RFQ 36C25721Q0396.pdf

PAGE 1 OF1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. DUNS: DUNS+4:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 44

36C25721Q0396 02-08-2021

Delphia Schoenfeld 210-694-6336 02-19-2021

11:00 EST

Department of Veterans Affairs Network Contracting Office 17 (NCO 17) 5441 Babcock Rd. Ste 302 San Antonio TX 78240

X

621511

$35 Million

N/A

X

Department of Veterans Affairs South Texas Veterans Healthcare System Laboratory 7400 Merton Minter Blvd.

San Antonio TX 78229-4401

Department of Veterans Affairs Network Contracting Office 17 (NCO 17) 5441 Babcock Rd. Ste 302 San Antonio TX 78240

This is accomplished through the Tungsten Network located at:

http://www.fsc.va.gov/einvoice.asp This is mandatory and the sole method for submitting invoices.

(877) 353-9791 (512) 460-5540

See CONTINUATION Page

See Continuation Pages for detailed information.

See CONTINUATION Page

X X

X 1

Vance Wayne Farrell Contracting Officer

36C25721Q0396

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 STATEMENT OF WORK

B.3 PRICE/COST SCHEDULE

ITEM INFORMATION

B.4 DELIVERY SCHEDULE

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS (JUN 2016) .16 C.3 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE

ORDERS—COMMERCIAL ITEMS (NOV 2020)

C.4 52.216-18 ORDERING (AUG 2020)

C.5 52.216-19 ORDER LIMITATIONS (OCT 1995)

C.6 52.216-22 INDEFINITE QUANTITY (OCT 1995)

C.7 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.8 52.222-49 SERVICE CONTRACT LABOR STANDARDS—PLACE OF PERFORMANCE UNKNOWN (MAY

2014)

C.9 52.232-19 AVAILABILITY OF FUNDS FOR THE NEXT FISCAL YEAR (APR 1984)

C.10 VAAR 852.212-70 PROVISIONS AND CLAUSES APPLICABLE TO VA ACQUISITION OF COMMERCIAL

ITEMS (APR 2020)

C.11 VAAR 852.219-71 VA MENTOR-PROTÉGÉ PROGRAM (DEC 2009)

C.12 VAAR 852.219-72 EVALUATION FACTOR FOR PARTICIPATION IN THE VA MENTOR-PROTÉGÉ

PROGRAM (DEC 2009)

C.13 VAAR 852.219-76 SUBCONTRACTING PLANS MONITORING AND COMPLIANCE (JUL 2018)

C.14 VAAR 852.223-71 SAFETY AND HEALTH (SEP 2019)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

E.2 INSTRUCTIONS TO OFFERORS

E.3 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT (OCT 2020)

E.4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

E.5 52.212-2 EVALUATION—COMMERCIAL ITEMS (OCT 2014)

E.6 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—COMMERCIAL ITEMS (NOV 2020)

E.7 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.8 52.237-1 SITE VISIT (APR 1984)

E.9 VAAR 852.215-72 NOTICE OF INTENT TO RE-SOLICIT (OCT 2019)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C257 Department of Veterans Affairs Network Contracting Office 17 (NCO 17) 5441 Babcock Rd. Ste 302 San Antonio TX 78240

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or [] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Monthly

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

This is accomplished through the Tungsten Network located at:

http://www.fsc.va.gov/einvoice.asp This is mandatory and the sole method for submitting invoices.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 STATEMENT OF WORK

The STVHCS has a need for Specialized Genetic Laboratory Testing for the South Texas Veterans Health Care System (STVHCS), Audie L. Murphy Division located at 7400 Merton Minter Blvd., San Antonio, TX 78229-4404.

STATEMENT OF WORK: Contractor agrees to furnish all personnel, labor, transportation, equipment, materials and supplies necessary to provide Laboratory Fee Basis Testing and guidance in Exome & General Genetics, Oncology, Cardiology, Neurology and Pathology as specified herein for eligible VA beneficiaries of the South Texas Veterans Health Care System, Audie L. Murphy Division located at 7400 Merton Minter Blvd., San Antonio, TX 78229-4404.

