RFQ 1449 36C26326Q1078 Gastroscopes Colonoscopes Iowa City VA.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

636-26-4-4154-0263

36C26326Q1078 09-06-2026

Joseph Bennett 319-688-3633 09-15-2026

05:00 PM CDT

36C263

DEPARTMENT OF VETERANS AFFAIRS

NETWORK CONTRACTING OFFICE 23

1303 5TH STREET, SUITE 300

CORALVILLE IA 52241

X

334510

1250 Employees

N/A

X

36C368

Department of Veterans Affairs

Iowa City VA Health Care System

601 Highway 6 West

Iowa City IA 52246

36C263

NETWORK CONTRACTING OFFICE 23

1303 5TH STREET, SUITE 300

CORALVILLE IA 52241

FMS-VA-2(101)

FINANCIAL SERVICES CENTER

See CONTRACT ADMINISTRATION DATA below

See CONTINUATION Page

Request for Quote for Gastroscope and Colonoscope Systems for the Iowa City VA Healthcare System

See Instructions to Offers on page 3 below.

NOTE: Clause 52.212-5 does not apply. Ignore all references to it.

See CONTINUATION Page

636-3660160-4154-820100-3131-0400K1043

X X

Joseph Bennett

VA-VHA-RPOC-2024-0088

36C26326Q1078

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 INSTRUCTIONS TO OFFERORS

B.2 CONTRACT ADMINISTRATION DATA

B.3 STATEMENT OF WORK

B.4 VA INFORMATION AND INFORMATION SYSTEM SECURITY AND PRIVACY

LANGUAGE

B.5 RECORDS MANAGEMENT OBLIGATIONS

B.6 PRICE/COST SCHEDULE

B.7 DELIVERY SCHEDULE

SECTION C - CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES (OCT 2025) (DEVIATION)

C.2 52.222-40 NOTIFICATION OF EMPLOYEE RIGHTS UNDER THE NATIONAL

LABOR RELATIONS ACT (NOV 2025) (DEVIATION)

C.3 52.222-90 ADDRESSING DEI DISCRIMINATION BY FEDERAL CONTRACTORS

(DEVIATION APR 2026)

C.4 52.240-91 SECURITY PROHIBITIONS AND EXCLUSIONS (NOV 2025)

(DEVIATION)

C.5 VAAR 852.211-76 LIQUIDATED DAMAGES - REIMBURSEMENT FOR DATA

BREACH COSTS (FEB 2023)

C.6 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (OCT 2025) (DEVIATION)

E.2 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

E.3 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.4 52.240-90 SECURITY PROHIBITIONS AND EXCLUSIONS REPRESENTATIONS

AND CERTIFICATIONS (NOV 2025) (DEVIATION)

E.5 VAAR 852.233-71 ALTERNATE PROTEST PROCEDURE (OCT 2018)

E.6 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.7 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (OCT 2025) (DEVIATION)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 INSTRUCTIONS TO OFFERORS

All Instructions to Offerors added by the CO in addition to the standard 52.212-1 INSTRUCTIONS TO OFFERORS are here on this page. Read this entire page.

This solicitation is issued under Revolutionary FAR Overhaul, FAR 12 Simplified Acquisitions.

This RFQ is Unrestricted.

The Government intends to award without Discussions.

The Contract will be a Single Award, Firm Fixed Price, Purchase Order.

Offerors are required to be registered in SAM when submitting a quote and at time of award.

Late offers will be treated according to RFO 52.212-1.

The Government intends to evaluate all line items on a group basis and make a single award for

BAA/TAA applicability.

TRADE AGREEMENT CERTIFICATE.

This RFQ includes RFO Clause 52.225-5 Trade Agreements (Nov 2023).

The Trade Agreements Certificate, 52.225-6 is attached. It must be completed and signed at the very bottom and included with offer.

Instructions:

a) List all supplies that are NOT manufactured/final assembled or “substantially changed” in the United States or a Trade Agreement Compliant Country in the table in paragraph (b) “Other End Products” of the Trade Agreement Certificate.

b) A company representative with the authority to do so shall: complete name, signature and date at the bottom. See yellow highlights.

HIPPA – BUSINESS ASSOCIATE AGREEMENT:

Does your firm have a completed Business Associate Agreement with the National VA or with the local Iowa City VA Healthcare System? If yes, include a copy with your offer. If not, a local Business Associate Agreement will be required. A copy is attached for your firm to review. It does not have to be completed and returned unless an award is made to your firm. Submission of an offer indicates your firm’s willingness to enter into a Business Associate with the VA at the point of award.

