Reference Lab UBA1 VEXAS DRAFT PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

REFERENCE LABORATORY TESTING SERVICES

GENERAL

1.1. SERVICES REQUIRED:

The Department of Veterans Affairs San Francisco VA Health Care System (SFVAHCS) requires Contractor to provide reference laboratory testing services on an as needed basis. For the testing of somatic mutations of the UBA1 gene to aid in the diagnosis of VEXAS Syndrome.

1.2. PLACE OF PERFORMANCE:

Services shall be provided at the Contractor’s laboratory.

1.3. AUTHORITY: Title 38 USC 8153, Health Care Resources (HCR) Sharing Authority.

1.4. POLICY AND REGULATIONS: The Contractor shall comply with all applicable OSHA, federal and state laws and regulations as required for performing the type of services required, including the Centers for Medicare and Medicaid Services, Clinical Laboratory Improvement Amendments (CLIA).

1.5. DEFINITIONS/ACRONYMS:

1.5.1. CAP: College of American Pathologists. Laboratory Accreditation agency that has deemed status from the Centers for Medicare & Medicaid Services.

1.5.2. CDR: Contract Discrepancy Report

1.5.3. CLIA: Clinical Laboratory Improvement Amendments. United States federal regulatory standards that apply to all clinical laboratory testing performed on humans in the United States.

1.5.4. CMS: Centers for Medicare and Medicaid Services

1.5.5. Contracting Officer (CO): The person executing this contract on behalf of the Government with the authority to enter into and administer contracts and make related determinations and findings.

1.5.6. Contracting Officer’s Representative (COR): A person appointed by the CO to take necessary action to ensure the Contractor performs in accordance with, and adheres to, the specifications contained in the contract and to protect the interest of the Government. The COR shall report to the CO promptly any indication of non-compliance in order that appropriate action can be taken.

1.5.7. CPARS: Contractor Performance Assessment Reporting System

1.5.8. IAW: In Accordance With

1.5.9. POP: Period of Performance

1.5.10. PWS: Performance Work Statement

1.5.11. QA/QI: Quality Assurance/Quality Improvement

1.5.12. QM/PI: Quality Management/Performance Improvement

1.5.13. QASP: Quality Assurance Surveillance Plan

1.5.14. Veterans Health Administration (VHA): The central office for administration of the VA medical centers through throughout the United States. The VHA is located in Washington, D.C.

1.5.15. Veterans Integrated Services Network (VISN): The regional oversight for the VA medical center.

1.5.16. Veterans Affairs Medical Center (VAMC): Unless identified with the name of a different VA Medical Center, for purposes of this contract, this term shall mean the San Francisco VA Health Care System, 4150 Clement Street, San Francisco, CA 94121

SCHEDULE OF SERVICES

The Contractor shall provide all personnel, equipment and services to perform laboratory services to include pickup and transport of specimens to its laboratory; pre-analytic processing as defined in its laboratory user’s manual; analysis, reporting of analytic results, and consultation regarding selection, collection, transportation and result interpretation for the San Francisco VA Health Care System as further described in the Performance Work Statement (PWS) included herein.

Place of Performance: Services shall be provided at the Contractor’s reference laboratory. The primary reference laboratory is defined as the location where at least 85% of the total volume of tests are performed. It is acceptable for some tests (15% or less of the total volume of tests) to be sent to an alternate or more specialized testing laboratory.

Period of Performance:

Base Period: October 1, 2024 to September 30, 2025 Option Year 1: October 1, 2025 to September 30, 2026

Option Year 2: October 1, 2026 to September 30, 2027 Option Year 3: October 1, 2027 to September 30, 2028 Option Year 4: October 1, 2028 to September 30, 2029

CONTRACTOR QUALIFICATIONS

2.1. LICENSING AND ACCREDITATION: Contractor shall have and maintain all licenses, permits, accreditation and certificates required by law to operate as a CLIA-certified laboratory. This requirement shall also apply to any subcontractors performing services under this contract. Contractor shall provide evidence of Laboratory accreditation upon receipt of a written request.

2.2. PROFESSIONAL LIABILITY INSURANCE: Contractor shall maintain professional liability insurance by a commercial insurance company in the business of providing the required insurance coverage. The Contractor shall provide a copy of the Insurance Certificate upon receipt of a written request by the VA.

2.3. CONFLICT OF INTEREST: Contractor is responsible for identifying and communicating to the CO and COR conflicts of interest at the time of proposal and during the entirety of contract performance.

At the time of proposal, the Contractor shall provide a statement which describes, in a concise manner, all relevant facts concerning any past, present, or currently planned interest (financial, contractual, organizational, or otherwise) or actual or potential organizational conflicts of interest relating to the services to be provided. The Contractor shall also provide statements containing the same information for any identified consultants or subcontractors who shall provide services. The Contractor must also provide relevant facts that show how it’s organizational and/or management system or other actions would avoid or mitigate any actual or potential organizational conflicts of interest.

