RFQ 36C26123Q1043.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

612-24-1-6133-0005

36C26123Q1043 08-14-2023

Pablo S. Cunanan 808-539-1314 08-28-2023

4:00 PM PDT

Department of Veterans Affairs VA Sierra Pacific Network (VISN 21) Network Contracting Office 21 (NCO 21) 711 Kapiolani Blvd Suite 200 Honolulu HI 96813

X

561621

$25 Million

N/A

"See Delivery Schedule"

Department of Veterans Affairs VA Sierra Pacific Network (VISN 21) Network Contracting Office 21 (NCO 21)

FMS VA-9(101) Financial Services Center

PO Box 149971 Austin TX 78714-9971

866-372-1141 vafscenterprisesupport@va

See CONTINUATION Page

Description: Preventive Maintenance of Physical Access Control Systems (PACS) for the VA Northern California Health Care System in accordance with the Statement of Work.

Period of Performance: Base year plus two option periods Base year: 10/1/23 - 9/30/24

Offerors must be registered and "Verified" as an SDVOSB concern in https://veterans.certify.sba.gov/ on the date quotes are due and at time of award.

Offerors shall follow the submission instructions in FAR Provisions 52.212-1 and 52.212-2, and their addendums.

Failure to follow the instructions will result in unfavorable evaluation and may not be considered for award.

The applicable wage determinations are:

See Section D of the solicitation.

See CONTINUATION Page

36C26123Q1043

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

B.3 PERFORMANCE WORK STATEMENT (PWS)

SECTION C - CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES (DEC 2022)

C.2 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.3 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000) ...37

C.4 SUPPLEMENTAL INSURANCE REQUIREMENTS

C.5 VAAR 852.201-70 CONTRACTING OFFICER'S REPRESENTATIVE (DEC 2022)

C.6 VAAR 852.203-70 COMMERCIAL ADVERTISING (MAY 2018)

C.7 VAAR 852.219-73 VA NOTICE OF TOTAL SET-ASIDE FOR CERTIFIED SERVICE-

DISABLED VETERAN-OWNED SMALL BUSINESSES (JAN 2023) (DEVIATION)

C.8 VAAR 852.219-75 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING—

CERTIFICATE OF COMPLIANCE FOR SERVICES AND CONSTRUCTION

(JAN 2023) (DEVIATION)

C.9 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV

2018)

C.10 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020) ..45

C.11 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.12 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (JUN 2023)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (MAR 2023)

E.2 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (NOV 2021)

E.3 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

E.5 52.216-1 TYPE OF CONTRACT (APR 1984)

E.6 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.7 VAAR 852.233-70 PROTEST CONTENT/ALTERNATIVE DISPUTE RESOLUTION

(OCT 2018)

E.8 VAAR 852.233-71 ALTERNATE PROTEST PROCEDURE (OCT 2018)

E.9 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.10 VAAR 852.239-75 INFORMATION AND COMMUNICATION TECHNOLOGY

ACCESSIBILITY NOTICE (FEB 2023)

E.11 VAAR 852.239-76 INFORMATION AND COMMUNICATION TECHNOLOGY

ACCESSIBILITY (FEB 2023)

E.12 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (DEC 2022)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C261 Pablo S. Cunanan

VA Sierra Pacific Network (VISN 21) Network Contracting Office 21 (NCO 21)

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Monthly in arrears

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

• Tungsten e-Invoice Setup Information: 1-877-489-6135

• Tungsten e-Invoice email: VA.Registration@Tungsten-Network.com

• FSC e-Invoice Contact Information: 1-877-353-9791

• FSC e-invoice email: vafsccshd@va.gov

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

12.00 MO __________________ __________________

Preventative Maintenance Services, Sacramento VA Medical

Center, 10535 Hospital Way, Mather, CA 95655, 288 Card Readers Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024

Preventative Maintenance Services, Martinez VA Medical

Center, 150 Muir Road, Martinez, CA 94553, 102 Card Readers Contract Period: Base