At minimum the contractor must provide a menu of the following listed tests and provide the below listed requirements in-house (No substitutions):

Estimated Qty Test Code Test Description Genes TAT 120 8838 BRCA 1 &2 seq and del/dup

BRCA1, BRCA2 6-10

Days 10 8836 BRCA Plus ATM, BRCA1, BRCA2, CDH1, CHEK2, PALB2, PTEN, TP53

7-10 Days

10 8860 BRCA Expanded BARD1, BRIP1, NBN, NF1,RAD51C,RAD51D,ATM, PALB2, CHEK2,STK11, CHD1,BRCA1,BRCA2, PTEN,TP53,MLH1,MSH2,MSH6,PMS2,EPCAM, SMARCA4

14-21 Days

150 8824 Cancer Next APC, ATM, BARD1, BMPR1A, BRCA1, BRCA2, 14-21

BRIP1, CDH1, CDK4, CDKN2A, CHEK2, DICER1,

EPCAM, GREM1, HOXB13, MLH1, MRE11A, MSH2,

MSH6, MUTYH, NBN, NF1, PALB2, PMS2, POLD1,

POLE, PTEN, RAD50, RAD51C, RAD51D, SMAD4,

SMARCA4, STK11, TP53

Days

20 8822 Colo Next APC, BMPR1A, CDH1, CHEK2, EPCAM, GREM1, MLH1, MSH2, MSH6, MUTYH, PMS2, POLD1, POLE, PTEN, SMAD4, STK11, TP53

14-21 Days

10 8511 Lynch MLH del/dup analysis 6-10 Days

20 9510 Customized Panel (Various tests)

AIP, ALK, APC, ATM, AXIN2, BAP1, BARD1, BLM,

BMPR1A, BRCA1, BRCA2, BRIP1, CASR, CDC73,

CDH1, CDK4, CDKN1B, CDKN2A, CFTR, CHEK2,

CPA1, CTNNA1, CTRC, DICER1, EGFR, EPCAM,

FANCC, FH, FLCN, GALNT12, GREM1, HOXB13,

KIT, MAX, MEN1, MET, MITF, MLH1, MRE11A,

MSH2, MSH3, MSH6, MUTYH, NBN, NF1, NF2,

NTHL1, PALB2, PDGFRA, PHOX2B, PMS2, POLD1,

POLE, POT1, PRKAR1A, PRSS1, PTCH1, PTEN,

RAD50, RAD51C, RAD51D, RB1, RET, SDHA,

SDHAF2, SDHB, SDHC, SDHD, SMAD4, SMARCA4,

SMARCB1, SMARCE1, SPINK1, STK11, SUFU,

TMEM127, TP53, TSC1, TSC2, VHL, XRCC2

14-21 Days

10 8726 Adenomatous Polyposis

APC

MUTYH

14-21 Days

20 8835 GYN Plus BRCA1, BRCA2, BRIP1, EPCAM, MLH1, MSH2, MSH6, PALB2, PMS2, PTEN, RAD51C, RAD51D, TP53

14-21 Days

100 8830 Ova Next ATM, BARD1, BRCA1, BRCA2, BRIP1, CDH1, CHEK2, DICER1, EPCAM, MLH1, MRE11A, MSH2, MSH6, MUTYH, NBN, NF1, PALB2, PMS2, PTEN, RAD50, RAD51C, RAD51D, SMARCA4, STK11, TP53

14-21 Days

50 8820 Breast Next ATM, BARD1, BRCA1, BRCA2, BRIP1, CDH1, CHEK2, MRE11A, MUTYH, NBN, NF1, PALB2, PTEN, RAD50, RAD51C, RAD51D, TP53

14-21 Days

20 8874 Cancer Next Expanded AIP, ALK, APC, ATM, BAP1, BARD1, BLM, BMPR1A, BRCA1, BRCA2, BRIP1, CDH1, CDK4, CDKN1B, CDKN2A, CHEK2, DICER1, EPCAM, FANCC, FH, FLCN, GALNT12, GREM1, HOXB13, MAX, MEN1, MET, MITF, MLH1, MRE11A, MSH2, MSH6, MUTYH, NBN, NF1, NF2, PALB2, PHOX2B, PMS2, POLD1, POLE, POT1, PRKAR1A, PTCH1, PTEN, RAD50, RAD51C, RAD51D, RB1, RET, SDHA, SDHAF2, SDHB, SDHC, SDHD, SMAD4, SMARCA4, SMARCB1, SMARCE1, STK11, SUFU, TMEM127, TP53, TSC1, TSC2, VHL, XRCC2