2.4. ANNUAL OFFICE OF INSPECTOR GENERAL (OIG) STATEMENT:

2.4.1. In accordance with HIPAA and the Balanced Budget Act (BBA) of 1977, the VA OIG has established a list of parties and entities excluded from Federal health care programs. Specifically, the listed parties and entities may not receive Federal Health Care program payments due to fraud and/or abuse of the Medicare and Medicaid programs.

2.4.2. Therefore, all Contractors shall review the OIG List of Excluded Individuals/Entities on the OIG web site at www.hhs.gov/oig to ensure that the proposed Contractors and/or firm(s) are not listed.

Contractors should note that any excluded individual or entity that submits a claim for reimbursement to a Federal health care program, or causes such a claim to be submitted, may be subject to a Civil Monetary Penalty (CMP) for each item or service furnished during a period that the person or entity was excluded and may also be subject to treble damages for the amount claimed for each item or service. CMPs may also be imposed against the Contractors and entities that employ or enter into contracts with excluded individuals or entities to provide items or services to Federal program beneficiaries.

2.4.3. By submitting their proposal, the Contractor certifies that the OIG List of Excluded Individuals/Entities has been reviewed and that the Contractor(s) and/or firm(s) are not listed as of the date the offer/bid was signed.

SCHEDULE

3.1. SCHEDULE: The Contractor shall provide services 24 hours a day, 7 days per week, including federal holidays, as required by VA. All services shall be provided within the timeframes specified in Section 4 below. The Contractor shall provide routine scheduled specimen pickup at a time mutually agreed upon by the COR and the Contractor.

3.2. FEDERAL HOLIDAYS: The following holidays are observed by the Department of Veterans Affairs:

3.2.1. New Year’s Day

3.2.2. Martin Luther King’s Birthday

3.2.3. Presidents Day

3.2.4. Memorial Day

3.2.5. Juneteenth Independence Day

3.2.6. Independence Day

3.2.7. Labor Day

3.2.8. Columbus Day

3.2.9. Veterans Day

3.2.10. Thanksgiving Day

3.2.11. Christmas Day

3.2.12. Any day specifically declared by the President of the United States to be a national holiday.

3.3. Unless a state of emergency has been declared or SFVAHCS facilities are closed, the Contractor shall be responsible for providing services.

CONTRACTOR RESPONSIBILITIES

4.1. SERVICES REQUIRED: SFVAHCS requires the Contractor to provide reference laboratory testing for the tests described in the PRICE SCHEDULE for the most frequently ordered tests and estimated volumes for each. This list is not all inclusive as patient testing needs may fluctuate throughout the contract period. These fluctuations can occur in both the volume of tests and the test menu.

4.2. STANDARDS OF PRACTICE: Contractor shall perform services according to the requirements contained in this PWS and services shall be performed in a manner that is equal to or greater than CLIA and CAP standards.

4.3. SPECIMEN PICK-UP TIMES:

4.3.1. Routine: The Contractor shall provide test requisition forms, shipping containers for specimen, and prepaid shipping labels utilizing FedEx or UPS service for specimen transport.

4.4. TEST RESULTS:

4.4.1. Routine: The Contractor shall provide routine test results to the ordering VA facility within twenty-four (24) hours following test completion, except when specimens are picked up the day before a weekend or holiday (in which case the results will be provided the following business day) and for tests with published longer turnaround times. Test procedures requiring a turnaround time longer than 24 hours (excluding the above exceptions) shall be identified in the Contractor’s Laboratory User’s manual (paper or electronic or on-line).

4.4.2. Telephone Consultation: The Contractor shall consult with the VA COR, requesting Clinician or designee at the VA by telephone as needed.

4.4.3. Critical Values: The Contractor shall immediately telephone the COR; requesting Clinician or designee to report Critical Values or test result that may indicate a life-threatening condition.

4.4.4. Reporting of Results: A report is defined as a printed final copy in duplicate of laboratory testing results. This report shall be received by an electronic interface or available to be printed by an online user account. If results are telephoned to VA, the report must include the name of the individual who was notified by telephone of the results. Each test report shall indicate, at minimum, the following information:

4.4.4.1. Patient's name and/or identification code (Social Security number if provided)

4.4.4.2. Physician's name (if supplied)

4.4.4.3. Medical record number (if supplied)

4.4.4.4. Patient's location (clinical/ward), (if supplied)

4.4.4.5. Date/time specimen received in Reference Lab

4.4.4.6. Test ordered

4.4.4.7. Date/time of specimen collection (when available)

4.4.4.8. Date test completed

4.4.4.9. Test result

4.4.4.10. Flag abnormals

4.4.4.11. Reference range

4.4.4.12. Toxic and/or therapeutic range where applicable

4.4.4.13. Testing laboratory specimen number

4.4.4.14. Name of testing laboratory (contractor and/or subcontractor)

4.4.4.15. Type of specimen

4.4.4.16. Any additional comments related to test provided by submitting labs.

4.4.4.17. Any other information the laboratory has that may indicate a questionable validity of test results.

4.4.4.18. Unsatisfactory specimen shall be reported with regard to its unsuitability for testing.

4.5. STORAGE OF SPECIMENS:

4.5.1. The Contractor shall store all specimens as required by regulatory agencies (RA).

4.5.2. Upon request by the COR or designee, the Contractor shall provide a copy of the regulatory requirements for each participating RA.

