RFQ 36C26123Q0108.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

612-23-1-299-0005

36C26123Q0108 02-17-2023

Austin Mitts Email: Austin.Mitts@va.gov 559-225-6100 ext 6584 03-03-2023

3:00PM

Department of Veterans Affairs

VA Sierra Pacific Network (VISN 21)

Network Contracting Office (NCO) 21

855 M. Street, Suite 1020

Fresno CA 93721

X 100

X

621399

$10 Million

N/A

VA Northern California HealthCare System

Martinez Community Living Center (CLC)

150 Muir Road

Martinez CA 94553

VA Sierra Pacific Network (VISN 21)

VA Central California Health Care System

855 M Street, Suite 1020

Department of Veteran Affairs

FMS-VA-2(101) Financial Services Center

PO Box 149971

Austin TX 78714-9971

The VA Northern California HealthCare System has a requirement for virtual pharmacy services for the Martinez Community

Living Center (CLC) after normal CLC Pharmacy hour in accord with the Performance Work Statement contained herein.

-Please refer to the Addendum to the Instructions to

Offerors for details on how to respond. Page 61.

-Please refer to the Evaluation Health Care Resources for information on how quotes will be evaluated. Page 69.

Point of Contact: Austin Mitts

Email questions regarding RFQ to Austin.Mitts@va.gov by 02/24/2023 by 10:00am PST

Ordering Period 1: 04/01/23 - 03/31/24

Ordering Period 2: 04/01/24 - 03/31/25

Ordering Period 3: 04/01/25 - 03/31/26

Ordering Period 4: 04/01/26 - 03/31/27

Ordering Period 5: 04/01/27 - 03/31/28

612-3630160-299-822400-1024 0100224V1 x X

Maricela Berrones-Gauger

Contracting Officer

36C26123Q0108

Table of Contents

Section A…………………………………………………………………………………………………...1

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES………………………………………..……………..……

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

B.3 PERFORMANCE WORK STATEMENT

B.3 VHA SUPPLEMENTAL CONTRACT REQUIREMENTS FOR COMBATING COVID-19

B.4 IT CONTRACT SECURITY

SECTION C - CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (DEC 2022)

C.2 52.216-18 ORDERING (AUG 2020)

C.3 52.216-19 ORDER LIMITATIONS (OCT 1995)

C.4 52.216-22 INDEFINITE QUANTITY (OCT 1995)

C.5 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.6 SUPPLEMENTAL INSURANCE REQUIREMENTS

C.7 52.232-19 AVAILABILITY OF FUNDS FOR THE NEXT FISCAL YEAR (APR 1984)

C.8 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.9 VAAR 852.201-70 CONTRACTING OFFICER'S REPRESENTATIVE (DEC 2022)

C.10 VAAR 852.204-70 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL (MAY 2020)

C.11 VAAR 852.212-70 PROVISIONS AND CLAUSES APPLICABLE TO VA ACQUISITION OF

COMMERCIAL ITEMS (APR 2020)

C.12 852.219-10DEV VA NOTICE OF TOTAL SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS

SET-ASIDE (JUL 2019) (NOV 2020) (DEVIATION)

C.13 VAAR 852.219-77 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING—CERTIFICATE OF

COMPLIANCE FOR SERVICES AND CONSTRUCTION (SEP 2021) (DEVIATION)

C.14 VAAR 852.219-74 LIMITATIONS ON SUBCONTRACTING—MONITORING AND COMPLIANCE (JUL

2018)

C.15 VAAR 852.237-75 KEY PERSONNEL (OCT 2019)

C.16 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020)

C.17 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR

EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (DEC 2022)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

(NOV 2021)

E.2 52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS (NOV

2021)

E.3 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

E.5 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

E.6 52.216-1 TYPE OF CONTRACT (APR 1984)

E.7 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.8 VAAR 852.273-73 EVALUATION - HEALTH-CARE RESOURCES (NOV 2021)

