RFQ 36C26324Q1187v2.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C26324Q1187

6. SOLICITATION ISSUE DATE

9-10-2024 kathleen.bain3@va.gov (319) 338-0581 635541 09-20-2024

10:00 CDT

36C263 Department of Veterans Affairs Network 23 Contracting Office (NCO 23) VA Black Hills HCS Fort Meade Campus 113 Comanche Rd.

Fort Meade SD 57741

X 100

X

492110

1500 Employees

N/A

X

36C368

Department of Veteran Affairs Iowa City VA Medical Center

601 Highway 6 West Iowa City IA 52246

36C263

Department of Veterans Affairs Network 23 Contracting Office (NCO 23) VA Black Hills HCS Fort Meade Campus 113 Comanche Rd.

Fort Meade SD 57741

Department of Veterans Affairs

FMS-VA-2(101)

Financial Services Center PO Box 149971 Austin TX 78714-9971

See CONTINUATION Page

Courier Services - Multiple Locations - Iowa City VA Medical Center.

Contractor to provide all labor, materials, transportation and services to fulfill the Courier Services requirement for the Iowa City VA Health Care System as described in the Statement of Work.

Service Contract Labor Standards and Department of Labor wage determinations apply.

See CONTINUATION Page

X X

X 1

Jesse Sweesy

VA-VHA-RPOC-2023-0042

36C26324Q1187

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 Statement of Work

B.3 PRICE/COST SCHEDULE

ITEM INFORMATION

SECTION C - CONTRACT CLAUSES

C.1 IT CONTRACT SECURITY

C.2 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES (NOV 2023)

C.3 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.4 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000) ...32

C.5 SUPPLEMENTAL INSURANCE REQUIREMENTS

C.6 VAAR 852.211-76 LIQUIDATED DAMAGES – REIMBURSEMENT FOR DATA

BREACH COSTS (FEB 2023) ALTERNATE I (FEB 2023)

C.7 VAAR 852.219-73 VA NOTICE OF TOTAL SET-ASIDE FOR CERTIFIED

SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESSES (JAN 2023)

(DEVIATION)

C.8 VAAR 852.219-75 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING—

CERTIFICATE OF COMPLIANCE FOR SERVICES AND CONSTRUCTION (JAN 2023)

(DEVIATION)

C.9 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV

2018)

C.10 VAAR 852.237-75 KEY PERSONNEL (OCT 2019)

C.11 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020) ..40

C.12 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.13 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (MAY 2024)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (SEP 2023)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.3 52.204-29 FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT

ORDERS—REPRESENTATION AND DISCLOSURES (DEC 2023)

E.4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

E.5 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.6 VAAR 852.233-71 ALTERNATE PROTEST PROCEDURE (OCT 2018)

E.7 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.8 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (NOV 2021)

ADDENDUM to 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

E.9 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (MAY 2024)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C263

Department of Veterans Affairs

Network 23 Contracting Office (NCO 23)

VA Black Hills HCS Fort Meade Campus

113 Comanche Rd.

Fort Meade SD 57741

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Bi-Weekly (Every two weeks)

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 Statement of Work

STATEMENT OF WORK

SERVICES PROVIDED:

The Contractor shall provide all supervision, labor, equipment, transportation, insurance, licensing, fees, fuel, and tolls necessary to perform Courier Services, from the VA Outpatient Clinics (CBOCs) to the Pathology & Laboratory Medicine Service at the VA Medical Center, 601 Highway 6 West, Iowa City, IA (ICVHACS).

The contractor shall provide all labor, equipment, including Personal Protective Equipment (PPE), hand trucks, transportation, gasoline, insurance, and any other supplies needed to provide courier service for the ICVHACS.

The effective period of the contract shall include one base year covering 10/03/2024 – 10/02/2025, with four additional option years exercised at the Government’s discretion.

Pickup/Drop Off Locations:

The contractor shall provide courier services for all sites listed below. 1 Driver per pickup location is required in order to ensure there are no unnecessary delays in transport.