14-21 Days

10 8042 Panc Next ATM, PALB2, STK11, BRCA1, BRCA2, TP53,MLH1, MSH2, MSH6,PMS2,EPCAM,APC,CDKN2A

14-21 Days

1. The Reference Laboratory selected is required to be fully licensed, accredited and inspected by the Laboratory Accreditation of an accrediting agency to include; College of American Pathologists (CAP) with deemed status from the Center for Medicare and Medicaid Services, Center for Disease Control and any other state regulatory agencies as mandated by Federal and State Statutes. The Laboratory is required to be certified by the Joint Commission, American Associates of Blood Banks (AABB) as applicable. The

Clinical Laboratory shall meet all requirements set forth by the Clinical Laboratory Improvement Act (CLIA) of 1988 and comply with the National Standards to Protect the Privacy of Personal Health Information (HIPPA). In addition, contractor must meet all requirement outlined in VHA Handbook 1106.1 These above listed requirements must be met upon the date of Solicitation.

2. The Contractor shall provide timely (defined by the minimum and maximum turnaround times detailed in the description of requirements) and appropriate testing of patient specimens as requested by STVHCS facilities.

3. Each STVHCS facility will provide laboratory specimens properly collected identified with both the Patient’s Identification (as utilized by each facility) and requested tests. For those specimens that require special handling, the Contractor shall provide at no additional charge an adequate supply of specimen collection materials for such testing that is destined to the commercial reference laboratory for analysis (i.e. dry ice, stabilizing tablets, ice packets, 24-hour collection container with preservatives, special collection tubes, etc.).

4. Each test report shall at minimum indicate the following information:

a. Patient's name and/or identification number

b. Physician's name (if supplied)

c. VISN 17 medical record number or laboratory accession number (if supplied)

d. VISN 17 submitting facility name

e. Patient's location (clinic/ward) (if supplied)

f. Test ordered

g. Date/time of specimen collection (when available)

h. Date/time test completed

i. Test result

j. Reference intervals

k. Toxic and therapeutic ranges, if applicable

l. Flagged abnormal test results

m. Reference laboratory specimen number

n. Name of testing laboratory, if other than Contractor

o. Any other information the laboratory has that may indicate a questionable validity of test results

p. Unsatisfactory specimen shall be reported with documentation supporting its unsuitability for testing

q. Contractor shall provide daily, by 12:00 PM, a report listing all incomplete specimens and their processing status.

r. Contractor shall provide monthly, a Utilization report that lists all tests and costs for the previous month by the 10th of each month.

5. The Contractor shall store the specimens a minimum of seven (7) to ten (10) days after the test is reported in the event that subsequent action is necessary (i.e. problem solving, add-on test, and/or repeat testing). The Contractor shall state their specimen retention time.

6. Laboratory requests with Patient Demographics will be entered into the VA Decentralized Hospital Computer Program (DHCP) by the VA Processing Section. Specimens will be picked up daily by the Contractor for further processing.

7. Once laboratory requests with Patient Demographics for identification purposes are processed by the Contractor, the results will be returned to the VA Processing Section via secure fax or secure computer workstation for entering results in DHCP by VA personnel. Information will then be made electronically available to the clinicians by VA personnel.

8. Laboratory procedures that have not been assigned a log number will not be paid by the STVHCS or performed by the Contractor.

INVOICING: Payment to be made monthly in arrears by certified invoices and must contain the contract number and obligation number in addition to the requirements detailed in 52.212-4 (G) to be considered valid. Invoices shall also contain a line item for each test and quantities billed for and the Dates of Service the invoice pertain to.

STVHCS will not pay for tests that are not clearly identified by accession number on the Contractors invoice.

WORK HOURS: Contractor shall be responsible for providing services in between the hours of 8:00am and 4:30pm Monday through Friday excluding Federal Holidays. Federal Holidays are as follows:

New Year’s Day, Martin Luther King’s Birthday, President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, Christmas Day and any other day specifically designated as a national holiday by the President of the United States.

CONTRACTING OFFICER REPRESENTATIVE: The Contracting Officer Representative (COR) is identified as the Administrative Officer for Pathology and Laboratory Medicine Service. Prior to contract award, the Contracting Officer shall designate a VA Medical Center employee as the Contracting Officer's Representative (COR). All work coordination shall be made through the COR. The Contractor shall be provided a copy of the letter of delegation authorizing the COR at the commencement of the term of this agreement. No other person shall be authorized to act in such capacity unless appointed in writing by the Contracting Officer.