Preventative Maintenance Services, Chico Outpatient

Clinic,1601 Concord Avenue, Chico, CA 95928 , 37 Card Readers Contract Period: Base

Preventative Maintenance Services, 103 Bodin Circle, Travis

AFB, CA 94535, 12 Card Readers Contract Period: Base

Preventative Maintenance Services, Mare Island Outpatient

Clinic, 201 Walnut Avenue, Mare Island, CA 94612, 42 Card Readers Contract Period: Base

Preventative Maintenance Services, McClellan Outpatient Clinic, 5342 Dudley Boulevard, McClellan Park, CA 95652, 64 Card Readers Contract Period: Base

Preventative Maintenance Services, Modesto Outpatient

Clinic, 1225 Oakdale Road, Modesto, CA 95355, 6 Card Readers Contract Period: Base

Preventative Maintenance Services, Redding Outpatient

Clinic, 3455 Knighton Road, Redding, CA 96002, 37 Card Readers Contract Period: Base

Preventative Maintenance Services, Redding Clinical Annex, 760 Cypress Avenue, Suite 100, Redding, CA 96001, 4 Card Readers Contract Period: Base

Preventative Maintenance Services, Sonora Outpatient

Clinic, 13663 Mono Way, Sonora, CA 95370, 4 Card Readers Contract Period: Base

Preventative Maintenance Services, Yuba City Outpatient

Clinic, 425 Plumas Boulevard, Yuba City, CA 96097, 16 Card

Readers Contract Period: Base

Preventative Maintenance Services, VA Sierra Pacific

Network (VISN 21) Offices, 391 Taylor Road, Pleasant Hill, CA 94523, 16 Card Readers Contract Period: Base

1.00 EA __________________ __________________

Software Updates

Contract Period: Base

4.00 HR __________________ __________________

Training

Contract Period: Base

500.00 HR __________________ __________________

Troubleshooting

Contract Period: Base

Travel

Contract Period: Base

Center, 10535 Hospital Way, Mather, CA 95655, 288 Card

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025

Center, 150 Muir Road, Martinez, CA 94553, 102 Card Readers Contract Period: Option 1

Clinic,1601 Concord Avenue, Chico, CA 95928 , 37 Card Readers Contract Period: Option 1

AFB, CA 94535, 12 Card Readers Contract Period: Option 1

Clinic, 201 Walnut Avenue, Mare Island, CA 94612, 42 Card Readers Contract Period: Option 1

Clinic, 5342 Dudley Boulevard, McClellan Park, CA 95652, 64 Card Readers Contract Period: Option 1

Clinic, 1225 Oakdale Road, Modesto, CA 95355, 6 Card Readers Contract Period: Option 1

Clinic, 3455 Knighton Road, Redding, CA 96002, 37 Card Readers Contract Period: Option 1

760 Cypress Avenue, Suite 100, Redding, CA 96001, 4 Card Readers Contract Period: Option 1

Clinic, 13663 Mono Way, Sonora, CA 95370, 4 Card Readers Contract Period: Option 1

Clinic, 425 Plumas Boulevard, Yuba City, CA 96097, 16 Card Readers Contract Period: Option 1

Network (VISN 21) Offices, 391 Taylor Road, Pleasant Hill, CA 94523, 16 Card Readers Contract Period: Option 1

Contract Period: Option 1

Contract Period: Option 1

Contract Period: Option 1

Contract Period: Option 1

Center, 10535 Hospital Way, Mather, CA 95655, 288 Card Readers Contract Period: Option 2

Center, 150 Muir Road, Martinez, CA 94553, 102 Card

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026

Clinic,1601 Concord Avenue, Chico, CA 95928 , 37 Card Readers Contract Period: Option 2

AFB, CA 94535, 12 Card Readers Contract Period: Option 2

Clinic, 201 Walnut Avenue, Mare Island, CA 94612, 42 Card Readers Contract Period: Option 2

Clinic, 5342 Dudley Boulevard, McClellan Park, CA 95652, 64 Card Readers Contract Period: Option 2

Clinic, 1225 Oakdale Road, Modesto, CA 95355, 6 Card Readers Contract Period: Option 2

