PWS Cancer REGISTRY.pdf

PERFORMANCE WORK STATEMENT

CANCER REGISTRY SERVICES

The VA Pittsburgh Healthcare System is in need for Cancer Registry Services. The government intends to award an IDV contract with up to five (5) 1-year ordering periods.

CANCER REGISTRY SERVICES

The Contractor shall provide Cancer Registry Services for the VA Pittsburgh Healthcare System (VAPHS) in strict accordance with the Statement of Work as well as all contract clauses.

The Contractor shall provide all necessary staffing and resources needed to properly maintain the VAPHS Cancer Registry database in accordance with 100% of the current American College of Surgeons Commission on Cancer Registry standards and Veterans Health Administration (VHA) Cancer Registry requirements. The Contractor shall have current experience managing an accredited Cancer Registry program within the last twelve months and have recent experience as a consultant with the American College of Surgeons (ACOS) Commission on Cancer (CoC). The duties and responsibilities of the Contractor may include:

A. Case finding – The Contractor shall electronically screen and accept all cases into the Cancer Registry database, shall flag all cases as “suspense” with demographics and ensure cases are primary site coded. The Contractor shall be responsible for monthly review of disease indices, pathology reports, radiology reports, treatment logs, and other computerized methods to identify reportable cancer cases. The Contractor shall be responsible for transcribing and interpreting information from patient records regarding treatment provided to an estimated 550-600 new cancer patients annually using the approved Veterans Administration (VA) abstracting software program (currently the VistA Oncotrax). The Contractor shall review and abstract the cancer patient’s medical record on an ongoing basis in compliance with the industry standards of the North American Association of Central Cancer Registries (NAACCR), National Cancer Institute Surveillance, Epidemiology and End Results Program (SEER), World Health Organization International Classification of Diseases for Oncology (ICDC), American Joint Commission on Cancer (AJCC) Staging Manual Criteria, VA Central Cancer Registry (VACCR) Reportable List, American College of Surgeons / Commission on Cancer (ACOS / CoC), and the VAPHS Cancer Registry. The contractor will be a VA experienced Certified Oncology Data Specialist (ODS-C) and produce proof of current credential status to provide abstracting services. The Contractor shall abstract cases within 4-6 months of the cancer diagnosis. Contractor may not add cases without direct approval from VHAPTH ODS Program.

B. Rejects – The Contractor will not delete cases in the database.

C. Case Abstracting and Coding – Abstracting is defined as coding and entering patient and disease specific information into the Veterans Administration Vista Cancer Registry database or other databases as identified within this statement of work. The Contractor shall utilize approved codes as indicated, i.e. ICD-O, ICD-9-CM, ICD-10-CM, etc. as appropriate. The Contractor shall abstract oncology cases with 100% accuracy and shall ensure that all Commission on Cancer requirements/standards are met. The Contractor shall ensure that all cases are cleared (within pre-established timeframes) in terms of passing all edits required by the VA Central Cancer Registry or by the American College of Surgeons Commission on Cancer, e.g. National Cancer Database edits, Vista Oncology package edits, Gen-edits Program edits, etc. Responsible to transcribe and interpret information from patient records regarding treatment provided to new cancer patients annually using the approved Veterans Administration (VA) abstracting software program (currently the Vista Oncotrax). The Contractor shall review and abstract the cancer patient’s medical record on an ongoing basis in compliance with the industry standards of the North American Association of Central Cancer Registries (NAACCR), National Cancer Institute Surveillance, Epidemiology and End Results Program (SEER), World Health Organization International Classification of Diseases for Oncology (ICDC), American Joint Commission on Cancer (AJCC) Staging Manual Criteria, VA Central Cancer Registry (VACCR) Reportable List, American College of Surgeons / Commission on Cancer (ACOS / CoC), and the Pennsylvania Cancer Registry (PCR).

The contractor will be a VA experienced Certified Oncology Data Specialist (ODS-C) and produce proof of current credential status, to provide abstracting services. The Contractor shall abstract cases within 4-6 months of the cancer diagnosis.

D. Follow-up – The Contractor (Certified Oncology Data Specialist) shall complete data entry to include all required Commission on Cancer Registry fields, including but not limited to text, recurrence, treatment and required death information fields. The Contractor shall be responsible for tracking the care all patients receive in the years following their cancer diagnosis at the VAPHS Medical Center, and at other health care institutions. A The Contractor shall provide the Cancer Registry function of Follow-up as described in the Standards of the American College of Surgeon’s Commission on Cancer (ACOS CoC) Standards for Oncology Registry Entry (STORE). These functions shall include computer input, data review and report generation tailored to the needs of the VA. The Contractor shall provide follow-up of living cancer patients in compliance with accepted industry standards, posting information on recurrence, subsequent therapy, date of last contact, vital status, cancer status, any comments supporting the findings.