4.6. MONTHLY TESTS SUMMARY:

4.6.1. The Contractor shall provide to the VA a cumulative (year-to-date) and monthly report of all tests received during the month and for all outstanding results. The report will also include turn around statistics, cost per test (including any additional charges), and specimen or testing issues.

4.7. SERVICE:

4.7.1. The Contractor shall provide telephone number(s) and a contact person to be used by the VA to make specimen problem inquiries and for problem solving at all times, including weekends and holidays.

4.7.2. The Contractor shall include names and telephone numbers of technical Directors and Pathologists available for consultation.

4.7.3. The Contractor agrees to maintain the minimum acceptable service, reporting systems and quality control as specified herein. Immediate (within 24 hours) notification must be given to VA upon adverse action by a regulatory agency (RA).

4.7.4. The Contractor shall assign a specific local account representative to the VA.

4.7.5. The Contractor shall advise the COR of any changes in methodology, procedure, reference ranges, delays in testing, and any new tests introduced within a timely manner and prior to changes being made.

4.7.6. In the event that the Contractor changes the assay procedure of a critically important component of an assay (e.g., and antibody, purified antigen, etc.), the Contractor shall notify the COR prior to the intended change and provide documentation that the quality and efficacy of the test will remain unchanged or be improved when desirable for all tests. All new tests shall have CPT codes and LOINC coding. Changes in the assay materials or procedure may be sufficient cause for changing to an alternate contractor for the assay(s) for the duration of the contract at the sole discretion of the CO/COR.

4.7.7. If it is deemed that the removal of the test from the test menu is required, due to any changes by the Contractor, then it will be communicated to the Contractor by the CO, COR or designee.

4.8. TELECOMMUNICATIONS/ELECTRONIC RESULT REPORTING:

4.8.1. Receiving Electronic Results. The VA shall receive results through a web based online account established for users at SFVAHCS. The completed and/or partial test results shall be available online to SFVAHCS facility personnel within published turnaround time (TAT) except where specified. The Contractor is responsible for all supplies required for transmission of test results.

4.8.2. The web based online account must allow the SFVAHCS user to:

4.8.2.1. Print copies of the laboratory reports

4.8.2.2. Provide a report format of the copies equal to the current facilities format.

4.8.2.3. Reprint capability of a report at the VA laboratory.

4.8.3. The Contractor shall:

4.8.3.1. Provide for individual online user accounts for SFVAHCS laboratory personnel.

4.8.3.2. Have the responsibility to train medical center personnel in routine operations of the online account and

4.8.3.3. Provide a validation service (fax or telephone) in the event of transmission or online account failure.

4.9. TESTING METHODOLOGY & REFERENCE:

4.10. Testing methodology and reference ranges for a test must be defined in the laboratory user manual.

4.11. LOCATION OF PRIMARY TESTING LABORATORY. The location of the primary reference laboratory shall be located in the same time zone. The primary reference laboratory is defined as the main facility where samples are transported and received, and a minimum of 85% of the submitted samples for testing are performed at that location. Up to 15% of the submitted samples may be referred to other Contractor’s testing laboratories within its network, and may be located in another time zone, provided there is a mechanism to maintain the samples’ integrity.

4.12. CONTRACTOR PERSONNEL:

4.13. The Contractor shall make sure employees have current and valid professional certifications before starting work under this contract. The Laboratory Director, medical technologists, medical technicians, cytotechnologists shall meet personnel qualifications required by CLIA '88 Guidelines.

Pathologists must have graduated from an approved school of medicine or osteopathy and completed a residency or fellowship in pathology acceptable to the United States Surgeons General and must possess a valid license to practice clinical reference laboratory services from a United States jurisdiction; and shall have provided pathology services a minimum of 24 months within the past 36 months and pathology consultation services a minimum of 36 months within the past 48 months.

4.14. The Contractor shall maintain current licenses and certificates and provide copies of such to VA upon reasonable written request.

4.15. The courier personnel shall be trained and certified to handle biological and infectious samples as defined by the Department of Transportation. Copies of training certificates shall be made available upon request.

4.16. PERFORMANCE STANDARDS, QUALITY ASSURANCE AND QUALITY

IMPROVEMENT:

4.16.1. The Contractor shall be subject to Quality Assurance measures, using the standards as outlined in this PWS and methods of surveillance detailed in the Quality Assurance Surveillance Plan (QASP). The QASP shall be attached to the resultant contract and shall define the methods and frequency of surveillance conducted.

4.16.2. The Government will evaluate the Contractor’s performance to ensure services are performed in accordance with this Contract to include monitoring test results for consistency to ensure results correlate with diagnosis. If any of the services do not conform to the contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no additional cost to the Government. When the defective services cannot be corrected by re-performance, the Government may:

4.16.3. Obtain the service from another source and charge the Contractor with any resultant charges plus actual administrative costs.