OFFER SHALL INCLUDE THE FOLLOWING:

In addition to providing information about your scope systems, their technology, their performance and capabilities, include the following information:

• Does your firm have a completed an Enterprise Risk Assessment (ERA) with the VA? Provide the ID number and date it was completed. You may be asked to provide a copy.

• Support. Describe how your firm supports the equipment and VA staff. Include scope replacements, repairs, loaners. Include how long it takes to receive a replacement/loaner scope and the process. Include any training/in-services your firm intends to include. Include how a request for replacement/loaner is made. Include how your firm provides updates to software/platforms. Include how your firm addresses networking/integration issues.

• The VA Gastroenterology Departments (Also called Gastro-intestinal or GI for short) are mandated to use Provation. All offers must be compatible with and interface seamlessly with Provation. Describe your proposed system’s ability to interface/network with Provation.

• Sterilization. Describe how your equipment is disinfected and sterilized. Include all processes and procedures the VA will need to use to disinfect and sterilize your proposed equipment.

Include all chemicals required.

• Delivery. Describe lead time for equipment to be delivered once an order is placed. Though your firm will be required to coordinate delivery and installation per the Statement of Work, include a brief description of how your firm generally manages delivery and installation. Include storage needs, general timeline and phases, and how your firm validates the equipment is working properly before moving to the next phase or part of the project.

TRAINING COURSES REQUIRED UPON AWARD:

If an award is made to your firm, there are VA INFORMATION SECURITY AND PRIVACY training courses required. They are described in Section B ???? page ????. Submission of an offer indicates your firm’s willingness to have representatives/technicians complete these courses upon award.

SUBMISSION OF OFFERS:

All offers shall be received by the CO no later than 05:00 PM CT Tuesday September 15, 2026.

All offers shall be emailed to Joseph.Bennett@va.gov All Emails/correspondence shall include this RFQ number in the Subject Line: 36C26326Q1078.

DELIVERY:

Delivery is FOB Destination.

Installation is described in the Statement of Work.

Delivery within 60 days of award or propose your earliest date.

B.2 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: NCO 23 Contracting Officer Department of Veterans Affairs Network 23 Contracting Office 1303 5th St. Suite 300 Coralville, IA 52241

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[ ] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

[ ] a. Quarterly [ ] b. Semi-Annually [ X ] c. Other: Within 30 days of Receipt and Acceptance mailto:Joseph.Bennett@va.gov

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

In order to comply with the Improper Payment Elimination and Recovery Act of 2010 (IPERA), the VA has mandated electronic invoice submission to the Veterans Affairs Financial Services Center (FSC).

The VA Financial Service Center(FSC) has partnered with third-party contractor, Tungsten, to transition vendors from paper to electronic invoice submission. Please go to this website:

http://www.tungsten-network.com/US/en/veterans-affairs/ to begin submitting electronic invoices, free of charge.

Vendor e-Invoice Set-Up Information:

Please contact the phone numbers or email address listed below to begin submitting your electronic invoices to the VA Financial Services Center for payment processing, free of charge. If you have question about the e-invoicing program or Tungsten, please contact the FSC at the phone number or email address listed below:

Tungsten e-Invoice set-up information: 877-489-6135 Tungsten e-Invoice email: VA.Registration@Tungsten-Network.com FSC e-Invoice Contact Information: 877-353-9791 FSC e-Invoice email: vafsccshd@va.gov More information on the FSC electronic invoicing process can be found at http://www.fsc.va.gov/einvoice.asp.

FAR and VAAR Causes may be accessed at these links:

https://www.acquisition.gov/browsefar https://www.va.gov/oal/library/vaar/

5. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

http://www.fsc.va.gov/einvoice.asp https://www.acquisition.gov/browsefar https://www.va.gov/oal/library/vaar/

B.3 STATEMENT OF WORK

SCOPE

The Iowa City VA Healthcare System (ICVAHCS) Gastroenterology Department has a requirement to refresh their upper and lower GI Endoscope Systems. The requirement is for fully functional upper and lower GI scope systems comprised of the most recent models and the latest generation of technology.

Contractor shall furnish and facilitate all labor, transportation, parts, test equipment, tools, travel, supervision, and expertise necessary to deliver and perform this contract. All components to make this system fully functional shall be included. This includes software, licensing, troubleshooting, testing, and training and support.

PERIOD OF PERFORMANCE:

90 days After Receipt of Order (ARO), or propose your firm’s best expedited timeline.