The pick-up locations are located at the following 11 addresses:

Quad Cities VA Clinic 2826 West Locust St Davenport, IA 52804

(563) 332-8528

Burlington VA Clinic 1000 Roosevelt Ave Suite 7 Burlington, IA 52601

(319) 752-3722

Cedar Rapids VA Clinic 3500 Dalton Way SW Suite 400 Cedar Rapids, IA 52404

(319) 369-4340

Decorah VA Clinic 915 Short St Decorah, IA 52101 563-387-5840

Department of Veterans Affairs Medical Center 3600 30th Street Des Moines, IA 50310-5774

(515) 699-5999

Dubuque VA Clinic 2600 Dodge St Suite A1 Dubuque, IA 52001

(563) 588-5520

Galesburg (Lane Evans) VA Clinic 310 Home Blvd Galesburg, IL 61401

(309) 343-0311

Ottumwa VA Clinic 1020 N Quincy Ave Suite 1 Ottumwa, IA 52501

(641) 683-4300

Quincy VA Clinic 6020 Broadway Street Quincy, IL 62301

(217) 224-3366

Sterling VA Clinic 2901 East Lincolnway Suite M Sterling, IL 61081

(815) 632-6200

Waterloo VA Clinic 945 Tower Park Drive Waterloo, Iowa 50701

(319) 235-1230

TRAINING:

The Contractor shall ensure the confidentiality of all patient information being transported and will be held liable in the event of breach of confidentiality. The Contractor shall comply with the provisions of the Federal Privacy Act of 1974 (Public Law 93-579) and Health Information Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Parts 160 and 164.

Inadvertent contact with proprietary information – privacy/release of information: In the performance of contract services, the contractor shall observe the requirements imposed by law, federal regulation, and VA statutes and policies concerning privacy and/or release of sensitive data/information. The contractor shall ensure that their personnel meet these requirements, and that confidential and proprietary information shall be released only to those officers and officials of the VA or contractor authorized to receive such information.

The Contractor shall provide safe transport of all biomedical materials. This must include the proper receipt, distribution, storage, and security of patient specimens in accordance with all federal regulations governing the safe transport of the materials including but not limited to the following:

Contractor must provide documentation of employee training for Blood Born Pathogens, HIPAA and for shipping of biohazardous materials, Class 6, Division 6.2=Category B infectious materials.

The following training Certificates must be submitted to the VA 1 week prior to an employee beginning performance of the Courier Services:

1. Department of Transportation 49 CFR Parts 171-180 – Hazardous Materials: Infectious Substances; Final Rule.

2. Department of Labor/OSHA 29 CFR, Section 1910.1030-Bloodborne Pathogens.

3. Proof of qualified HIPAA training

VEHICLES:

All vehicles used in performance of this contract shall be registered, licensed and meet the minimum vehicle requirements as mandated by the Department of Transportation. It is important that the contractor has safe vehicles that dependably operate in difficult weather conditions to support high priority needs such as Laboratory services. The Government reserves the right to inspect the vehicles to validate contractor’s ability to perform.

All transported samples shall not be unsecured or left in unattended vehicles or extreme hot/cold environments. Temperature for lab specimens: RT (room temperature) items 20-25C for, Refrigerated items 2-10C and frozen items ≤ -18C.

Vehicles must provide protection for the items being transported to prevent exposure to weather (direct sunlight, heat, rain, snow, water, etc) or extreme internal variations (heat/air conditioning) in order to protect specimen integrity.

DRIVERS:

All drivers must be of legal age, possess a valid state driver’s license, and maintain a neat, clean and professional appearance. Drivers shall possess identification showing the person’s name and job title.

The contractor shall be responsible for the actions and conduct of its employees and shall ensure they comply with all VA facility and parking regulations, policies, and guidelines while conducting business for the contract. Drivers shall not make any personal stops in performance of duties under the contract, nor shall any unauthorized passenger accompany the driver during contracted services.

Drivers shall comply with the VA smoking policy and only smoke in designated areas. Smoking within vehicles shall not take place while transporting VA items. This includes e-cigarettes and the like. Any incident of smoking while transporting samples can potentially damage the samples/property and shall be reported to the Contracting Officer and the Awardee for immediate resolution. Multiple occurrence may result in the driver no longer being able to transport VA samples.

Drivers transporting laboratory specimens must be trained in Universal Precautions for handling of biohazard materials and follow proper procedures in case of biohazard spills or accidents.