4.16.4. Require the Contractor to take necessary action to ensure that future performance conforms to contract requirements; and

4.16.5. Take other actions as appropriate, including but not limited to termination of this Contract.

4.16.6. For contracts with a period of one year or less, the CO will perform a single evaluation when the contract is complete. For contracts exceeding one year, the CO will evaluate the Contractor’s performance annually. Interim reports will be filed each year until the last year of the contract, when the final report will be completed. The report shall be assigned in CPARS to the Contractor’s designated representative for comment. The Contractor will have sixty (60) days to submit any comments and re-assign the report to the CO.

4.16.7. Failure of the Contractor to respond to the evaluation within those sixty (60) days will result in the Government’s evaluation being placed on file in the database with a statement that the Contractor failed to respond; the Contractor’s representative will be “locked out” of the evaluation and may no longer send comments.

4.16.8. To ensure proper handling and test performance, the Contractor shall provide the following updated information to VA upon request during the life of contract:

4.16.8.1. For quality purposes, tests routinely performed in duplicate should be indicated.

4.16.8.2. Indication of average monthly volume of specified tests in the Schedule that the laboratory performs.

4.16.8.3. Coefficient of variation of quality control samples of all tests or specified tests the laboratory performs.

4.16.8.4. Proficiency testing data shall include a list of tests outside of the acceptable range for past two years.

4.16.8.5. Contractor shall provide address of processing sites under contract, including subcontracted testing location sites.

4.16.8.6. The Contractor(s) facilities, methodologies (defined as the principal of the method and the references), and quality control procedures may be examined by representatives of the government upon prior written notice and during normal business hours during the life of the contract.

4.17. RECORDS:

4.17.1. The Contractor shall be responsible for creating, maintaining and disposing of only those government required records that are specifically cited in the work statement or required by the provisions of a mandatory directive listed in section (d) Applicable Publications and Forms. If requested by the COR, the Contractor shall provide the original record, or a reproducible copy of any such record, promptly of receipt of the written request.

4.18. PATIENT LISTS:

4.18.1. The Contractor shall treat patient lists, no matter how developed, as privileged information. Lists and/or names of patients shall not be disclosed to or revealed in any way for any use outside the VA without prior written permission by the COR or Chief of Staff.

4.19. RELEASE OF MEDICAL INFORMATION:

4.19.1. The Contractor and its subcontractors shall not release any medical information obtained during the course of this contract to anyone outside the VA, unless authorized in writing by the COR and the patient, as required by applicable law.

4.20. PROFESSIONAL LIABILITY INSURANCE:

4.20.1. Professional liability insurance shall be by a commercial insurance company in the business of providing the required insurance coverage. The Contractor shall provide a copy of the Insurance Certificate upon receipt of a written request by VA.

4.21. SAFETY:

4.21.1. The Contractor shall comply with all applicable OSHA, Federal, State, laws, and regulations as required for performing the type of services required.

4.22. END OF CONTRACT PERFORMANCE:

4.22.1. At the end of the period of contract performance, SFVAHCS will notify the Contractor of the quantity of unused supplies and arrange a pick-up time. All Contractor-provided equipment shall be disconnected by the Contractor from SFVAHCS’ facilities upon contract expiration and removed within five working days.

4.23. GENERAL DEFINITIONS:

4.23.1. Critical Value: A test result that requires evaluation by a physician or other health care provider as soon as verified. Failure to take appropriate action as a result of a critical value might cause harm or undue suffering for a patient. A list of critical values is to be made available to SFVAHCS upon request.

4.23.2. Reference or Referral Laboratory. The contract laboratory that provides testing, and examination of specimens provided by the VA.

4.23.3. Reference Value. A range of test values expected for a designated population of individuals.

4.23.4. Specimen. A body fluid or tissue sample removed for medical examination and analytical testing.

4.23.5. STAT. A designated category of tests that requires immediate processing to expedite results to physicians handling potentially life-threatening cases.

4.23.6. Tests. Diagnostic assays to evaluate a patient's physiological condition.

4.23.7. Routine Test. A test that is usually performed at high volume in which the result is required in 24 hours generally.

4.23.8. Specialized Test. A test that is performed in low volume but the technology, expense, or time-consuming nature of each test, is such that some delay is expected. However, results should be received within a reasonable amount of time to meet patient care needs. The delay usually occurs to allow tests received from different enters to be batch to make the operation cost effected.

4.23.9. Esoteric Test. A test that is similar to specialized tests, except they can only be done in a few laboratories throughout the country.

4.23.10. TAT. Turnaround time. The length of elapsed time between pick-up or dispatch of specimen from the contractor’s laboratory until the receipt of the completed printed/ electronically transmitted report back in the lab. Exception: For STAT tests, the TAT shall begin at the time of notification by the SFVAHCS laboratory to the Contractor. These definitions apply whether the contractor or a subcontractor performs the test.