TYPE OF CONTRACT

This is a Firm-Fixed-Priced, one-time supply contract with no option year(s).

POINT-OF-CONTACT (POC)

This contract is assigned to a POC/s who will provide general instructions for delivery and installation. The POC is not authorized to grant permission(s) to change the scope of the project. The POC that is assigned to this contract will ensure that the supplies/services provided by this company are received based on the contractual terms and conditions. The POC/s will be named in the award letter.

SERVICES TO BE PROVIDED:

Vendor/Contractor will provide the necessary manpower, supervision, tools, software, hardware, transportation, parts, test equipment, expertise necessary to properly install their equipment including software licensing, digital keys, peripherals, and associated interfaces alongside

Biomed department.

Vendor/Contractor will provide the necessary manpower, supervision, tools, software, hardware, transportation, parts, test equipment, expertise and peripheries necessary to properly test the equipment for full functionality.

Vendor/Contractor will assist Biomed with migrating old data from previous units to new units if necessary.

Vendor/Contractor will provide all training required to operate software/hardware/equipment by staff/clinicians/providers and residents.

Vendor/Contractor will provide all training required to operate software/hardware/equipment to

Biomed department and Sterilization Department.

Upon completion of any work on equipment, thorough testing shall be completed and approved by the VA before acceptance is granted.

a. Warranty Requirements

Manufacturer’s Warranty.

b. Installation

Installation is required by the Contractor. Contractor will contact the Point-of-Contact and schedule with the Biomed department to schedule dates/times for installation within seven (7) business days from award.

The vendor shall deliver materials to the job site in original equipment manufacturer (OEM) original unopened containers, clearly labeled with the OEM’s name, equipment model and serial identification numbers, delivery order number, and VA purchase order number for ease of taking inventory of what is received and not requiring packages to be opened to receive them.

All on-site installation services shall be vendor-provided by technical staff, fully trained to service and install products, parts, and accessories as specified.

The vendor will be responsible for moving waste materials from job site(s).

The vendor shall provide the following documentation:

Hard and soft copy of operator’s manual Hard and soft copy of technical service manuals including troubleshooting guides, necessary diagnostic software and equipment, schematic diagrams, and parts lists Hard and soft copy of cleaning, sterilization, and reprocessing procedures

c. Training Requirements

The vendor shall provide technical training to ensure Biomed staff at the facility have the ability to support the equipment at an equivalent level of a vendor-provided fully trained service technician.

All costs and expenses for the contractor to provide the following technical training required shall be included with purchase and cover up to one year.

The vendor shall provide technical training to ensure sterile processing services (SPS) staff at each facility have the ability to service and support equipment at an equivalent level of a vendor provided fully trained sterilization technician.

The vendor shall provide clinical end user training to ensure clinical staff can properly utilize and operate equipment. The training should provide staff the knowledge and skill set at an equivalent level of a vendor-provided fully trained clinical staff. This shall include training of residents as need for each class of residents.

Certified instructors must provide user training for staff on day, evening, and night shifts at times to be determined by the facility.

All staff to be trained within 2 weeks of install. Training must be flexible based on day, evening, night, and weekend shifts. All times to be determined by the facility.

d. ID Badges / Smoking / Weapons

BADGES: All Contractor personnel are required to wear identification (ID) badges during the entire time they are on the VA grounds. Contractor ID badges name of the individual and the represented company depicted on it. Contractors shall carry acceptable form of ID on their person at all times. VA badges will also need to be worn while on VA grounds and should be obtained through the VA Police Dispatch Center. All badges shall be worn in an obvious, easy to see, manner.

SMOKING: Smoking is not permitted within or around the VA Healthcare System facilities.

WEAPONS are not permitted on VA property.

DELIVERABLES OR DELIVERY SCHEDULE

The vendor shall deliver the equipment via standard delivery with F.O.B. destination as scheduled.

The vendor shall coordinate delivery and storage with the POC.

The equipment shall be delivered to the following address:

CHANGES TO CONTRACT

All changes shall have prior authorization from a VA Contract Officer in the form of a written modification.

CONDITION OF EQUIPMENT

Equipment shall be the firm’s most recent generation/version of the type of equipment required.

Refurbished equipment is acceptable provided that the equipment was refurbished by the OEM or an OEM certified service and is compliant with all applicable regulations and the FDA.

Refurbished equipment shall be identified and shall be supported and warrantied as if it were new equipment.

All equipment shall be FDA compliant and compliant with any other applicable regulations.

