email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of Site POC.

All shipments, either single or multiple container deliveries, shall bear the VA IFCAP Purchase Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA IFCAP PO number shall indicate total number of containers for the complete shipment (e.g. “Package 1 of 2”), clearly readable on manifests and external shipping labels.

Packing Slips/Labels and Lists shall also include the following:

IFCAP PO #: ____TBD________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier I Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

SHIPMENT OF HARDWARE OR EQUIPMENT

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary

Alternate

GENERAL REQUIREMENTS

RECORDS MANAGEMENT

The Contractor shall comply with the following Records Management requirements:

1. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

2. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

6. The Government Agency owns the rights to all data/records produced as part of this contract.

7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

8. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

10. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

POINTS OF CONTACT

VA Program Manager:

Contracting Officer’s Representative:

Name:

Address:

Voice:

Email:

Contracting Officer:

Name: Kendra M. Casebolt Address: Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

Contract Specialist:

23 Christopher Way Eatontown, NJ 07724

6.0 INFORMATION SECURITY CONSIDERATIONS

The assessment and authorization (A&A) requirements do not apply and a Security Accreditation Package is not required.

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.

a. A prohibition on unauthorized disclosure: “Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA.” This clause expressly limits the Contractor/Subcontractor’s rights to use data as described in Rights in Data – General, FAR 52.227-14(d).(1).

b. A requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access, the Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO, and Privacy Officer for the contract. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a.

c. A requirement to pay liquidated damages in the event of a data breach: “In the event of a data breach or privacy incident involving SPI the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.” However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1) Notification;

2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3) Data breach analysis;

4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs

d. A requirement for annual security/privacy awareness training: “Before being granted access to VA information or information systems, all Contractor employees and Subcontractor employees requiring such access shall complete on an annual basis either: (i) the VA security/privacy awareness training (contains VA security/privacy requirements) within 1 week of the initiation of the contract, or (ii) security awareness training provided or arranged by the contractor that conforms to VA’s security/privacy requirements as delineated in the hard copy of the VA security awareness training provided to the Contractor. If the Contractor provides their own training that conforms to VA’s requirements, they will provide the COR or CO, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in VA’s contract have received their annual security/privacy training that meets VA’s requirements and the total number of employees trained. See VA Handbook 6500.6, Appendix C, paragraph 9.

e. A requirement to sign VA’s Rules of Behavior: “Before being granted access to VA information or information systems, all Contractor employees and Subcontractor employees requiring such access shall sign on annual basis an acknowledgement that they have read, understand, and agree to abide by VA’s Contractor Rules of Behavior which is attached to this contract.” See VA Handbook 6500.6, Appendix C, paragraph 9, and Appendix D. Note: If a medical device vendor anticipates that the services under the contract will be performed by 10 or more individuals, the Contractor Rules of Behavior may be signed by the vendor’s designated representative. The contract must reflect by signing the Rules of Behavior on behalf of the vendor that the designated representative agrees to ensure that all such individuals review and understand the Contractor Rules of Behavior when accessing VA’s information and information systems.

image1.jpeg