4.23.11. Special handling. Unusual circumstances may dictate the need for a specimen to be picked up, run out of sequence at a special time, or reported within a shorter than usual time.

4.23.12. Overflow. A test usually performed in a SFVAHCS laboratory, which might be referred to the Contractor’s laboratory in case of instrument breakdown or other circumstances interfering with the VA’s ability to analyze the specimens.

4.23.13. Proficiency Testing. An assessment of the accuracy of testing by a laboratory based on the analysis of an unknown specimen analyzed by a large number of other labs. The proficiency survey is conducted by an organization or agency authorized by HHS to do so.

GOVERNMENT RESPONSIBILITIES

5.1. OVERSIGHT OF SERVICE/PERFORMANCE MONITORING: After award of contract, all inquiries and correspondence relative to the administration of the contract shall be addressed to:

5.2. SAMPLE PREPARATION:

5.2.1. SFVAHCS will provide laboratory specimens prepared according to the Contractor's laboratory user’s manual, identified, and labeled for testing. The Contractor shall be responsible for transporting and storing specimens according to industry standards. Contractor shall supply any special preservatives required for specimen preservation.

5.2.2. SFVAHCS is responsible for packaging the specimens for transport.

5.3. CO RESPONSIBILITIES:

5.3.1. The CO is the only person authorized to approve changes or modify any of the requirements of this contract. The Contractor shall communicate with the CO on all matters pertaining to contract administration. Only the CO is authorized to make commitments or issue any modification to include (but not limited to) terms affecting price, quantity or quality of performance of this contract.

5.3.2. The CO shall resolve complaints concerning Contractor relations with the Government employees or patients. The CO is final authority on validating complaints. In the event the Contractor effects any such change at the direction of any person other than the CO without authority, no adjustment shall be made in the contract price to cover an increase in costs incurred as a result thereof.

5.3.3. In the event that contracted services do not meet quality and/or safety expectations, the best remedy will be implemented, to include but not limited to a targeted and time limited performance improvement plan; increased monitoring of the contracted services; consultation or training for Contractor personnel to be provided by the VA; replacement of the contract personnel and/or renegotiation of the contract terms or termination of the contract.

5.4. COR Responsibilities:

5.4.1. After contract award, the CO will designate a VA employee as the Contracting Officer’s Representative (COR). The COR will be responsible for overseeing the services performed by under this Contract. The COR shall be the VA official responsible for verifying contract compliance. After contract award, any incidents of Contractor noncompliance as evidenced by the monitoring procedures shall be forwarded immediately to the CO.

5.4.2. The COR will certify monthly invoices for payment and will be responsible for monitoring the Contractor’s performance to ensure all specifications and requirements are fulfilled.

SPECIAL CONTRACT REQUIREMENTS

6.1. DELAYS IN REPORTING TEST RESULTS:

If for any reason, there will be a delay in reporting of test results the Contractor will contact the VA as soon as they are aware that a delay will occur. Such notification must be made by telephone or facsimile to the COR and the Contractor will provide an estimated time for delivery of delayed results. Email notification will not be accepted.

6.2. BILLING/INVOICES:

6.2.1. SFVAHCS will maintain a record-keeping system comprising daily logs specimens sent to the Contractor for processing. The COR will review this data against monthly invoices submitted by the Contractor to ensure invoices accurately reflect the services performed.

6.2.2. Payment made during all periods of performance of this agreement shall constitute the total cost for services rendered by the contractor, and shall not exceed the amounts specified in the “Schedule of Supplies and Services” without written request and the written approval from the CO.

6.2.3. Invoices rendered by the contractor to SFVAHCS for services furnished under this agreement, will be invoiced in full for each month in which services were performed. All payments made under this contract will be made monthly in arrears in accordance with FAR Clause 52.212-4. No advance payments will be authorized. Invoices shall be electronically sent, using the form Tungsten/OB10 e-Invoice, to the Department of Veterans Affairs, PO Box 149971 Financial Services Center (FSC), Austin, Texas 78714- 8971. For more information on how to send invoices electronically, visit http://www.ipps.fsc.va.gov.

6.2.4. All invoices applicable to this contract must be submitted no later than thirty (30) days after the end of the contract period. Any problems regarding unpaid invoices should be directed to the COR.

6.2.5. At a minimum, each invoice must contain the following: Dates of service, description of test(s) performed, unit price, and total cost of services provided, purchase order number, contract number, and remittance address. All invoices must include the name, title and phone number of person to be notified in the event of defective invoicing. Refer to FSC policy in completing and submitting Form OB-10 e- Invoice.

6.2.6. All invoices must be submitted for actual services performed by the Contractor. Invoices shall be submitted in accordance with, and at the prices specified in the continuation of SF Form 1449, Schedule of Supplies and Services of this agreement.