EQUIPMENT COMPLIANCE

Equipment/software/hardware must be compliant with:

• DICOM, HL7, Highland Midware, Provation.

• All VA network and system requirements.

• Must be FDA compliant.

ENTERPRISE RISK ASSESSMENT(ERA).

The awardee will have completed and ERA at the point of award. If an ERA has not been completed, an ERA will need to be completed withing 60 days of award. If the ERA cannot be completed with 60 days of award, the contract may be terminated.

OPERATING ROOM TECHNOLOGY

Offerors are also to propose equipment that can interface with the equipment in the OR as described here:

In the OR, images leave the Scope and travel to an Olympus Tower. Images then leave the Tower and travel to a Karl Storz Image Processor and monitor for viewing. Images then travel back to the Tower and then to Provation and then to the electronic health record management system.

Support Program to cover 1(one) year.

• Will be a separate line item on quote, broken down into components and sub-line-items to describe coverage.

• Program for scope replacement: Replacement, Loaners, Repairs. (describe in detail).

• Cost for shipping shall be built into program cost. Shipping labels provided to VA.

• 24–48-hour turn-around time for loaners, replacement scopes.

• Support Program shall be a Separate line item on quote and broken down into specifics.

• A 24 hour phone support.

Licenses

• All Licenses paid for shall cover the first year at a minimum.

• Will be a separate line/s item on quote.

Upgrades

• The latest version of all upgradeable software/digital platforms will be installed by final acceptance. All new upgrades that are published and become ready for install AFTER award will be covered by the cost of the contract at award and will be installed by final acceptance. The VA will not modify the contract to procure an upgrade that comes online after award and before final acceptance.

• All upgrades for the first year shall be included in the price of the quote.

Cloud Support and Vendor Servers

• The VA will not be obligated to move to the Cloud during the life of this equipment. All upgrades that would be handled via the “Cloud” shall be made in a manner that does not require the Cloud for the life of the equipment.

• Cloud support will only be authorized when the VA determines it can be used with proper security. Cloud support will not be used without authorization and approval by the VA and only after the proper risk analysis is performed.

• The same applies to vendor servers.

TECHNICAL SPECIFICATIONS

General Equipment Name: Olympus Gastroscopes and Colonoscopes.

A. Brand Name or Equal to the following descriptions:

Video System Center:

• Must have conventional white light for normal imaging.

• Must support multiple light modalities and visual enhancements such as Narrow

Band Imaging, Texture and Color enhancement Imaging, Red Dichromatic Imaging, Brightness Adjustment Imaging with Maintenance of Contrast.

• Must have texture and color enhancement imaging for brightness and color tone.

• Must be able to record images.

• Must have dual-focus optical lens capable of switching to near-focus during procedures.

• Analog signal output: VBS Composite.

• Digital signal outputs: 12G-SDI, 3G-SDI, HD-SDI, SD-SDI.

• Must be capable of storing multiple different user profiles.

• Patient data display must include patient ID, name, gender, age, DOB, and any comments from previous procedures.

Video Colonoscopes:

• Must have dual focus allowing to switch between normal and near focus during procedures.

• Must support multiple light modalities and visual enhancements such as Narrow Band Imaging, Texture and Color enhancement Imaging, Red Dichromatic Imaging, Brightness Adjustment Imaging with Maintenance of

• Contrast.

• Normal focus Field of View (FOV) consistent with commercial medical practice.

• Near focus FOV must be consistent with commercial medical practice.

• Direction of view must be forward viewing.

• Normal focus depth of field must be between… consistent with commercial medical practice.

• Near focus depth of field must be between… consistent with commercial medical practice.

• Distal end outer diameter consistent with commercial medical practice.

• Insertion tube outer diameter consistent with commercial medical practice.

• Total length consistent with commercial medical practice.

• Instrument channel inner diameter of… consistent with commercial medical practice.

• Degrees of up/down angulation consistent with commercial medical practice.

• Degrees right/left angulation consistent with commercial medical practice.

Slim Colonoscopes:

• Normal focus FOV must be consistent with commercial medical practice

• Near focus FOV must be consistent with commercial medical practice

• Direction of view must be forward viewing.

• Normal focus depth of view must be between… consistent with commercial medical practice

• Near focus depth of view must be between… consistent with commercial medical practice

• Minimum visible distance must be 3mm from the distal end or consistent with commercial medical practice

• Must have dual focus allowing to switch between normal and near focus during procedures.

• Must have real-time 3D visualization of scope configuration during insertion.