Training shall also include mandatory Hazardous Materials training (as listed above in the training section). The contractor shall provide initial written documentation of training as well as annually and at the beginning of the driver’s employment, of Hazardous Materials and any other training that meets the laws and regulations of the US Department of Transportation and the Centers for Disease Control governing the transport of clinical specimens.

Personnel working for the contractor shall not be considered Government employees.

The contractor shall provide a copy of all the names and contact information for the courier drivers. The contractor shall supply their employees with a name badge and/or uniform with their name emblazoned upon it and ensure it is worn for proper identification when the contractor or contractor’s personnel are providing the courier services and while on site at the Government facility. Couriers must be positively identified by VA staff prior to picking up specimens being released for transport.

Contracted agency shall complete background investigations prior to the employee starting services to insure employees do not have a record of criminal offenses and employees are properly licensed and insured. A list of vetted drivers will be provided to the Government prior to any driver picking up specimens and for all new hires.

The contractor may have patient contact during the performance of this requirement. Physical or verbal abuse of patients or VA employees will not be tolerated. If either type of abuse is witnessed, the contractor personnel will be immediately removed from this requirement and not allowed to return. If a patient confronts the contractor or otherwise tries to engage the contractor in adverse behavior, the contractor will remain calm and contact VA employees, the COTR or the VA/local Police for assistance.

It is the federal policy to create an environment free of discrimination and to promote an atmosphere for the residents, visitors, and workforce free of discrimination and/or harassment, without regard to race, color, sex, national origin, age, physical or mental handicap.

It is the responsibility of the contractor awarded a contract to perform services on a federal worksite to take all necessary measures to prevent sexual harassment and discrimination from occurring, by assuring that his/her employees and those of his/her subcontractors maintain the highest degree of conduct and standards in this regard.

These steps should include, but not be limited to, affirmatively raising the subject with employees from other than contractor related personnel, i.e., VA personnel, patients, and/or visitors shall be reported to the contracting officer in charge of the awarded contract.

The government will not be responsible or held liable for any loss, damage, personal injury, or loss of like of contractor personnel, not caused by the fault, negligence, wrongful omission of the government, its agents, or its employees, occurring at any time such personnel are entering, exiting, using, or occupying government property or facilities in performance of this contract.

The contractor shall be liable and will indemnify and hold harmless the government, it agents and employees, against all actions or claims for damages to persons, property, including death not caused by the fault, negligence, wrongful act, or wrongful omission of the government, its agents, or employees. The contractor shall be liable and will indemnify and hold harmless the government, its agents and employees against all action or claims for all damages to persons or property, including death arising or resulting from the fault, negligence, wrongful act, or wrongful omission of the contractor personnel in accordance with the Federal Tort Claim Act (28 U.S.C.

2671-2680)

All contractor personnel shall meet minimum physical requirements including occasional standing, walking, pushing, pulling, bending, and daily driving. Frequent lifting of 5 to 35 lbs. is required.

Service Contract labor standards and DOL Wage determinations apply to this procurement.

ITEMS TO BE TRANSPORTED:

Specimen transport containers for delivery/pickup are approximately:

Bag with wheels: 15.5 x 9.5 x 22 Small size: 7.25 x 7.25 x 10.25 Medium size bag: 9 x 9 x 16 Large bag: 24 x 16.5 x 12

Vehicles must be appropriately sized to ensure proper transport of the specimen containers.

Laboratory specimens, i.e., body fluids, will be properly packaged by the VA personnel for transportation and will be placed in the shipping container. Contractor does not package specimens.

Empty transport bags will be picked up from Iowa City VA by courier delivering VA specimens, and delivered back to all contracted locations the following day.

PICK-UP TIMES:

The driver will pick up samples within the prescribed pickup window listed below. These pickup and drop off times shall not be adjusted or modified without Contracting Officer (CO) or

Contracting Officer Representative (COR) expressed approval. Pick-ups shall be according to the following schedule:

Quad Cities VA Clinic 3:45 – 4:15 PM CST Monday – Friday Burlington VA Clinic 3:45 – 4:15 PM CST Monday – Friday Cedar Rapids VA Clinic 3:45 – 4:15 PM CST Monday – Friday Decorah VA Clinic 3:45 – 4:15 PM CST Monday – Friday Des Moines CIHCS 3:45 – 4:15 PM CST Monday – Friday Dubuque VA Clinic 3:45 – 4:15 PM CST Monday – Friday Galesburg VA Clinic 3:45 – 4:15 PM CST Monday – Friday Ottumwa VA Clinic 3:45 – 4:15 PM CST Monday – Friday Quincy VA Clinic 3:45 – 4:15 PM CST Monday – Friday Sterling VA Clinic 3:45 – 4:15 PM CST Monday – Friday Waterloo VA Clinic 3:45 – 4:15 PM CST Monday – Friday