6.2.7. Invoice requirements and supporting documentation: Supporting documentation and invoices must be submitted no later than the 20th workday of the month. Subsequent changes or corrections shall be submitted by separate invoice. In addition to information required for submission of a “proper” invoice in accordance with FAR 52.212-4 (g), all invoices must include all information necessary using electronic means in accordance with the policy set forth by the VA Financial Services Center, Austin, Texas (see previous paragraph).

6.3. SUBCONTRACTING:

If during the course of the Contract, the Contractor elects to subcontract to a different laboratory for the purpose of performing any of the services required under this Contract, the Contractor shall provide advance written notification to the CO and COR. SFVAHCS shall have the right to approve or disapprove the use of any proposed subcontractor(s) based on a determination of the subcontractor(s)’ ability to perform the services in accordance with VA’s standards for quality and consistency. The Contractor shall be responsible for ensuring that subcontractor possess and maintain the same qualifications, accreditations and certifications as required for the Contractor as described above.

6.4 CHANGES:

If it is deemed by VA that the removal of the test from the test menu is required, due to any changes by the Contractor, then it will be communicated by the CO, COR or designee.

The VA may need to add test to the test list during the contract term without contract modification. This may be due to a change or discontinued test previously done by another laboratory. VA may make requests for pricing, specimen requirements and methodology. The CO, COR or designee will make the final decision on the appropriateness of adding the subject test to the test list.

INFORMATION SECURITY REQUIREMENTS

7.1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

7.2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

7.2.1. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

7.2.2. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

7.2.3. The contractor or subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The CO must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

7.3. VA INFORMATION CUSTODIAL LANGUAGE

7.3.1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

7.3.2. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

7.3.3. Prior to termination or completion of this contract contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

7.3.4. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

7.3.5. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

7.3.6. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

7.3.7. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

7.3.8. The contractor/subcontractor l firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

7.3.9. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

7.3.10. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

7.3.11. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

7.4. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

7.4.1 . FOR INFORMATION SYSTEMS THAT ARE HOSTED, OPERATED, MAINTAINED, OR

USED ON BEHALF OF VA AT NON-VA FACILITIES, CONTRACTORS/SUBCONTRACTORS

ARE FULLY RESPONSIBLE AND ACCOUNTABLE FOR ENSURING COMPLIANCE WITH ALL

HIPAA, PRIVACY ACT, FISMA, NIST, FIPS, AND VA SECURITY AND PRIVACY DIRECTIVES

AND HANDBOOKS. THIS INCLUDES CONDUCTING COMPLIANT RISK ASSESSMENTS,

ROUTINE VULNERABILITY SCANNING, SYSTEM PATCHING AND CHANGE MANAGEMENT

PROCEDURES, AND THE COMPLETION OF AN ACCEPTABLE CONTINGENCY PLAN FOR

EACH SYSTEM. THE CONTRACTOR’S SECURITY CONTROL PROCEDURES MUST BE

EQUIVALENT, TO THOSE PROCEDURES USED TO SECURE VA SYSTEMS. A PRIVACY

IMPACT ASSESSMENT (PIA) MUST ALSO BE PROVIDED TO THE COTR AND APPROVED BY

VA PRIVACY SERVICE PRIOR TO OPERATIONAL APPROVAL. ALL EXTERNAL INTERNET

CONNECTIONS TO VA’S NETWORK

INVOLVING VA INFORMATION MUST BE REVIEWED AND APPROVED BY VA PRIOR TO

IMPLEMENTATION.

7.4.2. ADEQUATE SECURITY CONTROLS FOR COLLECTING, PROCESSING, TRANSMITTING,

AND STORING OF PERSONALLY IDENTIFIABLE INFORMATION (PII), AS DETERMINED BY

THE VA PRIVACY SERVICE, MUST BE IN PLACE, TESTED, AND APPROVED BY VA PRIOR

TO HOSTING, OPERATION, MAINTENANCE, OR USE OF THE INFORMATION SYSTEM, OR

SYSTEMS BY OR ON BEHALF OF VA. THESE SECURITY CONTROLS ARE TO BE ASSESSED

AND STATED WITHIN THE PIA AND IF THESE CONTROLS ARE DETERMINED NOT TO BE IN

PLACE, OR INADEQUATE, A PLAN OF ACTION AND MILESTONES (POA&M) MUST BE

SUBMITTED AND APPROVED PRIOR TO THE COLLECTION OF PII.

7.4.3 OUTSOURCING (CONTRACTOR FACILITY, CONTRACTOR EQUIPMENT OR

CONTRACTOR STAFF) OF SYSTEMS OR NETWORK OPERATIONS, TELECOMMUNICATIONS

SERVICES, OR OTHER MANAGED SERVICES REQUIRES CERTIFICATION AND

ACCREDITATION (AUTHORIZATION) (C&A) OF THE CONTRACTOR’S SYSTEMS IN

ACCORDANCE WITH VA HANDBOOK 6500.3, CERTIFICATION AND ACCREDITATION

AND/OR THE VA OCS CERTIFICATION PROGRAM OFFICE. GOVERNMENT-OWNED

(GOVERNMENT FACILITY OR GOVERNMENT EQUIPMENT) CONTRACTOR-OPERATED

SYSTEMS, THIRD PARTY OR BUSINESS PARTNER NETWORKS REQUIRE MEMORANDUMS

OF UNDERSTANDING AND INTERCONNECTION AGREEMENTS (MOU-ISA) WHICH DETAIL

WHAT DATA TYPES ARE SHARED, WHO HAS ACCESS, AND THE APPROPRIATE LEVEL OF

SECURITY CONTROLS FOR ALL SYSTEMS CONNECTED TO VA NETWORKS.