• Distal end outer diameter 11.8mm – slim profile designed for pediatric/diagnostic use or consistent with commercial medical practice.

• Insertion tube outer diameter consistent with commercial medical practice.

• Working length real-time 3D visualization of scope configuration during insertion

• Total length consistent with commercial medical practice.

• Instrument channel inner diameter of 3.2mm or consistent with commercial medical practice.

• Degrees up/down angulation consistent with commercial medical practice.

• Degrees right/left angulation consistent with commercial medical practice.

• Must have water jet ability to clean the lens without withdrawing the scope during

Gastrointestinal Videoscopes:

• FOV must be 140 degrees for normal focus and near focus or consistent with commercial medical practice.

• Direction of view must be forward viewing.

• Normal focus depth of view must be between… consistent with commercial medical practice.

• Near focus depth of view must be between… consistent with commercial medical practice.

• Minimum visible distance must be 3mm from the distal end or consistent with commercial medical practice.

• Must have dual focus allowing to switch between normal and near focus during procedures.

• Must support multiple light modalities and visual enhancements such as Narrow Band Imaging, Texture and Color enhancement Imaging, Red Dichromatic Imaging, Brightness Adjustment Imaging with Maintenance of Contrast.

• Working length consistent with commercial medical practice.

• Distal end outer diameter 9.9mm or consistent with commercial medical practice.

• Insertion tube outer diameter 9.6mm or consistent with commercial medical practice.

• Instrument channel inner diameter of 2.8mm to accommodate biopsy tools consistent with commercial medical practice.

• Degrees up angulation consistent with commercial medical practice.

• Degrees down angulation consistent with commercial medical practice.

• Degrees right/left angulation consistent with commercial medical practice.

• Must have water jet ability to clean the lens without withdrawing the scope during

B. Brand-Name or Equal to the following Olympus Line Items.

NOTE: The offeror is not required to match equipment line by line for this Brand-Name or Equal. Offerors are to provide the most equivalent/comparable components/systems to match the system that the VA requires.

• (5 each) CV-1500 VIDEO SYSTEM CENTER

• (22 each) Flexible Video Colonoscope CF-EZ1500DL

• (10 each) SLIM COLONOSCOPE W/ DUAL FOCUS NBI, PCF-HQ190L

• (1 each) SLIM COLONOSCOPE PCF-H190TL SLIM COLONO SH BEND RETROFLEX

• (18 each) Gastrointestinal Videoscope, GIF-EZ1500

• (6 each) Gastroscope GIF-XP190N ULTRA-SLIM SCOPE, 4-WAY, NBI

• (2 each) Duodenoscope TJF-Q190V (US)

• (1 each) GIF-1TH190 GIF-1TH190 EVIS EXERA III HIG

• (1 each) UHD 4K 32-INCH MONITOR, OEV321UH

• (6 each) Provation Trigger Cable 10ft

• (4 each) Provation p-emulator trigr cable

• (6 each) HDP3 MINI CONVERTER

• (6 each) 3GDA MINI-CONVERTER

• (12 each) AJA MEDICAL GRADE PSU - 5VDC, 5

• (6 each) K7505088 IEC TO JAPANESE/USA SOCKET ADA

• (5 each) MAJ-1945 DVI CABLE 3M

• (12 each) 12G-SDI CABLE 1.5M

B.4 VA INFORMATION AND INFORMATION SYSTEM SECURITY AND

PRIVACY LANGUAGE

NOTE: For Contracts that do not have an assigned COR, the term COR shall be replaced with

VA POC (VA Person of Contact).

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is

FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define

Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and

VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and V VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability

Office (GAO) staff during periodic control assessments, audits, or investigations.

The contractor may only use VA information within the terms of the contract and applicable

Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive

6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate

Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using

VA-approved encryption tools which are, at a minimum, Federal Information Processing

Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements.

The contractor shall transmit VA sensitive information using VA approved Transport Layer

Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and

Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer to all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by

Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38

U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer to such court order or other requests to the

VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and

Access Management (IAM) Security processes specified in the VA Information Security

Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with

National Archives and Records Administration (NARA) requirements as outlined in VA Directive

6300, Records and Information Management, VA Handbook 6300.1, Records Management

Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal

Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the

Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the

COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rules of Behavior

(ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and

Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security

Clearance shall be processed through the Special Security Officer located in HRA/OSP.