Clinic, 3455 Knighton Road, Redding, CA 96002, 37 Card Readers Contract Period: Option 2

760 Cypress Avenue, Suite 100, Redding, CA 96001, 4 Card Readers Contract Period: Option 2

Clinic, 13663 Mono Way, Sonora, CA 95370, 4 Card Readers Contract Period: Option 2

Clinic, 425 Plumas Boulevard, Yuba City, CA 96097, 16 Card Readers Contract Period: Option 2

Network (VISN 21) Offices, 391 Taylor Road, Pleasant Hill, CA 94523, 16 Card Readers Contract Period: Option 2

Contract Period: Option 2

Contract Period: Option 2

Contract Period: Option 2

Contract Period: Option 2

GRAND TOTAL __________________

Summary:

Period of Performance Amount

Base Period – October 1, 2023 - September 30, 2024 $

Option Period One – October 1, 2024 - September 30, 2025 $

Option Period Two – October 1, 2025 - September 30, 2026 $

Aggregate Amount (Base Period + Two One-Year Option Periods = 3 Years)

B.3 PERFORMANCE WORK STATEMENT (PWS)

Card Access Preventative Maintenance Services for the VA Northern California

HealthCare System (VANCHCS)

1. General Information

A. The Contractor shall provide all labor, materials, equipment, and necessary supervision for the inspection, testing, and maintenance of the existing physical access control systems (PACS) and associated devices. All inspections & testing will be monitored by the Contracting Officer Representative (COR) or their authorized designee. The Contractor will be required to maintain all necessary licenses and/or permits required to adequately perform all tasks outlined in this Performance Work Statement regarding the existing Software House/HID Global card readers and associated systems and hardware.

• CCure 9000 Series R+ support agreement expires 8/31/23, serial number 9-20650.

B. The Contractor shall perform all maintenance requirements at the following locations:

• Sacramento VA Medical Center: 10535 Hospital Way, Mather, CA 95655 (288 Card Readers)

• Martinez VA Medical Center: 150 Muir Road, Martinez, CA 94553 (102 Card Readers)

• Chico Outpatient Clinic: 1601 Concord Avenue, Chico, CA 95928 (37 Card Readers)

• Fairfield Outpatient Clinic: 103 Bodin Circle, Travis AFB, CA 94535 (12 Card Readers)

• Mare Island Outpatient Clinic: 201 Walnut Avenue, Mare Island, CA 94612 (42 Card

• McClellan Outpatient Clinic: 5342 Dudley Boulevard, McClellan Park, CA 95652 (64 Card Readers)

• Modesto Outpatient Clinic: 1225 Oakdale Road, Modesto, CA 95355 (6 Card Readers)

• Redding Outpatient Clinic: 3455 Knighton Road, Redding, CA 96002 (37 Card Readers)

• Redding Clinical Annex: 760 Cypress Avenue, Suite 100, Redding, CA 96001 (4 Card

• Sonora Outpatient Clinic: 13663 Mono Way, Sonora, CA 995370 (4 Card Readers)

• Yuba City Outpatient Clinic: 425 Plumas Boulevard, Yuba City, CA 96097 (16 Card

• VA Sierra Pacific Network (VISN 21) Offices, 391 Taylor Road, Pleasant Hill, CA 94523 (16 Card Readers)

C. Period of Performance (POP): See Price/Cost Schedule.

D. All travel costs associated with the performance of this contract are the responsibility of the Contractor and are provided at no additional cost to the Government.

2. Scope of Work

1) Physical Access Control Systems (PACS), sometimes referred to as a card reader or entry control system or proximity access card system. Current card readers specific to the system are 200-bit capable HID pivCLASS RP40-H, RPK-40H, and RP-10.

2) System Controllers, power supplies and other associated and control panels/boards.

Including the following: Software House iStar Ultra Door Controllers; iStar GCM and ACM boards; iStar Edge Controllers, boards and RM-4 reader modules; and Altronix 12-and 24-volt power supplies and distribution modules.