7.4.4 THE CONTRACTOR/SUBCONTRACTOR’S SYSTEM MUST ADHERE TO ALL FISMA,

FIPS, AND NIST STANDARDS RELATED TO THE ANNUAL FISMA SECURITY CONTROLS

ASSESSMENT AND REVIEW AND UPDATE THE PIA. ANY DEFICIENCIES NOTED DURING

THIS ASSESSMENT MUST BE PROVIDED TO THE VA CONTRACTING OFFICER AND THE ISO

FOR ENTRY INTO VA’S POA&M MANAGEMENT PROCESS. THE

CONTRACTOR/SUBCONTRACTOR MUST USE VA’S POA&M PROCESS TO DOCUMENT

PLANNED REMEDIAL ACTIONS TO ADDRESS ANY DEFICIENCIES IN INFORMATION

SECURITY POLICIES, PROCEDURES, AND PRACTICES, AND THE COMPLETION OF THOSE

ACTIVITIES. SECURITY DEFICIENCIES MUST BE CORRECTED WITHIN THE TIMEFRAMES

APPROVED BY THE GOVERNMENT. CONTRACTOR/SUBCONTRACTOR PROCEDURES ARE

SUBJECT TO PERIODIC, UNANNOUNCED ASSESSMENTS BY VA OFFICIALS, INCLUDING

THE VA OFFICE OF INSPECTOR

7.4.5 GENERAL. THE PHYSICAL SECURITY ASPECTS ASSOCIATED WITH

CONTRACTOR/SUBCONTRACTOR ACTIVITIES MUST ALSO BE SUBJECT TO SUCH

ASSESSMENTS. IF MAJOR CHANGES TO THE SYSTEM OCCUR THAT MAY AFFECT THE

PRIVACY OR SECURITY OF THE DATA OR THE SYSTEM, THE C&A OF THE SYSTEM MAY

NEED TO BE REVIEWED, RETESTED AND RE-AUTHORIZED PER VA HANDBOOK 6500.3.

THIS MAY REQUIRE REVIEWING AND UPDATING ALL OF THE DOCUMENTATION (PIA,

SYSTEM SECURITY PLAN, CONTINGENCY PLAN). THE CERTIFICATION PROGRAM OFFICE

CAN PROVIDE GUIDANCE ON WHETHER A NEW C&A WOULD BE NECESSARY.

7.4.6 THE CONTRACTOR/SUBCONTRACTOR MUST CONDUCT AN ANNUAL SELF

ASSESSMENT ON ALL SYSTEMS AND OUTSOURCED SERVICES AS REQUIRED. BOTH HARD

COPY AND ELECTRONIC COPIES OF THE ASSESSMENT MUST BE PROVIDED TO THE COTR.

THE GOVERNMENT RESERVES THE RIGHT TO CONDUCT SUCH AN ASSESSMENT USING

GOVERNMENT PERSONNEL OR ANOTHER CONTRACTOR/SUBCONTRACTOR. THE

CONTRACTOR/SUBCONTRACTOR MUST TAKE APPROPRIATE AND TIMELY ACTION (THIS

CAN BE SPECIFIED IN THE CONTRACT) TO CORRECT OR MITIGATE ANY WEAKNESSES

DISCOVERED DURING SUCH TESTING, GENERALLY AT NO ADDITIONAL COST.

7.4.7 VA PROHIBITS THE INSTALLATION AND USE OF PERSONALLY OWNED OR

CONTRACTOR/SUBCONTRACTOR OWNED EQUIPMENT OR SOFTWARE ON VA’S

NETWORK. IF NON-VA OWNED EQUIPMENT MUST BE USED TO FULFILL THE

REQUIREMENTS OF A CONTRACT, IT MUST BE STATED IN THE SERVICE AGREEMENT,

SOW OR CONTRACT. ALL OF THE SECURITY CONTROLS REQUIRED FOR GOVERNMENT

FURNISHED EQUIPMENT (GFE) MUST BE UTILIZED IN APPROVED OTHER EQUIPMENT (OE)

AND MUST BE FUNDED BY THE OWNER OF THE EQUIPMENT. ALL REMOTE SYSTEMS

MUST BE EQUIPPED WITH, AND USE, A VA-APPROVED ANTIVIRUS (AV) SOFTWARE AND

A PERSONAL (HOST-BASED OR ENCLAVE BASED) FIREWALL THAT IS CONFIGURED WITH

A VA APPROVED CONFIGURATION. SOFTWARE MUST BE KEPT CURRENT, INCLUDING

ALL CRITICAL UPDATES AND PATCHES. OWNERS OF APPROVED OE ARE RESPONSIBLE

FOR PROVIDING AND MAINTAINING THE ANTI-VIRAL SOFTWARE AND THE FIREWALL

ON THE NON-VA OWNED OE.