The Contractor shall include outcome data when applicable. The Contractor shall maintain follow-up at a minimum of 90% on all patients through 5 years and 80% on all patients through 15 years. Cases are delinquent (lost) if the follow-up interval exceeds 15 months. The Contractor shall provide a list of patients completed follow-up along with the Contractor’s monthly invoice.

E. Consult Hours: The Contractor shall provide Consult Hours that shall include time spent working with Health Information Managers, the Cancer Committee and the Cancer Program/Hospital Administrator. Consult hours shall also include ensuring that all current ACOS and related Cancer Registry standards pertaining to the VAPHS Cancer Registry are met, that all data entered into the Cancer Registry is 100% accurate and that all pre-established timeframes related to the Cancer Registry are met. Consult hours shall also include producing reports, ensuring that the Cancer Registry Policy and Procedure Manual meets the Commission on Cancer Standards and is up to date, and assisting and advising all Cancer Program staff and related staff with Commission on

Cancer survey readiness and preparation. Consult hours shall also include preparation of data for transmission to the Central VA Office and any other entity as required by the VA or American College of Surgeons. The contractor will provide consultative services both by telephone and on site to assist in the Commission on Cancer approval process.

F. Rapid Cancer Reporting System (RCRS): The Contractor shall conform to all ACOS Commission on Cancer requirements relating to the Rapid Cancer Reporting System (RCRS) including timely accurate submissions; timely accurate resubmissions; correcting edits; and monitoring CoC flash newsletters to ensure compliance with all Cancer Registry and related deadlines, etc. Cancer Registry data submitted by the Contractor to the RCRS shall meet the established quality criteria 100% of the time, as outlined in the monthly submission to RCRS. Annually, cases submitted by the Contractor to Rapid Cancer Reporting System (RCRS) that were diagnosed on January 1, 2003, or later meet the established quality criteria and resubmission deadlines as specified in the monthly reporting to RCRS.

G. Staging Alerts – At the time of abstracting the Contractor shall send an email to VA

ODS-C identifying incomplete staging.

H. Communication - The Contractor will cc the Assistant Chief, Health Information Management on all email messages sent from the Contractor to VA staff.

I. Rapid Cancer Reporting System (RCRS)- The Contractor shall monitor the quality of the Cancer Registry data. The Contractor shall monitor the facility’s performance based on the CoC performance indicators, using the CoC reporting tools for the Rapid Cancer Reporting System (RCRS). The Contractor shall keep the medical center point of contact, Cancer Liaison Physician, the Chair of the Cancer Program and the Cancer Program Administrator advised of the performance status as requested by the above-mentioned staff and no less than once monthly. (RCRS is a real time data collection program to assess hospital-level performance using National Quality Forum (NQF) endorsed quality of cancer measures).

J. Quality Assurance Surveillance Plan (QASP) – The Contractor shall provide quality work, complete work, and accuracy as evidenced by meeting Commission on Cancer, National Cancer Data Base, Pennsylvania Cancer Registry, National Cancer Registrars Association (NCRA), and VA Central Cancer Registry standards and requirements. The Contractor shall perform a quality assurance review on 10% of the analytic case load for compliance noting any deficiencies or non-deficiencies. The Contractor shall forward a list to the medical center point of contact via e-mail Quarterly, noting any deficiencies or non-deficiencies.

The Contractor follows the attached Cancer Registry Quality Assurance Surveillance Plan/Program to evaluate the quality of 100% of their staff’s Cancer Registry data and 100% of their staff’s Cancer Registry activities done on behalf of the VAPHS.

Activities to be evaluated:

QASP activities

• Case finding

• Abstracting timeliness

• Accuracy of abstracted data

• Class of Case

• Primary Site

• Histology

• AJCC Stage

• First Course of Treatment

• Follow-up information, including Date of First Recurrence, Type of First Recurrence, and

Cancer Status

• The percentage of information coded as unknown (usually coded as 9 or a string of 9s)

• RCRS data submission, correction of data errors, and resubmission of corrected data.

• Required accuracy – 100%

• Cancer Registry data submitted to the RCRS meet the established quality criteria included in the annual NCDB

• All other standards as outlined in the most current edition of the ACOS Commission on

Cancer manual are met or exceeded.