E.9 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (DEC 2022)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1 1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer Maricela Berrones-Gauger

Network Contracting Office (NCO) 21

Contract Specialist Austin Mitts

Network Contracting Office (NCO) 21

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [x] Monthly Upon Government acceptance on a monthly basis

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the

Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

2,100.00 EA __________________ __________________

Prescription Filling Service (Nights, Weekends, Holidays)

Contract Period: Ordering Period 1

POP Begin: 04-01-2023

POP End: 03-31-2024

PRINCIPAL NAICS CODE: 621399 - Offices of All Other Miscellaneous

Health Practitioners

PRODUCT/SERVICE CODE: Q517 - Medical - Pharmacology

MANUFACTURER PART NUMBER (MPN): N/A

Contract Period: Ordering Period 2

POP Begin: 04-01-2024

POP End: 03-31-2025

PRINCIPAL NAICS CODE: 621399 - Offices of All Other Miscellaneous

Health Practitioners

Contract Period: Ordering Period 3

POP Begin: 04-01-2025

POP End: 03-31-2026

PRINCIPAL NAICS CODE: 621399 - Offices of All Other Miscellaneous

Health Practitioners

Contract Period: Ordering Period 4

POP Begin: 04-01-2026

POP End: 03-31-2027

PRINCIPAL NAICS CODE: 621399 - Offices of All Other Miscellaneous

Health Practitioners

Contract Period: Ordering Period 5

POP Begin: 04-01-2027

POP End: 03-31-2028

PRINCIPAL NAICS CODE: 621399 - Offices of All Other Miscellaneous

Health Practitioners

GRAND TOTAL __________________

B.3 PERFORMANCE WORK STATEMENT

1 Scope of Work: The contractor shall provide the services of a qualified Pharmacist, hereinafter referred to as “contract Pharmacist” to perform the requirements of this contract. The contract

Pharmacist shall provide virtual pharmacy services to eligible hospitalized patients at the

Community Living Center (CLC) at Martinez after normal CLC pharmacy hours. The contractor shall also provide virtual pharmacy services for the processing of clinic orders. This virtual pharmacy service will be performed offsite at the contractor’s facility.

2 Acronyms:

2.1 AMIS: Automated Management Information System

2.2 C&A: Certification and Accreditation

2.3 CBI: Compliance and Business Integrity

2.4 CLC: Community Living Center

2.5 CO: Contracting Officer

2.6 COR: Contracting Officer’s Representative

2.7 COS: Chief of Staff

2.8 CPARS: Contractor Performance Assessment Reporting System

2.9 CPRS: Computerized Patient Record System

2.10 HIPAA: Health Insurance Portability and Accountability Act

2.11 HIV: Human Immunodeficiency Virus

2.12 IGCE: Independent Government Cost Estimate

2.13 ISO: Information Security Officer

2.14 JCAHO: Joint Commission Accreditation of Hospital Organizations

2.15 NACI: National Agency Check with Inquiries

2.16 NIST: National Institute of Standards Technology

2.17 POP: Period of Performance

2.18 QA: Quality Assurance

2.19 SAC: Special Agreement Check

2.20 SIC: Security Investigation Center

2.21 TJC: The Joint Commission

2.22 U.S.C.: United States Code

2.23 VA: Department of Veterans Affairs

2.24 VANCHCS: Veterans Affairs Northern California Health Care System

2.25 VHA: Veterans Health Administration

2.26 VISTA: Veterans Integrated Systems Technology Architecture

2.27 VPN: Virtual Private Network

3 Specific Contractor Tasks include:

3.1 Provide virtual Pharmacist services to complete pending inpatient orders for all medications including those administered intravenously. This professional service includes order review for appropriateness of medication dose, indication and problem solving needed to assure safe and appropriate medication processing such as screening for drug interactions or contraindications.