CONTRACTING OFFICER

The Contracting Officer is the only person authorized to approve changes or modify any of the requirements under this contract. The contractor shall communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer is authorized to make commitments or issue changes, which will affect price, quantity, or quality of performance of this contract. In the event the Contractor effects any such changes at the direction of any person other than the Contracting Officer, the change shall be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof.

Government Inherent Functions:

Contractor shall not perform inherently governmental functions. This includes, but is not limited to, determination of agency policy, determination of Federal program priorities for budget requests, direction and control of government employees, selection or non-selection of individuals for Federal Government employment including the interviewing of individuals for employment, approval of position descriptions and performance standards for Federal employees, approving any contractual documents, approval of Federal licensing actions and inspections, and/or determination of budget policy, guidance, and strategy.

General Duties, Requirements, and Expectations:

1. Be professionally competent to handle required duties.

2. Work with staff to ensure safety measures are in place and documented.

3. Services provided under the terms of this contract are required to be in compliance with the American

Association of Blood Banks (AABB) and College of American Pathologists (CAP) and VHA Handbook 1106.1.

Information Systems Officer, Information Protection:

The contractor will not have access to VA Desktop computers, nor will they have access to online resources belonging to the government while conducting services. If removal of equipment from the VA is required, any memory storage devices, such as hard drives, solid state drives and non-volatile memory units will remain in VA control and will not be removed from VA custody.

Privacy Officer:

The contractor will have access to Patient Health Information (PHI) but will not have the capability of accessing patient information from the VA System during the services provided to the VA.

Records Manager:

1. Contractor shall comply with all applicable records management laws and regulations, as well as National

Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. STVHCS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of STVHCS or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.

In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to STVHCS. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to STVHCS control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and STVHCS guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with STVHCS policy.

8. The Contractor shall not create or maintain any records containing any non-public STVHCS information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The STVHCS owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which STVHCS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take VHA-provided records management training, Talent Management System (TMS) Item #10176, Privacy and Information Security, Rules of Behavior. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

B.3 SPECIAL CONTRACT REQUIREMENTS

1. STX-HCR671-04 General Information Security Requirements /Records

1.1 All information and records provided to Contractor by VA, in whatever medium, as well as all information and documents, including drafts, emails, back-up copies, hand-written notes and copies that contain such information and records gathered or created by Contractor (collectively referred to as “VA information”) in the performance of this contract, regardless of storage media, are the exclusive property of VA. Contractor does not retain any property interest in these materials and will not use them for any purpose other than performance of this contract.

1.2 Upon completion or termination of the contract, Contractor will either provide all copies of all VA information to VA or certify that it has destroyed all copies of all VA information as required by VA in a method specified by VA, at VA’s option. Medical records of any kind including notes shall be returned to the VA. The Contractor will not retain any copies of VA information. Where immediate return or destruction of the information is not practicable, Contractor will return or destroy the information within 30 days of completion or termination of the contract. All provisions of this contract concerning the security and protection of VA information that is the subject of this contract will continue to apply to VA information for as long as the Contractor retains it, regardless of whether the contract has been completed or terminated.

1.3 Prior to termination or completion of this contract, Contractor will not destroy VA information received from VA or gathered or created by Contractor in the course of performing this contract without prior written approval by VA.

1.4 Contractor will receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in accordance with the terms of this contract and applicable federal and VA information confidentiality and security laws, regulations and policies.

1.5 The Contractor shall not make copies of VA information except as necessary to perform this agreement or to preserve electronic information stored on Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor needs to be restored to an operating state. Contractor shall provide access to VA information only to employees, subcontractors, and affiliates only: (1) to the extent necessary to perform the services specified in this Contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of this contract, and (3) only to individuals who first satisfy the same conditions, requirements and restrictions that comparable VA employees must meet in order to have access to the same VA information. These restrictions include the same level of background investigations, where applicable.

1.6 Contractor will store, transport or transmit VA information only in an encrypted form, using an encryption application that meets the requirements of FIPS 140-2, and is approved for use by VA.

1.7 Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two other situations: (i) in response to an order of a court of competent jurisdiction, or (ii) with VA’s prior written authorization. The contractor will refer all requests for, demands for production of, or inquiries about, VA information to VA for response.

1.8 If VA information subject to the contract includes information protected by 38 USC 7332, or 5705, include the following after the last sentence of the paragraph immediately above: Contractor shall not release information protected by either 38 USC 5705 or 7332 in response to a court order, and shall immediately refer such court orders to VA for response.