3) Affiliated hardware and software necessary for programming, controlling, and managing the PACS system. This includes licensing and annual support fees for the Software House CCure 9000 software and, annual support agreement fees and/or licensing fees necessary to enroll standards-based cards like the PIV (currently Technology Industries Entry Point Slammer).

4) Door hardware and other inputs controlled by the PACS (i.e. magnetic locks, door hold devices, door electric strikes, electrified panic bars, request-to-exit sensors, door contacts, resistors, etc).

A. There are currently 628 PACS card readers and 73 Controllers active across the listed sites.

(See Attached Spreadsheets)

B. Contractor tasks shall include the following:

1) Maintain the Software House / Tyco / CCure 9000 card access system at all designated facilities at 100% operational functionality 24 hours a day, 7 days a week.

2) All adjustments, repairs, installations, replacement, and modifications, necessary to maintain or restore full functionality, must be approved by the COR and conform to the

VA guidelines and/or industry standards, as applicable. The most stringent requirements shall govern unless written direction from the COR is provided. Applicable standards are the following:

a) VA Handbook 0730/4 Appendix B https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=700&FType=2

b) VA Directive 6500 https://www.oprm.va.gov/docs/Directive_6500_24_Feb_2021.pdf

c) VA Directive 0735 – Homeland Security Presidential Directive 12 (HSPD) Program https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=815&FType=2

3) As part of their bid, the Contractor shall provide functional software updates once each year for the duration of the service contract period and at no additional cost to the Government.

4) The Contractor will provide support for installation of any security software patches should a vulnerability be identified.

5) Contractor shall have in his possession throughout the term of the contract all diagnostic equipment necessary to fully maintain, test, repair, adjust, or reprogram the PACS systems software.

6) The Contractor shall maintain a separate maintenance/inventory record of all PACS devices. The maintenance record shall be kept in the PACS equipment room and shall be kept up-to-date and readily available for inspection by the COR or authorized designee. This maintenance log shall list each PACS component and show the schedule of the manufacturer’s recommended frequency of inspection and/or testing of each component. This maintenance record is the property of the Government and shall be turned over to the Government at the end of the contract. The maintenance record shall be a chronological file that includes the following information:

a) Date

b) Nature of work (i.e. Preventive Maintenance Inspection (PMI) or call back)

c) Description of work performed (Contractor should be brief and concise)

d) Any indication of problems experienced

e) Printed name and signature of the technician who performed the work

f) Serial numbers and model numbers of individual components

7) Safety door operation tests and other tests and inspections shall be performed by the Contractor. Contractor shall perform all safety tests and other tests and inspections as recommended.

https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=700&FType=2 https://www.oprm.va.gov/docs/Directive_6500_24_Feb_2021.pdf https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=815&FType=2

8) All tests or inspections that will remove the PACS or door from normal operation shall be scheduled in advance with the COR.

9) An adequate supply of spare parts shall always be maintained to ensure prompt preventive-maintenance and repair services. This includes iStar GCM, ACM, RM-4 and iStar Edge boards or modules and 200-bit capable HID pivCLASS RP40-H, RPK-40H, and RP-10 card readers.

10) Contractor shall provide up to 2 hours of training on administration of the CCure 9000 software per contract year.

C. Maintenance and Repairs: The Contractor shall develop and submit for COR approval a routine maintenance and preventative maintenance schedule no later than 45 days after contract award. A complete preventative maintenance plan shall include manufacturer maintenance requirements outlined in applicable technical manuals and documentation. The Contractor shall furnish all labor and supplies, and parts necessary to regularly and systematically clean, examine, adjust as required, and if conditions warrant, repair or replace (corrective and preventative maintenance) as follows:

1) Respond and complete all corrective maintenance and repairs within 10 business days after notification.

2) 100% compliance with the facility inventory and maintenance review plan.

3) All licenses, software upgrades, backup software, and updates required for PACS system functionality and network security.

4) Electric door locking hardware.

