PWS Telepath Service.docx

CONTINUATION PAGE 36C10GXXXXXXX Page 2 of 2

B.2 PERFOMANCE WORK STATEMENT

A. GENERAL INFORMATION

A.1. Title of Project:

National Digital Telepathology Service Maintenance Agreement

A.2. Background:

The Department of Veteran Affairs, Pathology and Laboratory Medicine (PLM) program office in collaboration with the VA National Precision Oncology Program (NPOP), supported by a Congressional appropriation of funding targeted to deliver the highest quality and the most medically advanced diagnosis and treatment available to veterans with cancer, developed a telepathology program to implement digital telepathology. To support this effort VA awarded a series of contracts across the enterprise for equipment purchase of Contractor proprietary digital telepathology scanners, Image Scanning Management (IMS) software and physical services for image storage. This equipment configuration has been cleared by the FDA for clinical patient use and due to this clearance status and highly technical proprietary aspect of the equipment service of the equipment must be performed by manufacture employees. The VA procured equipment provides the infrastructure requirements and the access to testing needed to deliver appropriate training and education, a second opinion consult service, a virtual molecular tumor board for clinician case-based learning and ongoing professional practice evaluation.

The effort of digital technology strongly ties clinical care and research together in the broader VA precision oncology initiative where there are continuous learning opportunities for clinicians, researchers and patients and shared decision making with an ultimate goal of providing the highest quality oncology care to Veterans.

A.3. Objectives:

The equipment that is at each VA location to be services includes specialized proprietary aspects for the equipment and software for the digital pathology equipment utilized by VHA laboratories, and remote diagnostic services, preventative maintenance, and corrective maintenance are required. The subject equipment includes hardware (scanner instrumentation), operating software, servers (physical or virtual), and peripheral parts required to operate the overall telepathology system such as monitors, barcode slide labeler and scanner table (if provided by manufacturer).

All services shall be in accordance with manufacturer’s instructions as necessary or required to keep equipment in optimal working condition and as needed to maintain FDA Clearance/Approvals.

Services under this contract include, at a minimum:

B. SCOPE

The Contractor shall provide all necessary qualified personnel, equipment, supplies, facilities, transportation, travel, tools, materials, supervision, and other items and non-personal services necessary to successfully perform the services as defined in this Performance Work Statement (PWS) except for those items specified as Government furnished property and services. No Government employee shall be used for or perform any portion of the services. Task Orders shall be placed during the current period of performance to indicate services required to be rendered.

The Government shall neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. It shall be the sole responsibility of the Contractor to manage its employees and to guard against any actions in the PWS that are of the nature of personal services or give the perception of personal services.

The Contractor shall provide digital telepathology tier of service selected by individual laboratories as listed in an appropriate Task Order. Work may be assigned at any VA medical center that has Phillips Healthcare manufactured digital pathology equipment. Currently 45 VA medical centers across the United States (may include all 50 states, territories and/or Puerto Rico) have equipment eligible for coverage, but additional locations may obtain equipment in the future. Some locations are still covered under manufacture warranty or alternate contract activity, this contract shall not duplicate services provided under alternative contract activity.

Additionally, the Contractor shall work with the VA to maintain enterprise level access to the VA environment through an active Memorandum of Understanding Interconnection Security Agreement (MOU-ISA), Business Associate Agreement (BAA) and maintaining Contractor employee PIV access requirements as outlined in section 3.3.

B.2. Contract Information

B.2.1. Period of Performance:

The period of performance shall be a twelve (12) month base period and four (4) twelve (12) month option periods. A continuation of performance of any services may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months beyond option period four.

B.2.2. Type of Contract:

The Government will award a single Blanket Purchase Agreement. Task Orders (TOs) will be placed during the period of performance for required service maintenance agreements for specified equipment coverage.

B.2.3. Place of Performance:

Work completed under this PWS shall take place at the VA facility, the Contractor’s facility or by virtual modality depending on task requirement.