3.1.1 Due to the critical nature of this service, the contractor shall have a backup

Pharmacist available in the event of sickness or other reasons for the primary contract

Pharmacist’s unavailability

3.1.2 Medication orders will be verified by contract Pharmacist(s).

3.1.3 The pending orders queue (pending and non-verified orders) will be checked and processed once every hour. Phone calls will be made by the facility to the contractor for emergency orders or for consultation. Emergency orders will be processed within 15 minutes of contact.

3.1.4 The contract Pharmacist will evaluate each prescription for drug interactions and contraindications given recorded drug allergies, appropriate doses, and accurate directions and to assure the final verified order will be understandable to the nurses administering the medication. Pending medication orders not meeting standards for completeness, restrictions, lacking clinical information and those requiring consults will be clarified with the prescriber prior to processing.

3.1.5 Using formulary information provided by the VA Northern California Health Care

System (VANCHCS) the contract Pharmacist will review pending orders and make efforts to utilize formulary agents by recommending formulary alternatives to the prescriber. If efforts are not successful, the order will be processed and follow-up actions will be taken by each facility.

3.1.6 Access to the Veterans Integrated Systems Architecture (VISTA) computer system is required and contract Pharmacists will have to meet all information security requirements as required by the Department of Veterans Affairs.

3.1.7 Contract Pharmacists must have knowledge of the VA Formulary and the VISTA computer system. Contract Pharmacists must also have a working knowledge of the processing requirements for proper completion of medication orders, and understand and be competent in accessing the Computerized Patient Records System (CPRS) to read notes, check laboratory values, etc., prior to completing medication orders that have questionable doses, special needs, etc.

3.1.8 The VA will not provide laptops, computers or any electronic equipment to the virtual pharmacist services. However, appropriate access to VISTA and CPRS systems will be made available through secure virtual private network (VPN) access.

3.1.9 The work will be performed remotely.

3.1.10 VA sensitive data will not be stored on hard drives or a non-VA network.

3.2 Normal Duty Hours

Contractor shall provide virtual contract Pharmacist services to eligible inpatients after normal hospital pharmacy hours. Normal pharmacy hours for the CLC at Martinez are 7:00 a.m. to 7:00 p.m., Monday through Fridays only. The CLC pharmacy is closed on weekends and holidays. The Contractor shall provide virtual pharmacist services to the Martinez CLC from 7:00 p.m. to 7:00 a.m. Monday through Friday, and full coverage 24 hours a day on Saturdays, Sundays, and Holidays.

3.2.1 The VA observes the following Federal Holidays:

3.2.1.1 New Year’s Day

3.2.1.2 Martin Luther King Jr. Day

3.2.1.3 Presidents Day

3.2.1.4 Memorial Day

3.2.1.5 Independence Day

3.2.1.6 Labor Day

3.2.1.7 Columbus Day

3.2.1.8 Veterans Day

3.2.1.9 Thanksgiving Day

3.2.1.10 Christmas Day

3.2.1.11 Any other day specifically declared by the President of the United

States to be a national holiday.

3.2.2 Vacation and leaves-of-absence shall be the responsibility of the contractor. The contractor shall coordinate leave and absences with the Contracting Officer’s

Representative (COR).

4 Qualifications.

4.1 The contract Pharmacist must be a graduate of a degree program in pharmacy from an approved college or university.

4.1.1 The contract Pharmacist must be licensed in a State, Territory, or

Commonwealth of the United States or the District of Columbia. Qualifications shall be subject to review by the VA Chief of Staff (COS) and approval by the VA Facility

Director.

4.1.2 The contract Pharmacist must have a working knowledge of VISTA and CPRS and be able to process pending inpatient orders. Experience with VISTA and CPRS must have been gained within the last three years.

4.1.3 The contract Pharmacist must be familiar with the VA formulary and the restrictions and criteria for the use of non-formulary drugs.

4.1.4 The contract Pharmacist must provide their own computer equipment and be readily available for questions and consultations via telephone

4.1.5 The contract Pharmacist must be a citizen of the United States, or non citizen under H1B or J1 visas, or a permanent resident alien.