5) Controller, selector and dispatching equipment, all relays, solid state components, resistors, condensers, transformers, contacts, leads, dashpots, time devices, CRT devices, recording devices, hardware and software (server and computer), selector tape or wire, and mechanical and electrical equipment as it pertains to the integration of automatic door opening devices and the PACS.

6) Automatic door operation integration with the physical access control system. Automatic doors must work as intended with the card access system. This PWS does not include maintaining automatic door hardware.

7) Software House/Tyco/Ccure 9000 and/or HID Global Card Reader Access.

8) Ensure all readers are visibly labeled/identified and match the configuration labeled on the controlling hardware. Some information might be missing on existing system and shall be identified by the contract as missing or needing to be identified for labeling. This shall be provided to the COR for decision on how to proceed.

9) Provide a monthly maintenance schedule to include impacts upon physical security and proposed alternative solutions to maintain appropriate security levels by the 5th calendar day of each month.

10) Provide a monthly report detailing all repairs, materials, parts, labor, and corrective and preventative maintenance completed the previous month by the 5 th calendar day of each month.

11) Coordinate with the COR prior to all tests, inspections, and/or maintenance repairs that will remove a PACS device from service. Notification will be provided to the COR, the site Physical Security Specialist (i.e. Police Service), and Engineering & Facilities Management Service (E&FMS) before removing any PACS device from service. If work requires more than one day, daily notification will be required. The Contractor shall notify both the Physical Security Specialist and E&FMS when placing any PACS device back in service. The Contractor shall document each on-site service and furnish the VA with a trip receipt showing time, date, and a brief description of the Contractor’s activities.

Documentation of site visits shall be provided to the VA COR or authorized designee monthly.

12) The Contractor shall notify the COR in writing of the existence or the development of any defects in or required repairs to the Card Access System or automatic doors in which the Contractor considers to be outside the scope of this contract. Upon request, the Contractor shall furnish a written estimate of the cost of repair and/or replacement. Final determination of acceptance and responsibility will be made by the Contracting Officer.

D. Emergency Response

1) The Contractor will respond within (2) hours to provide over-the-telephone troubleshooting and assistance and be available onsite within 24 hours during normal business hours Monday through Friday to troubleshoot and restore proper functionality.

E. Warranty

1) Warranty of newly installed devices: No device shall be acceptable that will not give full satisfaction without excessive maintenance and/or repairs. If it becomes evident during the guarantee period that the device is not functioning properly in accordance with the manufacturer’s requirements or in the opinion of Contracting Officer excessive maintenance and attention must be employed to keep device operational, the device(s) shall be removed and new device(s) shall be installed to meet satisfactory operation expectations. The ‘Guarantee Period’ shall restart for such parts from date of completion of each new installation performed, in accordance with foregoing requirements. Any components which may have suffered substantial life cycle reduction or damage due to redundant failure(s) shall also be provided at the Contractors expense and provided the same extended ‘Guarantee Period’.

Contractors Responsibilities

A. Contractor’s uniform shall have the Contractor’s name, easily identifiable, affixed thereon in a permanent manner such as a badge or monograms. The Contractor shall require his employees to comply with all VA rules and regulations pertaining to the conduct of their employees while on station. It is the responsibility of the Contractor to park in the appropriate designated parking areas. Information on parking is available from the VA Police Service. VANCHCS will not invalidate or make reimbursement for parking violations of the Contractor under any conditions. Smoking is prohibited inside all buildings. Cellular phones and two-way radios are not to be used in emergency rooms, surgical and recovery suites, and within six feet of any medical equipment. Possession of weapons is prohibited.

Enclosed containers, including tool kits, shall be subject to search. Violations of VA Regulations may result in a citation answerable in the United States Federal Court District, not local district state or municipal court.

B. Security Background Checks: The employee must be able to pass a minimum background investigation (MBI) similar to the investigations of Federal, non-sensitive position employees. Fingerprinting will be required.

C. The contractor will hold current Software House Advanced Integrator certification and have one fully trained field service technicians permanently residing within a 150-mile radius of Sacramento Medical Center (Mather), 10535 Hospital Way, Mather, CA. 95655, for the duration of the contract. All physical access control system mechanics and/or automatic door integration technicians’ personnel directly engaged in the work under the contract shall possess at least three (3) years of recent experience in the operation and maintenance of physical access control system components and automatic door operations.