B.2.4. Recognized Holidays:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday. The other six holidays are set by a day of the week and month:

B.2.5. Hours of Operation:

The Contractor is responsible for conducting services as outlined in service tier as outlines in the Task Order for the time zone of the individual VA facility requiring service. Any overtime and/or holiday pay that may be entitled to the Contractor's employees shall be the sole responsibility of the Contractor and shall not be billed to nor reimbursed by the Government.

B.2.6. Business Day:

For purposes of communication with and submission of deliverables to the COR, an administrative business day is 8:00am EST to 3:00 pm EST, Monday to Friday not including recognized holidays and weekends.

B.3. Contract Terms & Conditions These supplemental terms and conditions have the full force and effect of any other terms and conditions contained in the solicitation and the resulting contract.

B.3.1. Contracting Officer Representative (COR):

The COR(s) will be identified by separate letter. The COR(s) monitors technical aspects of the contract and assists in contract administration, PIV management and deliverable checks for quality monitoring.

A letter of designation issued to the COR(s), a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR(s), especially regarding changes in cost or price, or in estimates or changes in delivery dates. The COR(s) is not authorized to change the terms and conditions of the resulting contract.

B.3.2. Contractor Travel:

All travel has been imbedded in one or several Contract Line Item Number(s) (CLIN) and is therefore not separately priced or reimbursable via a cost reimbursable CLIN. No Additional travel expenditures are authorized on this contract.

B.3.7. Type of Orders Not all Contract Line Items Number(s) (CLIN) are required to be ordered on any given Task Order. CLINs will be identified on every order and the quantity being ordered. For the minimum and maximum order limitations, reference Section X: Contract Clauses:

52.216-18 ORDERING

52.216-19 ORDER LIMITATIONS

Tasks performed shall be of a non-personal nature. VA organizations will not provide supervision of Contractor personnel. Contractor personnel shall at no time allow an employer-employee relationship to develop with VA organizations or their staff. VA organizations will refrain from any activities that create the appearance of such a relationship.

Contractors shall not perform inherently governmental functions including: decision-making, supervision of Government employees, supervision of other Contractors on other contracts, and activities that create the appearance of performing such functions.

C.2 Activity 1: Meetings Meetings shall be conducted upon award and as needed throughout the performance period to allow for updates and dialogue on aspects, issues, and concerns related to the performance of the Contractor. These meetings shall be coordinated and scheduled depending on necessity.

Desired Outcome / Objective:

Meetings may pertain and include these aspects, but not limited and designed to: introduce Government and Contractor team members including roles and responsibilities, update contact information of all parties, complete a full review of the PWS along with associated timeframes and deadlines, discuss responsibilities, authorities, discuss plans for clear lines of communication between the Government and the Contractor, identify any potential successes, conflicts or issues in performance, and provide clear understanding of quality assurance measures of all requirements of the Contractor.

C.2.1. Task 1: Kick-Off Meeting The Kick-off meeting between the Program Office, Contracting, and the Contractor shall be scheduled within 10 business days after Notice to Proceed is issued to the Contractor. This meeting will take place virtually utilizing Microsoft TEAMS. This shall be part of the base contract first TO requirement. Contracting shall coordinate the date, time, location (in person or virtual) of the meeting. The Contractor shall attend meeting with the appropriate staff attendee list (with email addresses), which shall be provided to Contracting at least five business days prior to the meeting.

Deliverable #1: Kick-Off Meeting Attendance

C.3 Activity 2: Service Maintenance Agreement Contractor shall ensure all equipment is in optimal working condition throughout the contract period of performance by performing preventive maintenance, upgrades, remote support, corrective maintenance and supplying replacement parts. Support includes both remote and, when a problem cannot be resolved remotely, on-site support. It is the responsibility of the Contractor to bring appropriate equipment, parts and/or supplies necessary to complete the work as required. Any equipment calibrations and other analyses required following service/repairs/PMs shall be performed by the Contractor service engineer.

Personnel performing maintenance and repair services must be fully qualified and trained to perform work on the specific equipment in accordance with the original manufacturer's procedures. "Fully qualified" is defined as factory-trained or equivalent and experienced to work on the equipment assigned.