4.1.6 The contractor’s personnel shall be responsible and able to show evidence of reliability, ability and experience. Verified references of ability and qualifications may be requested and accepted by the Contracting Officer (CO) to satisfy these requirements.

4.1.7 Before commencing work under this contract, the contractor shall provide, and maintain for the duration of the contract, liability insurance in conformance with applicable California State requirements for the service contemplated. Evidence of insurance will not be waived.

5 Administrative Requirements.

5.1 Credentialing and Privileging.

5.1.1 Initial applications for clinical privileges and applications for renewal of privileges must be submitted to the COR upon notice of contract award. The COR will present such applications to the credentialing and privileging office for review. Prior to providing services at VANCHCS, all contractor personnel must be verified by the COR as having been credentialed and privileged. Additionally, if requested, the contractor shall make all proposed personnel available for interview prior to commencement of work and during the credentialing and privileging process

5.1.2 The qualifications of all personnel shall be subject to review by the

VANCHCS COS and approved by the VANCHCS Director.

5.2 Should the personnel proposed by the contractor to provide services under this contract be denied privileges, or should the privileges of any contractor personnel be suspended, terminated, or revoked, the contractor and the employee(s) in question, shall be notified of the basis for such actions.

5.3 Contractor personnel who provide services under this contract will be required to report specific patient outcome information, such as complications, to the Chief of Medical

Services or his/her designee. Quality improvement data provided by the contractor personnel and/or collected by the VANCHCS will be used to analyze individual practice patterns. This data may be used by VANCHCS when renewal of clinical privileges is required of contractor personnel.

5.4 Contractor personnel who were previously credentialed and privileged by

VANCHCS may be exempt from this contract requirement provided that they can provide documentation to support current and active privileges

5.5 The VANCHCS reserves the right to refuse or dismiss contract personnel whose personal or professional conduct jeopardizes patient care or the regular and ordinary operation of the facility. Reasons for refusal or dismissal include, but are not limited to, unsatisfactory performance prior to and/or during the term of the contract, failure to receive favorable adjudication during a VA background investigation, failure to satisfy the requirements of the contract, physical or verbal abuse to patients, staff, or visitors, intoxication or debilitation resulting from drug use, theft, patient abuse, dereliction or negligence in performing directed tasks, ethical misconduct, conduct resulting in formal complaints by patients or other staff members, and any other valid reason considered objectionable.

6 Training. The contract Pharmacist(s) must complete annual mandatory training by using the mandatory packet, attending training in person, or by going on-line to complete the training. The

Compliance and Business Integrity Training & Education—Contract (Revenue Cycle) Employees includes the following training:

6.1 Awareness Training: Contractor employees shall complete initial compliance awareness training within 30 days of commencing work under this contract as well as complete annual compliance awareness refresher training. At a minimum, Compliance and Business Integrity

(CBI) awareness training will include the following topics: (a) the revenue cycle, (b) seven elements of an effective compliance program, (c) definition of high risk areas, and (d) definition of any compliance concerns and how to address a compliance concern. This requirement can be fulfilled by completing the training module available via the following Internet site:

http://www.visn21.va.gov/CBI.asp

6.2 Remedial Training: When notified, contract employees must complete remedial training and education to address any detected compliance exceptions.

6.3 Proof of Training: Contract employees are responsible for submitting proof of awareness and remedial training completed to the COR for this contract. The COR will retain proof of training in accordance with applicable Records Control Schedule.

6.4 Information Security and Privacy Training.

6.4.1 All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

6.4.1.1 Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor

Rules of Behavior, Appendix E relating to access to VA information and information systems;

6.4.1.2 Successfully complete the VA Cyber Security Awareness and Rules of

Behavior training and annually complete required security training.