1.9 Prior to any disclosure pursuant to a court order, the Contractor shall promptly notify VA of the court order upon its receipt by the Contractor, provide VA with a copy by fax or email, whichever is faster, and notify by telephone the VA individual designated in advance to receive such notices. If the Contractor cannot notify VA before being compelled to produce the information under court order, the Contractor will notify VA of the disclosure as soon as practical and provide a copy of the court order, including a copy of the court order, a description of the records provided pursuant to the court order, and to whom the Contractor provided the records under the court order. The notice will include the following information to the extent that the Contractor knows it, if it does not show on the face of the court order: the records disclosed pursuant to the order, to whom, where, when, and for what purpose, and any other information that the Contractor reasonably believes is relevant to the disclosure. If VA determines that it is appropriate to seek retrieval of information released pursuant to a court order before Contractor notified VA of the court order, Contractor will assist VA in attempting to retrieve the VA information involved.

1.10The Contractor will inform VA by the most expeditious method available to Contractor of any incident of suspected or actual access to, or disclosure, disposition, alteration or destruction of, VA information not authorized under this Contract (“incident”) within one hour of learning of the incident. An incident includes the transmission, storage or access of VA information by Contractor or subcontractor employees in violation of applicable VA confidentiality and security requirements. To the extent known by the Contractor, the Contractor’s notice to VA will identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information was placed at risk or compromised), and any other information that the contractor considers relevant.

1.11Contractor will simultaneously report the incident to the appropriate law enforcement entity of jurisdiction.

The Contractor, its employees, and its subcontractors and their employees will cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor also will cooperate with VA in any civil litigation to recover VA information, to obtain monetary or other compensation from a third party for damages arising from any incident, or to obtain injunctive relief against any third party arising from, or related to, the incident.

1.12VA will provide the Contractor with the name, title, telephone number, fax number and email address of the VA official to whom the Contractor will provide all notices required by this Contract.

1.13VA has the right during normal business hours to inspect the Contractor’s facility, information technology systems and storage and transmission equipment, and software utilized to perform the contract to ensure that the Contractor is providing for the security of VA data and computer systems in accordance with the terms of this Contract.

1.14Contractor will receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with all applicable Federal Information Processing Standards (FIPS) and Special Publications (SPs) issued by the National Institute of Standards and Technology (NIST) concerning VA information that is the subject of this contract. If NIST issues or updates an applicable FIPS or SP after execution of this contract, the parties agree to negotiate in good faith to implement the FIPS or SP in this contract.

1.15A determination by VA that the Contractor has violated any of the information confidentiality and security provisions of this contract, including a violation of any applicable FIPS or SP, shall be a basis for VA to terminate the contract for cause.

1.16If anyone performing this contract, including employees of subcontractors, accesses VA computer systems or data in the performance of the contract, VA may monitor and record all such access activity. If VA monitoring reveals any information of suspected or potential criminal law violations, VA will refer the matter to the appropriate law enforcement authorities for investigation.

1.17Contractor shall inform its employees and other individuals performing any part of this contract that VA may monitor their actions in accessing or attempting to access VA computer systems and the possible consequences to them for improper access, whether successful or not. The Contractor shall ensure that any subcontractors or others acting on behalf of, or for, the Contractor in performing any part of this contract inform their employees, associates or others acting on their behalf that VA may monitor their access activities.

Execution of this contract and any subcontract or agreement constitutes consent to VA monitoring.

1.18The Contractor will ensure that all individuals who will access VA data or systems in performing the contract are appropriately trained in the applicable VA confidentiality and security requirements. Contractor may do this by requiring and documenting that these individuals have completed the VA training for its employees.

1.19To the extent practicable, Contractor shall mitigate any harmful effect on individuals whose VA information was accessed or disclosed in an incident.

1.20Contractor shall require subcontractors, agents, affiliates or others to whom Contractor provides access to VA information for the performance of this contract to agree to the same VA information confidentiality and security restrictions and conditions that apply to the Contractor before providing access.

1.21The contractor shall abide by FAR clauses 52.224-1 and 52.224.2.

1.22The contractor shall abide by FAR clauses 52.239-1 and 52.224.1-2 for Privacy or Security Safeguards 1.23In the performance of any part of the work on this contract, the contractor shall utilize only employees, subcontractors or agents who are physically located within a jurisdiction subject to the laws of the United States. Contractor will ensure that it does not use or disclose Patient Health Information (PHI) received from Covered Entity in any way that will remove the PHI from such jurisdiction. Contractor will ensure that its employees, subcontractors and agents do not use or disclose PHI received from Covered Entity in any way that will remove the PHI from such jurisdiction.