Desired Outcome / Objective:

Working equipment is required to utilize the advanced technology of pathology digital telepathology to meet VA strategic goals. Equipment downtimes interrupt daily operations and impacts Veteran care negatively. Goal is to have minimal telepathology equipment downtime that would impact availability for optimal patient care.

C.3.1 Task 2: Maintenance C.3.1.1: Preventative maintenance The Contractor shall perform any required scheduled (preventive) maintenance in accordance with manufacturer's recommendations as frequently as published in manufacturer’s operator’s manual and within a timely manner with regard to the scheduled due date to ensure compliance with accrediting agency requirements.

· Quarterly/every quarter = every 3 months (90 days), plus or minus 10 days.

· Every 6 months = 6 months (180 days) from the last event, plus or minus 20 days

· Annually/every 12 months/once a year/every year = 1 year from the last event, plus or minus 30 days.

Preventive maintenance shall be scheduled with the POC at the site requiring the maintenance as listed on the applicable Task Order.

C.3.1.2 Corrective Maintenance/Repair Services A technical assistance center shall be available with a maximum response time of four hours.

The Contractor shall initiate corrective maintenance whenever equipment defects are discovered as a result of the Contractor performing scheduled/preventive maintenance services, monitoring of the systems or notification by end user.

Each notification for an emergency repair service call shall be treated as a separate and new service call. The Contractor shall provide the covered locations with an unlimited number of unscheduled maintenance and technical support incidents during the performance period.

Contractor shall ensure no more than downtime then the service tier limits purchased by the individual facility. If equipment down time cannot be resolved within time limit an alternative solution shall be offered by the Contractor.

Corrective Maintenance/Repair Services shall be scheduled with the POC at the site requiring the service as listed on the applicable Task Order.

C.3.1.3 Replacement Parts All worn or defective parts are to be replaced at no cost to the Government. All newly installed parts will become the property of the Government.

Supplemental or support equipment that is not cost effective to repair shall be replaced at Contractor expense. Replaced parts are to be disposed of by the Contractor after approval of Facility POC. The Contractor shall promptly provide a return goods authorization for return of equipment being replaced.

Only standard new parts shall be furnished by the Contractor. All parts shall be of current manufacture and shall have versatility with presently installed equipment (See FAR Clause 52.211-5 (Aug 2000)). All major components and parts furnished shall carry the manufacturer's standard commercial warranty.

Operating and consumable supplies are not included in this contract.

C.3.1.4 Updates/Upgrades Updates/Upgrades shall be provided on both the equipment hardware and software to maintain the integrity of the existing System to keep products operating safely, effectively, and reliably, at no additional charge to the Government. These shall be provided as they become commercially available and at the same time as they are being provided to commercial customers, i.e., new version of software, correction of hardware defect, updates offered to commercial customers at no additional charge, upgrade to replace model of equipment no longer Contractor supported, etc.

All updates/upgrades must be in alignment with maintaining the overall existing digital telepathology system FDA clearance for patient use.

Changes to Service and Operator Manuals due to upgrades or updates shall be provided to the facility POC.

C.3.1.5 Service Reports A malfunction incident report shall be furnished to the facility POC upon completion of each service within 7 days. The report shall include, as a minimum, the following:

· Company name

· Service technician's name

· Date/time of service

· Serial number, type, and model number of equipment

· Time spent performing service

· Brief description of problem/issue, parts/items replaced, adjustments or realignments performed and any other information relevant to the service.

· Listing of replacement parts

· Proof of activity that includes supporting documentation of acceptable performance.

The maintenance service shall include communicating repair and outcomes with appropriate on-duty staff.

Deliverable #2: Service Maintenance Agreement

C.3.2 Task 3: VA Access C.3.2.1 Business Associate Agreement The Contractor shall sign and agree to the Business Associate Agreement (BAA) to establish requirements in accordance with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH) Act, and the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (“HIPAA Rules”), 45 C.F.R. Parts 160 and 164, for the Use and Disclosure of Protected Health Information (PHI) under the terms and conditions set forth.