6.4.1.3 Successfully complete the appropriate VA privacy training and annually complete required privacy training.

http://www.visn21.va.gov/CBI.asp

6.4.1.4 Successfully complete any additional cyber security or privacy training as required for VA personnel with equivalent information system access that will be defined by the VA program official and provided to the CO for inclusion in the solicitation document; e.g., any role-based information security training required in accordance with National Institute of Standards

Technology (NIST) Special Publication 800-16, Information Technology Security

Training Requirements.

6.4.1.5 The contractor shall provide to the CO and the COR a copy of the training certificates, and a signed copy of the Contractor Rules of Behavior for each applicable employee within one week of the initiation of the contract, and annually thereafter.

6.4.1.6 Failure to complete the mandatory annual training and sign the Rules of Behavior annually, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

7 Contractor Personnel Security Requirements - Information Systems Access

7.1 All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and

Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

7.2 All Contractor employees, who require access to VA computer systems and will work more than six months (180 days) under this contract, shall be the subject of a background investigation and must receive a favorable adjudication from the VA Security and Investigation

Center (SIC). This requirement is applicable to all subcontractor personnel requiring the same access.

7.3 Contractor personnel who previously received a favorable adjudication as a result of a government background investigation may be exempt from this contract requirement provided that they can provide documentation to support the previous adjudication. Proof of previous adjudication must be submitted by the contractor to the VA SIC through the VA CO. Some positions maybe subject to periodic re-investigation.

7.4 For those contractor employees who will work less than six months (180 days) under this contract, a background investigation is not required; however, such employees will be required to initiate a Special Agreement Check (SAC) for fingerprints only prior to providing services under this contract.

7.5 Position Sensitivity - The position sensitivity has been designated as: Low Risk

7.6 Background Investigation - The level of background investigation commensurate with the required level of access is: National Agency Check with Inquiries (NACI)

7.7 Contractor Responsibilities. In order to conduct a background investigation, the contractor shall submit or have their contract Pharmacist submit the following required forms to the COR. The COR will arrange a time for contract personnel to complete fingerprint verification.

7.7.1 Standard Form 85, Questionnaire for Non-Sensitive Positions

7.7.2 Standard Form 86A, Continuation Sheet for Questionnaires

7.7.3 Optional Form 306, Declaration for Federal Employment

7.7.4 Electronic Fingerprint Verification OR FD 258, U.S. Department of Justice

Fingerprint Applicant Chart

8 Access to and Safeguard of VA Information/Computer Systems

8.1 The contractor, their personnel, and their subcontractors shall be subject to the

Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

8.2 The contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems only to the extent necessary to perform the services specified in the contract, agreement, or task order.

8.3 The VA may provide contract personnel with access to VISTA and/or other general files maintained on VA computer systems via personalized VA access codes. These access codes are confidential and are to be protected by the end user. Sharing of these access codes or misuse of

VA information/computer systems is a Federal crime and may result in criminal penalties. When contract personnel no longer provides services to VA under the contract or no longer needs access to VA information systems, the Contractor shall immediately inform the COR so that the appropriate contract person’s access codes can be deactivated. The COR will be responsible for ensuring that such access codes are deactivated.

8.4 All contract personnel accessing VISTA or any other VA information/computer system will be required to complete VA Cyber Security Awareness Training annually and sign all applicable computer user agreements prior to accessing VA systems. The COR will be responsible for ensuring and documenting that this requirement is satisfied. Contract personnel shall maintain, access, release, and otherwise manage the information contained on VA information/computer systems in accordance with VA Handbook and Directive 6500, Information Security, and

VA/Veterans Health Administration (VHA) security policies, applicable VA confidentiality statutes (Title 38 United States Code (U.S.C.), Section 5701 and Title 38 U.S.C Section 7332) and the respective regulations implementing these statutes, and federal statutes and/or regulations applicable to Federal agency records. Copies of this information discussed in the aforementioned paragraphs can be provided to the contractor and contract personnel upon request.