The Contractor shall conduct monitoring at least once Quarterly and reported yearly to the medical center point of contact as stated in Standard 6.1 and the Contractor shall send their Quality Assurance Surveillance Plan (QASP) report findings to the medical center point of contact and Cancer Program Administrator at a minimum, quarterly. The report findings should also include the Contractor’s process for conducting monthly random case finding audits and include a sample of the audit findings to demonstrate that all eligible analytical cases are reviewed and processed. The Contractor shall send report findings back to the medical center point of contact and Cancer Program Administrator monthly and/or upon request. In addition, the reported findings shall include monthly abstracting quality control audit checks on 100% of cases abstracted by the Contractor’s staff to ensure abstracts are 100% edit (error) free prior to invoicing. The reported findings shall reflect the Contractor’s process for error corrections for all tasks performed by the Contractor’s staff and all tasks as required by the American College of Surgeons-Commission on Cancer for full accreditation; all errors identified either by the Contractor or by the medical center point of contact or by the facility’s Certified Oncology Data Specialist (ODS-C) or any representative of the VAPHS within one working day. The Contractor shall monitor each area of Cancer Registry activity and shall ensure all duties performed e.g. case finding, accessioning, follow up, edit corrections, data submissions, abstracting, etc. (i.e. all Cancer Registry tasks required by the American College of Surgeons- Commission on Cancer) are performed by a Certified Oncology Data Specialist (ODS-C). The Contractor shall provide written reports upon request and at least once monthly to the medical center point of contact and Cancer Program Administrator and take corrective action on any areas that fall below the measures specified in the QASP.

Cancer Registry Standards

A. 100% of cases are abstracted within 4 - 6 months of the patient’s first contact with the program.

B. 80% follow-up rate is maintained on all patients from the Cancer Registry reference date.

Within 15 years

C. 90% follow-up rate is maintained on all patients diagnosed within the last 5 years.

D. Data is submitted to the VA, Cancer Committee and to the VA Central Cancer Registry upon request prior to or within deadlines.

E. Data re-submitted, e.g. to the NCDB and to all other requestors, e.g. VA Central Cancer

Registry on cases diagnosed on or after the Cancer Registry reference date meet the quality criteria and resubmission deadline specified in the VA Central Registry.

F. Monthly reviews are conducted of the quality of Cancer Registry abstracting through 100% of the annual analytic caseload. The plan shall also identify the activities to be evaluated and shall set the benchmarks for required accuracy to meet all ACOS cancer program standards; and shall include the review of all pathology/radiology/Computerized Patient record System (CPRS) and Vista Imaging reports.

G. Education/Certified Oncology Data Specialist (ODS-C): The contractor shall show proof that those providing abstracting services are Certified Oncology Data Specialist (ODS-C) through the National Cancer Registrars Association. Contractor personnel functioning under this contract shall be certified by the National Cancer Registrars Association. The Contractor shall verify its personnel’s current certification status with the National Cancer Registrars Association and shall provide evidence of certification with their proposal submission. Ongoing cancer-related education enhances knowledge and skills. All Contractor Cancer Registry staff who perform case abstracting must:

H. Hold a current Certified Oncology Data Specialist (ODS-C) credential. The Certified

Oncology Data Specialist (ODS-C) credential is granted through the National Cancer Registrars Association, which provides details on eligibility, testing, and recredentialing.

High-quality Cancer Registry data are essential to accurately access treatment outcomes and patient survival. Successful operation of the Cancer Registry requires credentialed staff that is trained and knowledgeable in all aspects of oncology data collection and case abstracting. Abstracting is defined as coding and entering patient- and disease specific information into the Cancer Registry database. Certified Oncology Data Specialist (ODS- C) apply knowledge obtained from formal education and work experience to correctly interpret and code cancer diagnosis, stage, treatment, and outcomes information for each case that is seen at the VA Pittsburgh Healthcare System CoC accredited program that meets CoC reporting requirements.

I. The case abstracting responsibilities of the Certified Oncology Data Specialist (ODS-C) are documented by the Contractor.

J. In addition, the Contractor shall provide documentation upon request and annually that all members of their Cancer Registry staff shall participate in one cancer-related educational activity other than cancer conferences. Certified Oncology Data Specialist (ODS-C) Contractor staff participate in at least one cancer related educational activity other than cancer conferences at the local, state or national level; this education could include topics in the following areas: Advances in cancer diagnosis and treatment, changes in cancer program standards and changes in data collection requirements. Each year, all Contractor staff that work on this contract shall participate in 1 cancer-related educational activity other than cancer conferences; all members of the Contractor’s Cancer Registry staff shall participate in ongoing cancer-related education at the local, state, regional, or national level. All Contractor Certified Oncology Data Specialist shall maintain NCRA Credential and shall participate in a cancer related educational activity each year.