All pick-ups shall be delivered directly to the Pathology & Laboratory Medicine, Service, Room BW120, 601 Highway 6 West Iowa City, IA 52246-2209 Phone Number (319) 338-0581 x 635500 No Later than 7:45 PM Daily.

Courier must notify COR of any known possible delays due to inclement weather or extenuating circumstances, with at least two hours advanced notice and agreement from COR. Urgent unknown delays must be identified and reported immediately.

The Government will require a written report from the contractor when pick-up and delivery incidents are documented as being untimely. This report will be due within 24 hours of request.

The eleven (11) federal holidays observed by the Federal Government are as follows:

New Years Day Martin Luther King Day Presidents Day Memorial Day Juneteenth Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Christmas Or any additional National Holidays that are proclaimed by the President of the United States.

Government Points of Contact:

The contracting officer (CO) is the only person authorized to approve changes or modify any of the requirements for each facility under this contract. A contracting officer is the only authorized person to make a commitment or issue changes which will affect price, quantity, or quality of performance within this contract. In the event the contractor effects any such change at the direction of any person other than this contracting officer, the change shall be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof.

Any unauthorized personnel indicating any such changes as a listed in the above paragraph shall be reported directly to the Contracting Officer.

Contracting Officer Representative (COR): The Contracting Officer will delegate certain authority to the following individual who shall serve in the capacity of Contracting Officer’s Representative:

TBD

CORRESPONDENCE: All correspondence relative to this contract shall bear at a minimum the Department of Veterans Affairs purchase order number, contract number and be addressed to the Contracting Officer.

CONTRACTORS NOTICE: The COR, OR THEIR DESIGNEE, SHALL BE NOTIFIED within two hours, by phone, of Contractor’s actual or constructive knowledge of conditions which may adversely affect Contractor’s ability to perform contract requirements.

INVOICES:

All payments will be submitted electronically through the VA Tungsten website as described below. All payments will be made in arrears.

Invoices will be electronically submitted to the Tungsten website at https://www.tungsten-network.com/us/support/ Tungsten direct vendor support number is 877-489-6135 for VA contracts. The VA-FSC pays all associated transaction fees for VA orders. During Implementation (technical set-up) Tungsten will confirm your Tax Payer ID Number with the VA- FSC. This process can take up to 5 business days to complete to ensure your invoice is automatically routed to your Certifying Official for approval and payment. In order to successfully submit an invoice to VA-FSC please review “How to Create an Invoice” within the how to guides. All invoices submitted through Tungsten to the VA-FSC should mirror your current submission of Invoice, with the following items required. Clarification of additional requirements should be confirmed with your Certifying Official (your CO or buyer). The VA-FSC requires specific information in compliance with the Prompt Pay Act and Business Requirements. For additional information, please contact:

Tungsten Support:

Phone: 1-877-489-6135 Website: https://www.tungsten-network.com/us/support/ Department of Veterans Affairs Financial Service Center:

Phone: 1-877-353-9791 Email: vafscched@va.gov

Quality Assurance Surveillance Plan (QASP) The below table will be used for initial, annual and routine surveillance of contract.

Services Section

Reference Indicator Acceptable

Quality Level

(AQL)

Method of Surveillance

Completion of Required trainings for each Courier

Training Initial submission of certificates prior to contract start.

Annually or within 1 week for new hires thereafter

100% 100% Inspection of submitted certificates

Employee Background Checks

Drivers 1 week after award or initial hire

95% 100% Inspection

Pickup-Times: PICK-UP

TIMES

Daily 95% 100% Inspection

RECORDS MANAGEMENT OBLIGATIONS

A. Applicability This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes Iowa City VAHCS records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their Iowa City

VAHCS contract.

4. may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law.

Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. Iowa City VA HCS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of Iowa City VAHCS or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to Iowa City VAHCS. The agency must report promptly to NARA in accordance with 36

CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to Iowa City VA HCS control or the Contractor must hold it until otherwise directed.

Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and Iowa City VA HCS guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with Iowa City VAHCS policy.

8. The Contractor shall not create or maintain any records containing any non-public Iowa City VAHCS information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The Iowa City VA HCS owns the rights to all data and records produced as part of this contract.

All deliverables under the contract are the property of the U.S. Government for which Iowa City VA HCS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

D. Flowdown of requirements to subcontractors

1. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

B.3 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

1.00 JB __________________ __________________

BASE YEAR COURIER SERVICES TO SUPPORT IOWA CITY

HEALTHCARE SYSTEM AS PER THE STATEMENT OF WORK. PERIOD OF

PERFORMANCE 10/3/2024-10/02/2025.

Contract Period: Base POP Begin: 10-03-2024 POP End: 10-02-2025

Option YEAR 1 COURIER SERVICES TO SUPPORT IOWA CITY

HEALTHCARE SYSTEM AS PER THE STATEMENT OF WORK. PERIOD OF

PERFORMANCE 10/3/2025-10/02/2026.

Contract Period: Base POP Begin: 10-03-2025 POP End: 10-02-2026

Option YEAR 2 COURIER SERVICES TO SUPPORT IOWA CITY

HEALTHCARE SYSTEM AS PER THE STATEMENT OF WORK. PERIOD OF

PERFORMANCE 10/3/2026-10/02/2027.

Contract Period: Base POP Begin: 10-03-2026 POP End: 10-02-2027

Option YEAR 3 COURIER SERVICES TO SUPPORT IOWA CITY

HEALTHCARE SYSTEM AS PER THE STATEMENT OF WORK. PERIOD OF

PERFORMANCE 10/3/2027-10/02/2028.

Contract Period: Base POP Begin: 10-03-2027 POP End: 10-02-2028

Option YEAR 3 COURIER SERVICES TO SUPPORT IOWA CITY

HEALTHCARE SYSTEM AS PER THE STATEMENT OF WORK. PERIOD OF

PERFORMANCE 10/3/2028-10/02/2029.

Contract Period: Base POP Begin: 10-03-2028 POP End: 10-02-2029

GRAND TOTAL __________________

SECTION C - CONTRACT CLAUSES

C.1 IT CONTRACT SECURITY

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus.

If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default "program files" directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f. The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

g. The contractor/subcontractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

(a) The Systems of Records (SOR); and

(b) The design, development, or operation work that the contractor/ subcontractor is to perform;

(1) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a SOR on individuals that is subject to the Privacy Act; and

(2) Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a

SOR.

h. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/subcontractor is considered to be an employee of the agency.

(1) "Operation of a System of Records" means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

(2) "Record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person's name, or identifying number, symbol, or any other identifying particular assigned to the individual, such as a fingerprint or voiceprint, or a photograph.

(3) "System of Records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

i. The vendor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as "Systems"), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems.

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than days.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to the VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within days.

l. All other vulnerabilities shall be remediated as specified in this paragraph in a timely manner based on risk, but within 60 days of discovery or disclosure. Exceptions to this paragraph (e.g.

for the convenience of VA) shall only be granted with approval of the contracting officer and the VA Assistant Secretary for Office of Information and Technology.

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

a. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerablity scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor's security control procedures must be equivalent, to those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COR and approved by VA

Privacy Service prior to operational approval. All external Internet connections to VA's network involving VA information must be reviewed and approved by VA prior to implementation.

b. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

c. Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the contractor's systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA OCS Certification Program Office. Government- owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

d. The contractor/subcontractor's system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the ISO for entry into VA's POA&M management process. The contractor/subcontractor must use VA's POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with contractor/ subcontractor activities must also be subject to such assessments. If major changes to the system occur that may affect the privacy or security of the data or the system, the C&A of the system may need to be reviewed, retested and re- authorized per VA Handbook 6500.3. This may require reviewing and updating all of the documentation (PIA, System Security Plan, Contingency Plan). The Certification Program Office can provide guidance on whether a new C&A would be necessary.

e. The contractor/subcontractor must conduct an annual self assessment on all systems and outsourced services as required. Both hard copy and electronic copies of the assessment must be provided to the COR. The government reserves the right to conduct such an assessment using government personnel or another contractor/subcontractor.