D. The Contractor shall adhere to all OSHA (Occupational Safety and Health Administration) safety standards, EPA (Environmental Protection Agency) standards, NFPA (National Fire Protection Agency) and Life Safety code requirements, and all other applicable Federal, State, and local regulatory requirements.

E. In performance of this contract, the Contractor shall follow VANCHCS safety policy and standard for safe work practices and take such safety precautions as the Safety Officer or designee may determine to be reasonably necessary to protect the lives and health of occupants of the building. The Contractor shall comply with the VANCHCS smoking policy, which designates all interior space as non-smoking areas.

F. The safety of all building occupants shall be maintained at all times. The Contractor shall replace all safety guards, equipment, devices, etc. removed to service or repair components of the PACS system immediately after completion of work or when leaving the immediate work area.

G. The Contractor shall submit to the Contracting Officer, within (45) days after receipt of this contract, all Material Safety Data Sheets (MSDS) for all potentially hazardous materials (lubricants, cleaners, working fluids, etc.) to be used in the facility in performance of the contract, and will not use materials which have not been cleared in advance with the VANCHCS. MSDS for new chemicals shall be furnished concurrently with arrival of the chemical on site. The Contractor shall maintain a copy of all MSDS(s) on site in an accessible storage location to VANCHCS personnel.

H. The Contractor is responsible to identify, provide and maintain all personal protective equipment required to perform the duties outlined in the contract. In addition, the Contractor is responsible for identifying and providing all applicable safety documents (i.e. hot work permit, lockout/tagout, confined space entry, etc.) required in performing the work.

3. Contractors Quality Assurance / Quality Control (QA/QC) Plan A. The Contractor shall establish a complete quality control program to assure the requirements of the contract are provided as specified. The QA/QC plan shall be provided to the designated COR within (45) days from the contract award date. The program shall include, but not be limited to, the following:

1. An inspection system covering all the services described in the contract. A checklist used in inspecting contract performance during regularly scheduled or unscheduled inspections and the name(s) of the individual(s) who will perform the inspection.

2. The checklist shall include every area of the Contractor’s operation as well as every task required to be performed.

3. A system for identifying and correcting deficiencies in the quality of services before the level of performance becomes unacceptable and/or the Medical Center inspectors point out the deficiencies.

4. A file of all inspections conducted by the Contractor and the corrective action taken. This documentation shall be made available to the COR upon request, at any time during the term of the contract.

5. Provide monthly maintenance schedule to include impacts upon physical security and proposed alternative solutions to maintain appropriate security levels by the 5 th calendar day of each month.

6. Provide a monthly report detailing all repairs, materials, parts, labor, and corrective and preventative maintenance completed the previous month by the 5 th calendar day of each month.

B. The Contractor shall ensure that electrical and data closets are kept clean and free from dirt and debris. Contractor shall clean and vacuum all device enclosures as needed to remove dust and debris accumulation.

C. Condition of Equipment: Upon contract award, the Contractor accepts "as is" all PACS system equipment specified in the contract. Failure to inspect the PACS, prior to contract award, will not relieve the Contractor from performing services/repairs in accordance with the strict intent and meaning of the specifications at no additional cost to the Government.

Offerors should inspect the premises prior to submitting their offers in order to be fully aware of the scope of services required.

4. Government Responsibilities

A. Contractor shall have complete access to provide inspection, testing, and maintenance of the installed equipment and software as described in this agreement for the Base Year period. All services shall be provided in accordance with specifications, terms, and conditions contained in this Performance Work Statement. A Contracting Officer’s Representative (COR) will be appointed to monitor this contract.