8.5 Contract personnel with access to VA information/computer systems shall take both physical and electronic safeguards to protect the information and prevent unauthorized disclosures. Should contract personnel know or suspect that VA information/computer security was compromised or that VA information was, or could possibly be, disclosed to an unauthorized party, contract personnel must immediately report such knowledge or suspicion to the COR, who will then immediately notify the appropriate VA officials. The Information Security Officer (ISO) can be reached at the following address and phone number:

Information Security Officer

4150 Clement Street

San Francisco, CA 94121

(415) 221-4810 Extension 24064

8.6 The Privacy Officer can be reached at the following address and phone number:

Privacy Officer

103 Bodin Circle – Building 778

001/PO/FOIA/FF

Travis AFB, CA 94535

(707) 437-1823

8.7 If contract personnel are authorized by VA to access VA information/computer systems remotely via non-VA issued computers, the contractor will ensure that such computers are consistent with VA requirements and will upgrade hardware and/or software if instructed to do so by the VA in order to ensure compatibility and security when VA information/ computer systems are accessed by the end user. Individually identifiable health information will not reside on the contractor’s computer hard drives. After contract award, the VA reserves the right to inspect the contractor’s facilities, installations, operations, documentation, records, databases, and computers to ensure these requirements are met.

8.8 The contractor shall make its internal policies and practices regarding the safeguarding of medical and/or electronic information available to the VA and any other federal agencies with enforcement authority over the maintenance and safeguard of such records, upon request.

8.9 The contractor shall follow all of the previously mentioned statutes and respective regulations implementing these statutes as well as VA Directive 6500 – Information Security

Program, and any other VA or VHA policies and procedures governing the information discussed in this section of the contract. Copies of the information discussed in the aforementioned paragraphs may be viewed by contract personnel in the Office of Information Security (see the

Information Security Officer (ISO)).

8.10 The contractor, their personnel, and their subcontractors shall be subject to the federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

8.11 This contract only requires the use of VA information technology (IT) system and therefore Certification and Accreditation (Authorization) (C&A) requirements and Security

Accreditation Package do not apply here.

8.12 Any changes in the laws, regulations, or VA and VHA policies or procedures governing the information covered by this section of the contract, during the term of this contract, shall be deemed to be incorporated into this contract.

9 Computerized Patient Records System (CPRS)

9.1 Contract personnel are required to enter all patient care information into CPRS in accordance with Health Care System Memorandum No. 11-06-93 - Patient Care Orders Using the Computerized Patient Records System (see the COR to obtain a copy of this document) and any other VHA/medical center policies, procedures, or memorandums that address this topic.

9.2 The COR will be responsible for ensuring and documenting that these requirements are satisfied. If patient records are not properly documented within CPRS, the VA reserves the right to withhold payment to the contractor until such records are properly documented.

10 Handling of Records

10.1 By performing services under this contract, the contractor is considered part of the VA healthcare activity for purposes of the following statutes and respective regulations implementing these statutes: Title 5 U.S.C Section 552a (Privacy Act), Title 38 U.S.C. Section 5701, Title 38

U.S.C. Section 5705, Title 38 U.S.C Section 7332, and Public Law 104-191 Health Insurance

Portability and Accountability Act (HIPAA). Contract personnel shall have access to patient medical records and general files only to the extent necessary to perform their contractual duties.

Contract personnel shall only release medical information obtained during the course of this contract to those VA medical staff members involved in the necessary care and treatment of the individual patient in which the information pertains. Notwithstanding any other clause and/or provision of this contract, if a request for release or disclosure of information is not necessary for the care and treatment of an individual patient, the contractor and contract personnel shall not disclose any information contained in general files, patient records, and/or any other individually identifiable health information, including information and records generated by the contractor in performance of this contract, except pursuant to explicit instruction and written approval from

VA. For the purposes of this paragraph, instruction to disclose or copy such records and/or information may only be provided by the following: VA Regional Counsel and Chief, Health

Information Management Service/Privacy Officer through the VA CO. Violation of the aforementioned statutes may result in criminal and/or civil penalties.