A business associate agreement (BAA) between VHA and the Contractor must be in place before on-site activity occurs and maintained throughout the life of the contract in collaboration with the VHA Privacy Office BAA team (VHABAAIssues@va.gov), to cover any incidental viewing of VHA protected information that may occur in the process of performing this requirement.

C.3.2.2 MOU-ISA

Remote access is allowed for equipment and on premise servers located at VA sites with active TO through VPN with appropriate documentation in place. This includes access for remote work on software version changes, upgrades, updates, patches, enhancements, corrections, and new releases during the contract performance period.

The Contractor shall sign and agree to a Memorandum of Understanding, Interconnection Security Agreement (MOU-ISA) between the Contractor and VA. The Contractor is responsible for engaging with the Office of Cyber and Information Security and the VAMC Information Systems Security Officer to maintain a client-based VPN and appropriate MOU-ISA. The MOU-ISA must be maintained throughout the life of the contract.

C.3.2.3 Contractor PIV access Access to VA cloud computing environment shall be allowed for service activity of digital telepathology equipment software maintenances through Contractor employee VA PIV access. The Contractor may select up to five (5) key personnel to be sponsored through the PIV process under this contract for required maintenance activities outlined in section C.3.1. The Contractor agrees that the key personnel shall not be removed, diverted, or replaced from work without prior notification of the COR. Contractor staff shall be fully qualified and have the level of experience necessary to accomplish the requirements of this contract. Contractor is responsible for all PIV associated tasks outlined in Section E.

Not all Contractor personnel providing services under this contract require VA PIV access to accomplish the required tasks. The Contractor shall evaluate service needed and assign appropriate personnel to accomplish the required task.

Deliverable #3: BAA, MOU-ISA, PIV Access Documentation

D. GOVERNMENT- FURNISHED EQUIPMENT/ MATERIALS/ FACILITIES/ INFORMATION

The Contractor’s Key Personnel will be issued a PIV card to allow access to VHA platforms for communication. The Contractor’s Key Personnel will be given Remote Access into the VHA system. All personnel obtaining GFE/GFI/GFP shall complete IT Security Requirements (see Sec 15) and complete Rules of Behavior (ROB) form and have completed all required security trainings. GFE/GFI/GFP will be strictly provided only as necessary and approved by the Government. GFE/GFI/GFP

The Government may provide will furnish the following: encrypted laptop and electronic mail (e-mail) account as required by this contract.

Prior to the use/access of any Government-furnished equipment, the Contractor shall complete all mandatory training courses on the VA training site, currently the VA Talent Management System (TMS), and will be tracked therein. The TMS may be accessed at https://www.tms.va.gov. If an individual does not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

If needed, Government Furnished Laptops will be provided to the Contractor as approved by Contracting Officer Representative (COR) and Contracting Officer (CO). GFE is limited to Key Personnel with mission-critical duties as defined by the COR. Contractor shall complete a GFE Request Form (which would be provided as needed) for requests for GFE to the COR for review and approval by Contracting Officer (CO). No GFE shall be provided without explicit approval by CO. Any changes in status of a Contractor employee with GFE shall be made known to COR within 2 business days. The Government will track all GFE/GFI/GFP throughout the life of the Task Order. No GFE will be issued without explicit approval from CO.

The Contractor shall adhere to all VA security requirements for any VA issued equipment and all Contractor personnel that will receive and utilize VA issued laptops shall sign a VA property loan form and all associated documentation prior to receiving the equipment. All VA policies related to networked computer use will apply. Personal identification verification (PIV) cards shall be required for all Contractor personnel with VA network access/accounts. Contractor personnel shall complete VA’s Privacy and Information Security Awareness and Rules of Behavior training before networked computer access will be granted.

Final Invoice shall be withheld until all GFE/GFI/GFP has been retrieved and/or otherwise final dispensation of GFE/GFI/GFP is approved by COR and CO upon completion of the Contract. Failure to return GFI/GFP/GFP upon completion of contract or as otherwise requested by Government is cause for providing negative CPARS rating and other disciplinary action as allowed by Federal Regulations.