Per the Commission on Cancer Standards, Full-time and part-time registry staff for whom annual education is required are:

• Certified Oncology Data Specialist (ODS-C) staff

• Contract Certified Oncology Data Specialist (ODS-C) staff who are contracted to work for 3 or more consecutive months during the calendar year, regardless of the number of hours worked

• Management or supervisory personnel

This education could include topics in the following areas:

• Advances in cancer diagnosis and treatment

• Changes in cancer program standards

• Changes in data collection requirements

Educational activities that can be used to fulfill the standard include, but are not limited to, the following:

• A cancer-related lecture offered by the program (local activity)

• A face-to-face meeting or workshop

• Local—involves 1 program or facilities located in 1 city (local activity)

• State—involves 1 state (state activity)

• Regional—involves more than one state organization working collaboratively to develop the workshop. Agendas and meeting notices indicate collaborative effort (regional activity)

• National—is sponsored by a national organization and targeted to a national audience (national meeting)

• A video conference (local activity)

• A webinar (local activity)

• A Web-based training module (local activity)

• Journal-based articles that offer continuing education credits (local activity)

• Educational activities exclude patient management cancer conferences in any format.

National organizations that sponsor national meetings include:

• American Health Information Management Association (cancer-related educational activities)

• Association of Community Cancer Centers

• Commission on Cancer

• National Cancer Registrars Association

• National Comprehensive Cancer Network

• North American Association of Central Cancer Registries

Policy and Procedure manual - The Contractor shall maintain current Cancer Registry policies and procedures in compliance with CoC, NCDB, PCR and VACCR standards, and submit them to the medical center point of contact at the VAPHS annually (or upon request) for review. The Contractor’s Cancer Registry policy and procedure manual must be specific to the VAPHS and specify that current CoC data definitions and coding instructions are used to describe all reportable cases. The Contractor shall use the data standards defined by the CoC appropriate for the year of diagnosis for any specific case. The Contractor’s Cancer registrars shall be required to comply with additional mandates pertaining to case and data reporting as established by the Veterans Administration, federal or state government or by the VAPHS’s cancer committee.

The Cancer Registry policy and procedure manual includes:

• Abstracting

• Joint Committee on Cancer (AJCC) and Collaborative Stage staging policies

• Cancer Registry reference date

• Case eligibility

• Case finding

• Case accessions

• Confidentiality and release of information

• Computer operations

• Dates of implementation or changes in policies for registry operations

• Disaster recovery policy

• Documentation of first course of treatment

• Follow-up

• History of the registry for the program or health system (which may include facility mergers, network formation, facility name changes, vendor information, and identification of previous staff)

• Job descriptions

• Maintaining and using the suspense system

• NCDB reporting requirements and mechanisms

• Operational requirements for facility-based cancer registries

• Policy for CoC SAR documentation

• Quality control of registry data

• Registry purpose

• Request log

• Required coding manuals

• Retention of documents

• State registry reporting requirements and mechanisms

For the Policy and Procedure Cancer Registry manual, the Contractor provides a table of contents in accordance to Commission on Cancer standards.

A. Outcome Studies / Special Studies: The Contractor shall provide Cancer Registry data for outcome studies / special studies and assisting with preparation of the reports. The Contractor shall provide outcome studies / special studies for the medical staff, Cancer Committee, Cancer Conference / Tumor Board, Veterans Administration Central Cancer Registry (VACCR), and quality management upon request. The Contractor shall compare the data to the national data to determine effectiveness of treatment, programs and survival. The contractor shall also provide patient care evaluation studies for the annual cancer program report.

B. Corrections: The Contractor shall correct any mistakes in the registry cases made by them. This includes any data corrections as a result of edit error reports received from the NCDB, PCR or VACCR or records rejected because they lack supporting English text and/or have missing data elements. The Contractor shall correct all inconsistencies found through any quality assurance review within 1 month (or sooner if it impacts adversely on accreditation of the cancer program) of submission of inconsistencies, errors, warnings, or any other data quality problems.