10.2 Contract personnel who obtain access to hardware or media which may manipulate or store drug or alcohol abuse data, sickle cell anemia treatment records, records or tests or treatment for infection with the human immunodeficiency virus (HIV), medical quality assurance

(QA) records, or any other sensitive information protected under the statues and implementing regulations previously mentioned in paragraph 10.1, above, shall not have access to the records unless absolutely necessary to perform their contractual duties. Any contract person who has access to the previously mentioned data and/or information must not disclose it to anyone, including other contract personnel not involved in the performance of the particular contractual duty for which access to this data and/or information was obtained.

10.3 Information or records accessed or created by the contractor in the course of performing services under this contract are the property of the VA and shall not be accessed, released, transferred, or destroyed except in accordance with applicable federal law, regulations, and/or

VA and VHA policy. The contractor will not copy information contained in VA information systems, either by printing to paper or by copying to another digital format, without the explicit instruction and written approval from of the officials listed in paragraph 6.1., above, except as is necessary to make single copies in the ordinary course of providing patient care. The contractor will not commingle the data from VA information systems with information from other sources.

The contractor shall report any unauthorized disclosure of VA information to the officials listed in paragraphs 8.6 and 8.7 above.

10.4 If this contract is terminated for any reason, the contractor will provide VA with all of the individually identifiable VA patient treatment records or other information in their possession, and any copies made pursuant to paragraph 10.1, above, within seven calendar days of the termination of this contract.

10.5 The contractor shall follow all VA policies regarding the retention of records. As an alternative, the contractor may deliver the records to VA for retention.

10.6 The contractor shall follow all of the previously mentioned statutes and respective regulations implementing these statutes as well as VHA Handbook 1605.1 - Privacy and Release of Information and any other VA and VHA policies and procedures governing the information discussed in this section of the contract. Copies of the information discussed in the aforementioned paragraphs may be viewed by contract personnel in the Office of Health

Information Management (see the Privacy Officer). All contract personnel with access to any of the previously mentioned records (electronic or paper) will be required to complete VHA Privacy

Policy Training before accessing such record systems. This training must also be completed annually. The COR will be responsible for ensuring and documenting that this requirement is satisfied.

10.7 Any changes in the laws, regulations, or VA and VHA policies or procedures governing the information covered by this section of the contract, during the term of this contract, shall be deemed to be incorporated into this contract.

10.8 The VA has unrestricted access to the records generated by the contractor pursuant to this contract.

11 HIPAA Compliance

11.1 Under HIPAA privacy and security rules, the contractor providing services under this contract is considered to be a “covered entity,” and thus is not required to enter into a Business

Associate Agreement (BAA) with VA. However, the contractor must observe Public Law 104-

191 and all respective regulations implementing this law while providing services under this contract.

12 Quality Management.

12.1 Quality Assurance (QA)

12.1.1 The contractor shall perform services under this contract in accordance with the ethical, professional, and technical standards of the healthcare industry, and must meet, or exceed, the current QA standards recognized by The Joint Commission (TJC) and mandated by VHA QA policies and/or performance measures. A copy of these standards, policies, and performance measures may be viewed by contract personnel in the COS’

Office.

12.1.2 The contractor will not participate in, nor be a party to, any activities which are in conflict with Federal and/or State guidelines. In the event that the contractor encounters said conflicting situations, the contractor will notify the COR or the CO to resolve such issues. The CO will document and be responsible for resolution of any such situations.

Neither the VA nor the contractor will be responsible for any delays or failures to perform due to causes beyond each party's control.

12.1.3 In order to adequately protect VA patients, the contractor shall not introduce new procedures or services without prior recommendation to, and approval from the

VANCHCS COS or Director.

12.1.4 All services provided under this contract will be subject to QA and Utilization

Review procedures of the VANCHCS.