E. SECURITY AND PRIVACY REQUIREMENTS

E.1 Position/Task Risk Designation Level(S)

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Task 2 VA environment access - Tier 1 / Low / NACI Task 3 VA environment access - Tier 1 / Low / NACI

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

E.2 Contractor Personnel Security Requirements E.2.1 Contractor Responsibilities:

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

b. The Contractor shall bear the expense of obtaining background investigations. Within 3 business days after award, the Contractor shall provide a roster of Contractor and SubContractor employees to the COR to begin their background investigations in accordance with the ProPath template. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 7.0 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

c. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

d. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1. For a Tier 1/Low Risk designation:

0. OF-306

0. DVA Memorandum – Electronic Fingerprints

1. For Tier 2/Moderate or Tier 4/High Risk designation:

1. OF-306

1. VA Form 0710

1. DVA Memorandum – Electronic Fingerprints

The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via eQIP).

e. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

f. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) finger print results, training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and, the signed “Contractor Rules of Behavior.” However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

g. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and SubContractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

E.2.3 Physical Security and Safety Requirements The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

1. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

1. Smoking is prohibited inside/outside any building other than the designated smoking areas.

1. Possession of weapons is prohibited.

1. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

E.2.4 Confidentiality and Non-Disclosure

0. The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

0. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

0. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

0. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA CO.

0. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

0. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

0. Contractor must adhere to the following:

1. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

1. Controlled access to system and security software and documentation.

1. Recording, monitoring, and control of passwords and privileges.

1. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

1. VA, as well as any Contractor (or SubContractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

1. Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

1. Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

1. Contractor does not require access to classified data.

0. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

0. VA Form 0752, Confidentiality of Sensitive Information Non-Disclosure Agreement, shall be completed by all Contractor employees that receive Government furnished laptops, and shall be provided to the CO before any work is performed. In the case that Contractor personnel are replaced in the future, their replacements shall complete VA Form 0752 prior to beginning work.

E.3 APPLICABLE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE (per VA HANDBOOK 6500.6, APPENDIX C, MARCH 12, 2010)

E.3.1 General

Contractors, Contractor personnel, SubContractors, and SubContractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

E.3.2 Access To VA Information and VA Information Systems

a. A Contractor/SubContractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, SubContractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, SubContractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates (e.g. Business Associate Agreement, Section 3G), the Contractor/SubContractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The Contractor or SubContractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or SubContractor’s employ. The CO must also be notified immediately by the Contractor or SubContractor prior to an unfriendly termination.

E.3.3 VA Information Custodial Language

a. Information made available to the Contractor or SubContractor by VA for the performance or administration of this contract or information developed by the Contractor/SubContractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/SubContractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the Contractors/SubContractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA information is returned to VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of Contractor and SubContractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, Contractor/SubContractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a Contractor/SubContractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA CO within 30 days of termination of the contract.

d. The Contractor/SubContractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The Contractor/SubContractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/SubContractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/SubContractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. The Contractor/SubContractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

h. The Contractor/SubContractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA minimum requirements. VA Configuration Guidelines are available upon request.

i. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/SubContractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA prior written approval. The Contractor/SubContractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA CO for response.

E.3.4 Security Incident Investigation

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The Contractor/SubContractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/SubContractor has access.

b. To the extent known by the Contractor/SubContractor, the Contractor/SubContractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/SubContractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the Contractor/SubContractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The Contractor, its employees, and its SubContractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/SubContractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

E.3.5 LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the Contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the Contractor/SubContractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. The Contractor/SubContractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

1) Nature of the event (loss, theft, unauthorized access);

2) Description of the event, including:

a) date of occurrence;

b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

3) Number of individuals affected or potentially affected;

4) Names of individuals or groups affected or potentially affected;

5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

6) Amount of time the data has been out of VA control;

7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

8) Known misuses of data containing sensitive personal information, if any;

9) Assessment of the potential harm to the affected individuals;

10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1) Notification;

2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3) Data breach analysis;

4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5) One year of identity…