2. STX671-01 LOW RISK-CONTRACTOR PERSONNEL SECURITY REQUIREMENTS (May 2010)

2.1. All contractor employees who require access to the Department of Veterans Affairs’ computer systems or routine access to VA Facilities shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access.

2.1.1. Position Risk and Sensitivity Designations – Shall be determined by Contracting Officer’s

Representative (COR) in accordance with VHA Directive 0710 Appendix A. The position sensitivity for this contract has been designated as LOW RISK

2.2.7.1. Position Risk and Sensitivity Designations are directly tied to background investigative requirements.

2.2.7.2. A position designated as Low Risk requires a National Agency Check with Inquires (NACI).

2.2.7.3. A position designated as Moderate Risk requires a Minimum Background Investigation (MBI).

2.2.7.4. A position designated as High Risk requires a Background Investigation (BI).

2.2. Contractor Responsibilities:

2.2.1 The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM), the contractor shall reimburse VA within 30 days from receipt of a bill of collection.

2.2.2 Cost and Time Frames: Low Risk (NACI)-- The case is only open for 30 days except in rare occasions when something in the person’s background requires and extension. This investigation is done by mail and that is why we have to be so stringent with the paperwork. The average turn around on these cases is 45 days.

2.2.3 The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak and understand the English language.

2.2.4 After award and prior to contract performance, contractor shall submit to the Contracting Officer’s Representative all required information to initiate background check by completing the latest version of Local Background Check Request Form for each employee providing services under this contract. This form shall be provided by the COR.

2.2.5 Contractor shall notify the COR prior to changing/adding new contract personnel by submitting a new Local Background Check Request Form.

2.2.6 The Contractor, when notified of an unfavorable determination by the Government shall withdraw the employee from consideration of working under this contract.

2.2.7 The contractor shall submit the following required forms to the VA Office of Security and Law Enforcement as outlined within automatic email notification identifying the web site link following the detailed instructions regarding completion of the application process. This includes:

2.2.7.1. Standard Form 85, Questionnaire for Non-Sensitive Positions

2.2.7.2. If needed, Continuation Sheet for Questionnaires Standard Form 86A

2.2.7.3. FD 258, U.S. Department of Justice Fingerprint Applicant Chart; OR schedule to have electronic fingerprints as coordinated by COR

2.2.7.4. VA Form 0710, Authority for Release of Information Form

2.2.7.5. copies Optional Form 306, Declaration for Federal Employment (one copy submitted to office conducting electronic fingerprinting)

3.6.2. The Contractor shall ensure that all personnel requiring computer access will complete the VA’s

Cyber Security Training and Privacy training prior to obtaining computer access and annually thereafter.

3.6.3. Failure to comply with the contractor personnel security requirements may result in termination of the contract.

2.3. Government Responsibilities:

2.3.1. The VA Office of Security and Law Enforcement will provide the necessary forms to the contractor or to the contractor’s employees after receiving a background investigation request.

The COR shall submit Local Background Check Request Form to Contracting to initiate request in the Contractor Request Database (CRD).

2.3.2. Upon receipt, the VA Office of Security and Law Enforcement will review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation. The forms will be returned to the Contractor if incomplete or inaccurate.

2.3.3. The VA Office of Security and Law Enforcement will notify the Contracting Office and contractor after adjudicating the results of the background investigations received from OPM.

2.3.4. The Contracting Office will file and secure evidence that investigations have been completed or are in the process of being requested appropriately.

2.3.5. The COR shall ensure that all personnel requiring computer access have completed the VA’s Cyber Security Training and VA’s General Privacy Training and signed Rules of Behavior, prior to obtaining computer access and annually thereafter; hard copies provided to contract officer by contract number

3. STX671-02 Personal Security Verification (PIV) Card and/or Security Badge Requirements for Contractor Employees (FEB 2010)

3.1 Definitions. As used in this clause –

3.2 Access means routine, unescorted physical entry into, and to the extent authorized, mobility within a

Government facility. Also, it means the ability to obtain, view, read, modify, delete, and/or otherwise make use of information technology.

3.3 Contractor employee means an employee of the prime contractor or of any subcontractor, affiliate, partner, joint venture, or team members with which the contractor is associated. It also includes consultants engaged by any of those entities.