5. Work Hours A. Except for emergency callback service, the Contractor shall perform all work during regular working hours of regular working days, Monday-Friday 8:00 AM to 4:30 PM, excluding the Federal holidays noted below:

1. New Year’s Day

2. Labor Day

3. Martin Luther King Day

4. Columbus Day

5. Presidents Day

6. Veterans Day

7. Memorial Day

8. Thanksgiving Day

9. Independence Day

10. Christmas Day

11. Juneteenth National Holiday

6. Deliverables

A. The contractor shall create electronic inspection reports (field service reports) and email them to the COR after the services are rendered and five (5) business days prior to invoicing date. These reports are considered a part of the required services and must be provided prior to invoicing the VA in Tungsten. The COR shall notify the contractor of the acceptance of the report within 7 business days of receipt, so that the contractor can invoice in Tungsten. In addition, if there is online access to the reports, the contractor shall provide the COR with online access to the reports. It is preferred for the contractor to provide online access for report retrieval. The contractor shall maintain a complete, orderly, and chronological filing system of the reports and make available to the COR upon request at any time during the POP and 3 years after the contract expires

1. At a minimum, the reports shall include the following:

a. Name of the service technician that performed the work

b. Type of service performed (i.e., software upgrade, troubleshoot, repair, etc.)

c. Date service was rendered

d. Location of the equipment

e. Line number reference from inventory attachment

f. Notes or remarks applicable to the service performed

g. Recommended/required repairs

B. The contractor shall create electronic a consolidated invoice report and email the report to the COR after the services are rendered and five (5) business days prior to invoicing date. At a minimum the contractor shall use the excel version of the attached inventory listing or better, as the electronic report. These reports are considered a part of the required services and must be provided prior to invoicing the VA in Tungsten. The COR shall notify the contractor of the acceptance of the report within 7 business days of receipt, so that the contractor can invoice in Tungsten. The purpose of this report is to track the services being performed against the required services outlined in the SOW, as well as keeping track of the invoicing to ensure the government is paying for services that were rendered. This report serves as quality control for both, the government, and the contractor. The contractor shall maintain a complete, orderly, and chronological filing system of the reports and make available to the COR upon request at any time during the POP and 3 years after the contract expires.

1. The contractor shall not invoice for any services outlined in this document that were not rendered and shall not invoice prior to the CORs acceptance of all reports.

2. At a minimum, the report shall include the following:

a. Location of the equipment

b. Line number reference from inventory attachment

c. Remaining troubleshooting hours and hours rendered

d. Invoice number

e. Type of service performed (i.e., software upgrade, troubleshoot, repair, etc.)

f. Date service was rendered

g. Invoice amount (as applicable to contract CLINs)

h. A summary of the grand total and the totals by site

7. Records Management Language

A. Applicability

This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes VHA records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their VHA contract.

4. may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs.

21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the

Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, the Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. VHA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of VHA or destroyed except in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage, or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, the Contractor must report to VHA.

The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records, and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records, and/or equipment is no longer required, it shall be returned to VHA control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand-carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material, and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and VHA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with VHA policy.

8. The Contractor shall not create or maintain any records containing any non-public VHA information that is not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The VHA owns the rights to all data and records produced as part of this contract.

All deliverables under the contract are the property of the U.S. Government for which VHA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through

FAR 52.227-20.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take VHA-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

[Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.]

D. Flow down of requirements to subcontractors

1. The Contractor shall incorporate the substance of this clause, its terms, and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

8. VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

The C&A requirements do not apply and a Security Accreditation Package is not required.

A. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

B. VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data- General, FAR 52.227-14(d) (1).

3. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

4. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

C. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

1. VA prohibits the installation and use of personally-owned or contractor/subcontractor owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW or contract. All of the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned OE.

2. All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per 6500.1 requirements. This must be completed within 30 days of termination of the contract.

3. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

(1) Vendor must accept the system without the drive;

(2) VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

(3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

(4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

(a) The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact; and

(b) Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be preapproved and described in the purchase order or contract.

(c) A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed. The ISO needs to maintain the documentation.

D. SECURITY INCIDENT INVESTIGATION

1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

2. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

E. LIQUIDATED DAMAGES FOR DATA BREACH

1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SP/ the contractor/subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the contractor provides payment of actual damages in an amount determined to be adequate by the agency.

2. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

3. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may…