C. Other: The Contractor shall ensure all American College of Surgeons Commission on

Cancer Registry standards, requirements and initiatives are implemented and met; this includes ensuring all Rapid Cancer Reporting System (RCRS) requirements are met and includes developing a Cancer Registry policy and procedure manual which meets the current Commission on Cancer Standards. If abstract are inadvertently re-opened after being in the completed status (e.g. when Vista Oncotrax patches are put in for example) , the Contractor shall maintain thorough documentation as to the reason the case reopened on 100% of the cases entered into by the Contractor, shall resolve the issue within one working day and shall re-close the case and send the documentation to the medical center point of contact or designee (monthly with the monthly invoice (this documentation may be reviewed by the ACOS Surveyor during the accreditation process). The Contractor may be asked to speak directly to an ACOS Cancer Program Surveyor; if requested, the Contractor shall speak with the ACOS Surveyor. The Contractor shall be responsible for preparing Cancer Registry reports for the Cancer Committee which meets 4-6 times a year. The Contractor shall prepare reports on TNM staging, timeliness of abstracting, follow-up, and quality improvement of the Cancer Registry services. The Contractor shall bear all the costs of reports prepared for Cancer Committee meetings.

D. ACoS / Commission on Cancer Approval: The Contractor shall be responsible for coordinating the Cancer Registry portion of the Commission on Cancer / American College of Surgeons surveys in collaboration with the medical center point of contact, facility Certified Oncology Data Specialist (ODS-C) and facility Cancer Program Administrator and/or Physician Cancer Liaison; for assisting with preparation of the survey; and updating the Survey Application Record in collaboration with the assigned VAPHS representative. The Contractor shall ensure that VAPHS meets the standards of the American College of Surgeons Commission on Cancer Registry standards. The Contractor and the Cancer Program Administrator share responsibility for the survey by the ACoS. The Contractor shall also provide phone consultation about Cancer Registry issues to the VAPHS upon request during normal working hours, Mondays through Fridays, 8:00am -4:30pm. Eastern Standard Time.

E. Reporting Cancer Data / Transmission of Data: The Contractor shall be responsible for transmitting required submissions / resubmissions to the VA Center Cancer Registry (VACCR), National Cancer Data Base (NCDB), within prescribed timeframes; shall requests/maintain the required software for the transmissions; shall submit complete and accurate reports, and make corrections, as required. The Contractor shall demonstrate knowledge of the VACCR, NCDB, reporting requirements, complete required privacy reports and submit them to the privacy officer in collaboration with the VA Pittsburgh Healthcare System Cancer Registry contact.

F. Data User Agreement with Veterans Administration and the State of Pennsylvania:

The Contractor shall ensure a current Data User Agreement, or any other paperwork required by VA/VHA policy is in force with the State of Pennsylvania prior to submitting or transmitting requested data.

G. Continuing Education / Competency: The Contractor shall show proof of attendance at recent continuing education activities including state Cancer Registry trainings and Cancer Registry association education meetings. The Contractor shall maintain competency/training folders and make them available as requested. The Contractor and Contractor staff shall have a working knowledge of VA abstracting software programs and computer hardware. If the medical center point of contact has a concern about competency, the Contractor staff may be requested to take the NCRA Cancer Registrar Employment Screening at the contractor’s cost (see:

http://www.creducationcenter.org/html/cancer_registrar_employment_ab.html) to evaluate competency, or the medical center point of contact may request a VA Certified Oncology Data Specialist (ODS-C) review a specified number of abstracts to evaluate competency and ensure required elements are being completed. If the National VA Central Cancer Registrar documents continued uncorrected errors and quality problems from the Contractor, this shall be considered adequate documentation to terminate the contract due to quality concerns.

H. VA-Specific / Privacy Training - The contractor will complete the VHA Privacy Policy Training and Cyber Security training, and any other mandated training, at their own cost before access is given, at no cost to the government.

I. Computerized Patient Record System (CPRS) in VISTA. VA will provide contractor with electronic access to CPRS for use by the Certified Oncology Data Specialist (ODS- C). Contractor employees are responsible to access the system a minimum of once every ninety (90) days. Failure to access VA system at least once every ninety (90) days will result in the contractor’s employees being locked out of the VA system. If necessary, VA will provide Contractor with remote access to the Computerized Patient Record System (CPRS) in VISTA. It is expected that electronic access will be done monthly.