3.4 Facility and Government facility mean buildings, including areas within buildings, owned, leased, shared, occupied, or otherwise controlled by the federal government.

3.5 Information technology means any equipment or interconnected system or subsystem of equipment, including telecommunications equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major systems/ applications and general support systems as defined by OMB Circular A-130, owned by VA or owned and operated on VA’s behalf by another party.

3.6 Access to VA Facilities or Systems.

3.6.1. General. The performance of this contract requires contractor employees to have routine, unescorted access to VA facilities. All such employees who do not already possess a current Security Badge or PIV Card acceptable to VA shall be required to provide personal information, undergo an FBI National Criminal History Fingerprint Check, and obtain a Security Badge or PIV Card prior to being permitted access to any such facility in performance of this contract. No contractor employee will be permitted routine, unescorted access to a VA facility without a proper Security Badge or PIV Card.

3.6.2. Citizenship-related requirements. If required by the contract, each affected contractor employee as described in paragraph 14.1.2 shall be:

3.6.2.1 A United States (U.S.) citizen; or

3.6.2.2 A national of the United States (see 8 U.S.C. 1408); or

3.6.2.3 An alien lawfully admitted into the United States for permanent residence as evidenced by an Alien Registration Receipt Card Form I–151.

3.7 Background information.

3.7.1. For each contractor employee that has access to VA facilities or systems, the contractor shall coordinate with assigned Contracting Officer’s Representative (COR) to schedule electronic finger printing and initiate a Special Agreement Check (SAC). The COR will provide instructions to the contractor regarding the local procedures for fingerprinting and obtaining Security Badges or PIV Cards.

3.7.2. After completion of the fingerprint check, the Contracting Officer will notify the contractor in writing if any contractor employee is determined to be unsuitable to be given access to a government facility or VA system. If so notified, the contractor shall not allow such employees to perform work on this contract.

3.8 Security Badge or PIV Cards.

3.8.1. VA will issue a Security Badge or PIV Card to each contractor employee who is to be given routine, unescorted access to VA facilities or access to VA systems and does not already possess a Security Badge or PIV Card. Contractor employees that require logical access and email address in VA systems, access to sensitive records, sensitive physical access or common physical access of greater than 6 months or considered as a fulltime equivalent will require PIV Card, requiring background investigation (NACI) and SAC.

3.8.2. VA will issue Non-PIV Security Badges to contractor employees that require logical access with no email address in VA systems, access to sensitive records, sensitive physical access or common physical access of less than 6 months, or not considered as a fulltime equivalent will require non-PIV Card, requiring SAC. This card is issued with expiration date of 6 months or less.

3.8.3. Security Badge or PIV Cards shall identify individuals as contractor employees. Contractor employees shall always display their Security Badge or PIV Cards on their persons while working in a VA facility and shall present their cards for inspection upon request by VA officials or VA security personnel.

3.8.4. The contractor shall be responsible for all Security Badge or PIV Cards issued to the contractor’s employees and shall immediately notify the COR if any Security Badge or PIV Card(s) cannot be accounted for. The contractor shall notify the COR immediately whenever any contractor employee no longer has a need for his/her VA-issued Security Badge or PIV Card (e.g., employee terminates employment with the contractor, employee’s duties no longer require access to VA facilities). In such cases, the COR will instruct the contractor on how to return the Security Badge or PIV Card. Upon expiration of this contract, the COR will instruct the contractor on how to return all VA-issued Security Badge or PIV Cards not previously returned. The contractor shall not return Security Badge or PIV Cards to any person other than the COR.

3.9 Control of access

3.9.1 VA shall have and exercise full and complete control over granting, denying, withholding, and terminating access of contractor employees to VA facilities and systems. The Contracting Officer will notify the contractor immediately when VA has determined that an employee is unsuitable or unfit to be permitted access to a VA facility or system. The contractor shall immediately notify such an employee that he/she no longer has access to any VA facility or system, shall retrieve the employee’s Security Badge or PIV Card from the employee, and shall provide a suitable replacement employee in accordance with the requirements of this clause. The VA will not give the contractor the reason for requiring the removal of the unsuitable contractor employee but can provide the applicant the phone number to call the FBI to receive a copy of the SAC report used for this determination. The Government shall not be responsible for any costs incurred by the contractor as a result of removing such employee from the subject contract.

3.10 Termination

3.10.1 Failure on the part of the Contractor to comply with the terms of this clause may result in termination of this contract for default.