13 Contract Monitoring Procedures

13.1 In accordance with VA regulations, a record-keeping system will be established and maintained by the COR to ensure contract compliance.

13.2 Before approval of payment of contractor’s invoice by the COR, the medication errors and near misses from contractor pharmacist(s) will be reviewed.

13.3 Documentation via VISTA Automated Management Information System (AMIS) reports will be done to validate the work done by contractor pharmacist(s) after hours. A sampling of medical records will be reviewed to validate the accuracy of medication order verification and the count of orders verified.

13.4 Upon verification of services payment will be authorized by the COR.

13.5 The contractor agrees to provide services which meet or exceed the standards as established by The Joint Commission Accreditation of Hospital Organizations (JCAHO), the

Department of Veterans Affairs and regulations of the medical staff bylaws of the VACCHCS.

13.6 The services specified herein may be changed by mutual written agreement of the parties, in accordance with the terms and conditions set forth herein.

14 Terms of Agreement.

14.1 This agreement is effective for the period identified in the “Schedule of Supplies and

Service” and is subject to the availability of VA funds. Services will not be performed by the contractor beyond the expiration date, unless specifically authorized to do so in writing by the

CO.

14.2 Contractor personnel performing services under this agreement will not be considered

VANCHCS employees for any purpose, and shall be considered employees of the affiliate. VA will not make payment for any holidays or leave including sick leave. In addition, the contractor shall be required to provide their own worker’s compensation, liability insurance, health examinations, income tax withholdings and social security payments.

15 Estimated Quantities

15.1 The quantities of hours specified in this agreement are estimates, based upon the projected hours when the VA pharmacy is closed during the period of performance (POP). The VANCHCS does not imply or guarantee that any fixed number of hours will be required during the contract period. VANCHCS will not be obligated to reimburse the contractor for any specified amount of services, but will be obligated to make payment for any services received in the quality and quantity as requested.

16 VANCHCS Responsibilities

16.1 After award of the contract, the CO will designate a VA employee as the COR. The COR will be responsible for overseeing and directing the services to be performed by under this agreement.

16.2 The COR will be responsible for:

16.2.1 Maintaining a copy of the contract and all modifications to the contract.

16.2.2 Routinely comparing the contract with the acquisition package to ensure the contract mirrors what the service requested.

16.2.3 Take appropriate action when the independent government cost estimate

(IGCE) and the POP in the acquisition package do not match.

16.2.4 Ensure all contractor invoices match the contract requirements for invoice submission, e.g., monthly in arrears, line item numbers, quantities, prices, etc. are all reflected on the invoice in accordance with FAR 32.905.

16.2.5 Communicating regularly with the contractor and the CO for contract discrepancies or omissions

17 Contractor Signature of Purchase Order (Block 28 of Page 1)

17.1 In accordance with FAR 13.302-2, Obtaining Contractor Acceptance and Modifying

Purchase Orders when parties have signed this purchase order it becomes a binding bilateral firm-fixed price (FAR 16.202) contract, as defined at FAR 2.101.

Security language Per 6500.6 Appendix B & C.

1. General

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

1. Access to VA Information and VA Information Systems

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The

Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

2. VA Information Custodial Language

d. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-

14(d) (1).

e. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records

Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information

Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records

Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA

Contracting Officer within 30 days of termination of the contract.

f. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

3. Security Incident Investigation

g. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

h. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

i. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach.

Notifications need to be made in accordance with the executed business associate agreement.

j. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident

4. Liquidated Damages for Data Breach

k. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/ subcontractor processes or maintains under this contract. However, it is the policy of the VA to forgo collection of liquidated damages in the event the contractor provides payment of actual damages in the amount determined to be adequate by the agency.

l. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the

Security Incident Investigation section above. Upon such notification, VA must secure from a non-

Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

m. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy

Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

n. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $_37.50_ per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

5. Training

o. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1)…