Contractors shall conform to all requirements stated in the National Industrial Security Program

Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-

71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR /CO in writing prior to access being granted.

e. The contractor shall notify the COR /CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company- owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United

States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing

Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA access will return VA- issued property to VA. This property includes, but is not limited to: documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

4. TRAINING. This entire section applies to all acquisitions which include section 3.

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course

(Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role- based information security training].

Additional training required: TMS #10203 HIPAA

b. The contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

5. SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The contractor, subcontractor, their employees, or business associates shall immediately

(within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise

Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to

VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA was believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA

Information Systems VA Information Security Program, and VA Information Security Knowledge

Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving

Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach involving any VA sensitive personal information the contractor/subcontractor processes or maintains under the contract;

the contractor shall pay liquidated damages to the VA as set forth in clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs.

6. INFORMATION SYSTEM DESIGN AND DEVELOPMENT. This entire section applies to information systems, systems, major applications, minor applications, enclaves, and platform information technologies (to include the subcomponents of each) designed or developed for or on behalf of VA by any non-VA entity.

a. Information systems designed or developed on behalf of VA at non-VA facilities shall comply with all applicable Federal law, regulations, and VA policies. This includes standards for the protection of electronic Protected Health Information (PHI), outlined in 45 C.F.R. Part 164, Subpart C and information and system security categorization level designations in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information

Systems and FIPS 200, Minimum Security Requirements for Federal Information Systems.

Baseline security controls shall be implemented commensurate with the FIPS 199 system security categorization (reference VA Handbook 6500 and VA Trusted Internet Connections

(TIC) Architecture).

b. Contracted new developments require creation, testing, evaluation, and authorization in compliance with VA Assessment and Authorization (A&A) processes in VA Handbook 6500 and

VA Information Security Knowledge Service to obtain an Authority to Operate (ATO). VA

Directive 6517, Risk Management Framework for Cloud Computing Services, provides the security and privacy requirements for cloud environments.

c. VA IT contractors, subcontractors and third-party service providers shall address and/or integrate applicable VA Handbook 6500, VA Handbook 6517, Risk Management Framework for

Cloud Computing Services and Information Security Knowledge Service specifications in delivered IT systems/solutions, products and/or services. If systems/solutions, products and/or services do not directly match VA security requirements, the contractor shall work though the

COR/CO to identify the VA organization responsible for governance or resolution. Contractors shall comply with FAR 39.1, specifically the prohibitions referenced.

d. The contractor (including producers and resellers) shall comply with Office of Management and Budget (OMB) M-22-18 and M-23-16 when using third-party software on VA information systems or otherwise affecting the VA information. This includes new software purchases and software renewals for software developed or modified by major version change after the issuance date of M-22-18 (September 14, 2022). The term “software” includes firmware, operating systems, applications and application services (e.g., cloud-based software), as well as products containing software. The contractor shall provide a self-attestation that secure software development practices are utilized as outlined by Executive Order (EO)14028 and NIST

Guidance. A third-party assessment provided by either a certified Federal Risk and

Authorization Management Program (FedRAMP) Third Party Assessor Organization (3PAO) or one approved by the agency will be acceptable in lieu of a software producer's self-attestation.

e. The contractor shall ensure all delivered applications, systems and information systems are compliant with Homeland Security Presidential Directive (HSPD) 12 and VA Identity and Access management (IAM) enterprise identity management requirements as set forth in OMB M-19-17, M-05-24, FIPS 201-3, Personal Identity Verification (PIV) of Federal Employees and Contractors

(or its successor), M-21-31 and supporting NIST guidance. This applies to Commercial Off-The-

Shelf (COTS) product(s) that the contractor did not develop, all software configurations and all customizations.

f. The contractor shall ensure all contractor delivered applications and systems provide user authentication services compliant with VA Handbook 6500, VA Information Security Knowledge

Service, IAM enterprise requirements and NIST 800-63, Digital Identity Guidelines, for direct, assertion-based authentication and/or trust-based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key

Infrastructure (PKI) based authentication supportive of PIV and/or Common Access Card

(CAC), as determined by the business need and compliance with VA Information Security

Knowledge Service specifications.

g. The contractor shall use VA authorized technical security baseline configurations and certify to the COR that applications are fully functional and operate correctly as intended on systems in compliance with VA baselines prior to acceptance or connection into an authorized VA computing environment. If the Defense Information Systems Agency (DISA) has created a

Security Technical Implementation Guide (STIG) for the technology, the contractor may configure to comply with that STIG. If VA determines a new or updated VA configuration baseline needs to be created, the contractor shall provide required technical support to develop the configuration settings.