Contractor’s abstracting personnel may perform the abstracting functions from remote locations by computer modem and shall comply with the VA standard of case completion of four to six (6) months after date of diagnosis. A list of cases completed shall be provided to the medical center point of contact along with monthly invoices. Abstracting http://www.creducationcenter.org/html/cancer_registrar_employment_ab.html shall encompass the full and complete data set (required, optional and supplemental fields) to present a complete patient summary in the VistA Oncotrax package. Text field shall be utilized to document finds on Physical Exam, Scans, Scopes, Labs, Diagnostic OPS and Pathology. Collaborative Stage and AJCC TNM staging shall be performed on all cases meeting the criteria as established by SEER and the American Joint commission on Cancer, latest Manual for the Staging of Cancer, in conjunction with accepted principles. All required abstract fields must be completed with 100% accuracy.

CONTRACTORS RESPONSIBILITIES

Contractor will be responsible for completing and providing all Background Investigation documentation, Information Security, Rules of Behavior, Privacy Training, and completing the VAPHS VPN request for computer access as it pertains to the to all designated VA personnel.

NATIONAL HOLIDAYS

The 11 holidays observed by the federal Government, i.e., New Year’s Day, Martin Luther King’s Birthday, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving, and Christmas and any other specifically declared by the President of the United States to be a federal holiday.

INFORMATION MANAGEMENT

Documentation and record keeping shall be in accordance with the VAMC policies and procedures. All timeframes required by VAPHS policies and procedures for documentation and authentication in the electronic medical record shall be adhered to. Strict adherence to all documentation related to the performance of invasive procedures shall be maintained.

CONFLICT OF INTERST

The Contracting Officer Technical Representative and/or Contracting Officer will monitor in accordance with VHA Handbook 1660.3, that no individuals involved in the selection or contracting process are, or have ever been involved, or perceived to being involved, with a potential conflict of interest. If a selection panel is convened, the individual(s) on the panel will need to complete a conflict of interest agreement document that will be kept with the finalized contract.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

All contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access. If the investigation is not completed prior to the start date of the contract, the contractor will be responsible for the actions of those individuals they provide to perform work for VA, until the time such investigation is completed, and VA has accepted the proposed individual.

Position Sensitivity – The position sensitivity has been designated as: Moderate Risk.

Background Investigation – The level of background investigation commensurate with the required level of access is National Agency Check with Written Inquiries.

Contractor Responsibilities-The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM), the contractor shall reimburse VA within 30 days of receipt of VA Bill of Collection.

The contractor shall prescreen all personnel requiring access to the computer systems to ensure they are a U.S. citizen or maintain an appropriate visa and are able to read, write, speak and understand the English language.

The contractor shall submit or have their employees submit the following required forms to the VA Office of Security and Law Enforcement within 30 days of receipt:

Standard Form 85P, Questionnaire for Public Trust Positions Standard Form 85P-S, Supplemental Questionnaire for Selected Positions FD 258, U.S. Department of Justice Fingerprint Applicant Chart VA Form 0710, Authority for Release of Information Form Optional Form 306, Declaration for Federal Employment Optional Form 612, Optional Application for Federal Employment

The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract.

Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

Procedures for Background Security Investigations:

The Contracting Officer will obtain a list of employees proposed to work under the contract from the Contractor. This list must include the following information:

Individuals’ Name

SSN #

DOB, and Contractor’s address (versus individual’s address to facilitate receipt of paperwork)

Fingerprint charts are the responsibility of the contractor and must be done locally. Completed fingerprint charts and the list of names must be provided to the contracting officer, who will forward to Office of Security and Law Enforcement (OSLE).

Records Management Language for Contracts

RECORDS MANAGEMENT OBLIGATIONS

A. Applicability

This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes [Agency] records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their

[Agency] contract.

4. may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. [Agency] and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of [Agency] or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to [Agency]. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to [Agency] control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and [Agency] guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with [Agency] policy.

8. The Contractor shall not create or maintain any records containing any non-public [Agency] information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The [Agency] owns the rights to all data and records produced as part of this contract.

All deliverables under the contract are the property of the U.S. Government for which [Agency] shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227- 20.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take [Agency]-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

D. Flowdown of requirements to subcontractors

1. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

A Business Associated Agreement (BAA) will be needed with vendor once contract is awarded.

Vendor must work with VAPHS Privacy Officer to execute BAA once awarded.

Contractor must also sign VA 6500.6 appendix D Contractor Rules of Behavior to be considered for award.

VA INFORMATION AND INFORMATION SYSTEM SECURITY AND PRIVACY

LANGUAGE FOR INCLUSION IN CONTRACTS

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT)resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements.

The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO

(ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the abovementioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA

CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP.

Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204- 71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information…