7.4.8 ALL ELECTRONIC STORAGE MEDIA USED ON NON-VA LEASED OR NON-VA

OWNED IT EQUIPMENT THAT IS USED TO STORE, PROCESS, OR ACCESS VA

INFORMATION MUST BE HANDLED IN ADHERENCE WITH VA HANDBOOK 6500.1,

ELECTRONIC MEDIA SANITIZATION UPON: (I) COMPLETION OR TERMINATION OF THE

CONTRACT OR (II) DISPOSAL OR RETURN OF THE IT EQUIPMENT BY THE

CONTRACTOR/SUBCONTRACTOR OR ANY PERSON ACTING ON BEHALF OF THE

CONTRACTOR/SUBCONTRACTOR, WHICHEVER IS EARLIER. MEDIA (HARD DRIVES,

OPTICAL DISKS, CDS, BACK-UP TAPES, ETC.) USED BY THE

CONTRACTORS/SUBCONTRACTORS THAT CONTAIN VA INFORMATION MUST BE

RETURNED TO THE VA FOR SANITIZATION OR DESTRUCTION OR THE

CONTRACTOR/SUBCONTRACTOR MUST SELF-CERTIFY THAT THE MEDIA HAS BEEN

DISPOSED OF PER 6500.1 REQUIREMENTS. THIS MUST BE COMPLETED WITHIN 30 DAYS

OF TERMINATION OF THE CONTRACT.

7.4.9 BIO-MEDICAL DEVICES AND OTHER EQUIPMENT OR SYSTEMS CONTAINING

MEDIA (HARD DRIVES, OPTICAL DISKS, ETC.) WITH VA SENSITIVE INFORMATION MUST

NOT BE RETURNED TO THE VENDOR AT THE END OF LEASE, FOR TRADE-IN, OR OTHER

PURPOSES. THE OPTIONS ARE:

(1) VENDOR MUST ACCEPT THE SYSTEM WITHOUT THE DRIVE;

(2) VA’S INITIAL MEDICAL DEVICE PURCHASE INCLUDES A SPARE DRIVE WHICH MUST

BE INSTALLED IN PLACE OF THE ORIGINAL DRIVE AT TIME OF TURN-IN; OR

(3) VA MUST REIMBURSE THE COMPANY FOR MEDIA AT A REASONABLE OPEN MARKET

REPLACEMENT COST AT TIME OF PURCHASE.

(4) DUE TO THE HIGHLY SPECIALIZED AND SOMETIMES PROPRIETARY HARDWARE AND

SOFTWARE ASSOCIATED WITH MEDICAL EQUIPMENT/SYSTEMS, IF IT IS NOT POSSIBLE

FOR THE VA TO RETAIN THE HARD DRIVE, THEN;

(A) THE EQUIPMENT VENDOR MUST HAVE AN EXISTING BAA IF THE DEVICE BEING

TRADED IN HAS SENSITIVE INFORMATION STORED ON IT AND HARD DRIVE(S) FROM THE

SYSTEM ARE BEING RETURNED PHYSICALLY INTACT; AND

(B) ANY FIXED HARD DRIVE ON THE DEVICE MUST BE NON-DESTRUCTIVELY SANITIZED

TO THE GREATEST EXTENT POSSIBLE WITHOUT NEGATIVELY IMPACTING SYSTEM

OPERATION. SELECTIVE CLEARING DOWN TO PATIENT DATA FOLDER LEVEL IS

RECOMMENDED USING VA APPROVED AND VALIDATED OVERWRITING

TECHNOLOGIES/METHODS/TOOLS. APPLICABLE MEDIA SANITIZATION SPECIFICATIONS

NEED TO BE PREAPPROVED AND DESCRIBED IN THE PURCHASE ORDER OR CONTRACT.

(C) A STATEMENT NEEDS TO BE SIGNED BY THE DIRECTOR (SYSTEM OWNER) THAT

STATES THAT THE DRIVE COULD NOT BE REMOVED AND THAT (A) AND (B) CONTROLS

ABOVE ARE IN PLACE AND COMPLETED.

THE ISO NEEDS TO MAINTAIN THE DOCUMENTATION.

7.5. SECURITY INCIDENT INVESTIGATION

7.5.1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

7.5.2. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

7.5.3. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach.

Notifications need to be made in accordance with the executed business associate agreement.

7.5.4. In instances of theft or break-in or other criminal activity, , the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive. relief against any third party arising from, or related to, the incident.

7.6. LIQUIDATED DAMAGES FOR DATA BREACH

Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

7.6.1. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non- Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

7.6.2. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including: (a) date of occurrence; (b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

7.6.3. Based on the determinations of…