4. STX-HRC671-02 Health Insurance Portability and Accountability Act (HIPAA) Compliance (Feb 2010)

3.11 HIPAA COMPLIANCE: HIPAA compliance is required. Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). As required by HIPAA, the Department of Health and Human Services (HHS) has promulgated rules governing the security and use and disclosure of protected health information by covered entities, including the Department of Veterans Affairs (VA).

5. TUBERCULIN SKIN TEST:

5.1 A tuberculin skin test shall be required for all employees before reporting to STVHCS and then annually.

Annual tests shall be required for all negative results, completed during the anniversary month of initial test. Positive results should not be tested annually. All results forwarded to the Contracting Officer Technical Representative (COR). This test verifies the presence of tuberculosis (TB) (Mycobacterium tuberculosis). The Mantoux skin test uses TB antigens called purified protein derivative (PPD). The test cannot tell if the infection is active or inactive (latent).

6. STX-HCR671-01 Annual Office of Inspector General (OIG) Statement (Feb 2010)

6.1 “Providers and contracting entities have an affirmative duty to check the program exclusion status of individuals and entities prior to entering into employment or contractual relationships or run the risk of civil monetary penalties (CMP) liability if they fail to do so.”

6.2 The Contractor shall provide a signed annual report to the COR stating each individual or entity under this contract has been checked against the OIG List of Excluded Individuals/Entities http://www.oig.hhs.gov/fraud/exclusions.html and found no individual or entity had been excluded from participation in Medicare, Medicaid and other Federal healthcare programs. The report will be due each year on the renewal date of the contract.

6.3 Office of Inspector General of the Department of Health and Human Services (IG/HHS) has made a determination that prior to obligating VA contracts, purchase orders, task and delivery orders, and purchase cards orders paid with VA healthcare funds may not be entered with any individual, or with any entity or organization that has been listed on the HHS/OIG Exclusionary List. VA does not have the burden of defending the merits of the HHS/OIG decision established under §42 U.S.C. 1320a-7.

7. STX-HCR671-03 National Provider Identifier (NPI) Information Required (Feb 2010)

7.1 All Contractors and healthcare practitioners who provide billable healthcare services to the

Department of Veterans Affairs, VHA, shall obtain a National Provider Identifier (NPI) as required by the Health Insurance Portability and Accountability Act (HIPPA) National Provider Identifier Final Rule, administered by the Centers for Medicare and Medicaid Services (CMS). This rule establishes assignment of a 10-digit numeric identifier for healthcare practitioners, intended to replace the many identifiers currently assigned by various health plans. Each practitioner needs only one NPI, valid for all employers and health plans. The NPI may be obtained via a secure website at:

https://nppes.cms.hhs.gov/NPPES

7.2 Contractors must also designate their Specialties/Subspecialties by means of Taxonomy Codes on the NPI application.

8. Required Registration with Contractor Performance Assessment Reporting System (CPARS)

8.1 As prescribed in Federal Acquisition Regulation (FAR) Part 42.15, the Department of Veterans Affairs (VA) evaluates contractor past performance on all contracts that exceed $100,000 and shares those evaluations with other Federal Government contract specialists and procurement officials. The FAR requires that the contractor be provided an opportunity to comment on past performance evaluations prior to each report closing. To fulfill this requirement VA uses an online database, the Contractor Performance Assessment Reporting System (CPARS), which is maintained by the National Institutes of Health (NIH). The CPARS database information is shared with the Past Performance Information Retrieval System (PPIRS) database, which is available to all Federal agencies.

8.2 Each contractor whose contract award is estimated to exceed $100,000 is required to register with the NIH CPARS database at the following web address: https://cpscontractor.nih.gov. Help in registering can be obtained by contacting CPARS Support E-mail (CPARS-support-l@list.nih.gov) or by calling (301) 451-2771.

Registration should occur no later than thirty days after contract award and must be kept current should there be any change to the contractor’s registered representative.

8.3 For contracts with a period of one year or less, the contracting officer will perform a single evaluation when the contract is complete. For contracts exceeding one year, the contracting officer will evaluate the contractor’s performance annually. Interim reports will be filed each year until the last year of the contract, when the final report will be completed. The report shall be assigned in CPARS to the contractor’s designated representative for comment. The contractor representative will have thirty days to submit any comments and re-assign the report to the VA contracting officer.

8.4 Failure to have a current registration with the NIH CPARS database, or to re-assign the report to the VA contracting officer…