RFQ Information.docx

Table of Contents

TOC …………….…………………………………………………………………………………….1

SECTION B

1. PRICE/COST SCHEDULE

ITEM INFORMATION

The contractor shall provide all labor, personnel, equipment (including locked bins) secured vehicles, supervision, and other related services necessary to perform the services described in the Statement of Work (SOW).

Contract Period: Base POP Begin: 07-01-2021 POP End: 06-30-2022

NF/SG VHS On-Site Document Shredding Services Contract Period: Option 1 POP Begin: 07-01-2022 POP End: 06-30-2023

NF/SG VHS On-Site Document Shredding Services Contract Period: Option 2 POP Begin: 07-01-2023 POP End: 06-30-2024

NF/SG VHS On-Site Document Shredding Services Contract Period: Option 3 POP Begin: 07-01-2024 POP End: 06-30-2025

NF/SG VHS On-Site Document Shredding Services Contract Period: Option 4 POP Begin: 07-01-2025 POP End: 06-30-2026

NOTE: The specified rates under this clause will be those rates in effect pursuant to the CLIN under which the contractor is currently providing services. The option can be exercised at any time and can be exercised in increments of one to six months, but not for more than a total of six months during the life of the contract.

__NSP_______

Page 1 of Page 1 of

2. Statement of Work

Confidential Document Destruction for the North Florida/South Georgia Veterans Healthcare System

1.0—INTRODUCTION

The North Florida/South Georgia Veterans Health System (NF/SGVHS) is comprised of two main campuses and ancillary facilities throughout the area. The locations of the campuses where work under this contract will be performed are:

Malcom Randall VA Medical Center, 1601 S.W. Archer Road Gainesville, FL 32608-1197 Lake City VA Medical Center, 619 S. Marion Ave., Lake City, FL 32025-5808 Ancillary facilities as identified in table A

The objective of this Statement of Work (SOW) is to describe the Contractor’s technical support requirements for a contract to remove and destroy confidential documents generated at NF/SGVHS.

2.0—GENERAL REQUIREMENTS

This section outlines the general requirements under which the Contractor will be expected to perform. Any issues regarding the terms and conditions of this contract shall immediately be brought to the attention of the Contracting Officer Representative (COR) and Contracting Officer (CO).

2.1 Scope of Work

NF/SGVHS employees are in the practice of putting all confidential materials (including white and mixed paper containing VA sensitive information, personally identifiable information and protected health information) in locked bins located throughout all the NF/SGVHS campuses for destruction.

The contractor shall provide all labor, personnel, equipment (including locked bins) secured vehicles, supervision, and other related services necessary to transport this information from NF/SGVHS campuses to the contractor facility or 3rd party facility and ensure the materials are appropriately destroyed, maintaining compliance with VA Directive 6371, Destruction of Temporary Paper Records, throughout the entire process.

The contractor shall deliver and set up locked bins at NF/SGVHS campuses within 30 business days after contract award and approval of Contracting Officer Representative (COR). The bins will provide protection with a security slot that can accept multiple pages of paper at one time. The bins shall be placed at the designated locations directed by the COR (see paragraph 3.1.2.).

2.1.1 On a semiannual basis (June and December) the contractor will provide a listing, in electronic format, with the following information for each bin:

· Location

· Building number

· Room number

· Bin Identification Number

· Bin size in gallons

2.2 Service Frequency and Hours of Operation

Although this medical center operates 24 hours a day 7 days a week, for the purposes of this contract, the standard hours of operation shall be defined as 8:00am through 4:30pm, local time, Monday through Friday, except federal holidays.

The contractor should adhere to the frequency schedule below regarding regular servicing. The servicing can occur on any set business day (Monday through Friday) between the hours of 8:00AM and 3:30PM. The contractor, COR and CO will negotiate the specific day of the week for reoccurring services once contract is awarded. This day should stay consistent, week to week and month to month, barring any unforeseen circumstances. If needed, it can be changed, upon agreement by modification from the CO.

When a regular pick up day occurs on one of the Federal holidays listed below, the pickup day shall automatically shift to the following business day. The ten national holidays observed by the Federal Government are:

New Year’s Day (January 1) Martin Luther King Jr Day (third Monday in January)

***This list may also include any other day specifically declared by the President of the United States to be a national holiday.

2.2.1 Prior to any changes made to the pick-up schedule, the COR will notify the Contracting Officer (CO) in writing of the revised schedule. A revised pick-up schedule will be provided to the contractor in writing along with the contract modification from the CO.

2.3. Contract Management

For this contract, there is one designated CO and one COR located at NF/SGVHS. The CO will issue the Task Order (TO) and the COR will initiate and monitor the TOs for all equipment and services. The COR will have full responsibility for day-to-day document destruction operations, including but not limited to invoice verification and approval and bin relocations and deletions. The Contractor shall designate a local Project Manager to interact with the COR and CO.

3.0—SPECIFIC REQUIREMENTS

3.1. Bin Descriptions and Quantities

The sizes of the provided bins should be a 32-gallon (or similar size), unless specified otherwise. For other areas, 95-gallon (or similar size) container with wheels (so it can be rolled) or 64 gallons, (or similar size) container with wheels (so it can be rolled) is suitable. Each bin/container must have a scannable unique identification number. All 32-gallon bins at a specific location must be keyed alike. Keys may be different from site to site

3.1.1. The estimated quantity and physical location of bins are listed at the end of this SOW.

3.1.2. The amounts and locations listed in Table A are subject to change and will fluctuate as needs change at each campus. Minor changes may be needed and will be determined on a case by case basis. The contractor will provide additional bins or remove bins as the COR advises in writing (hard copy or electronic). The contractor will have up to 10 business days to deliver these bins upon receiving the request. The COR will maintain a written list of bin locations, and the parties agree that this list will be definitive of what service is to be performed from the time the list is published until expiration of the contract period of performance or publication of a revised list.

3.1.3. Occasions may arise where a campus needs extra bins for special projects (i.e. a temporary or one-time removal of large amounts of documents). In the event a special project arises; the CO will notify the contractor and place the request in writing. Following this, the COR will work with the contractor to coordinate the delivery, set up, and removal of bin(s). The contractor will have up to 10 business days to deliver these bins or provide service upon receiving the modification from the CO.

3.1.4. In the event, additional services or bins are needed, the CO is the only government staff member responsible for requesting changes with the contractor. All changes must be documented by contract modification. Once the COR requests and CO authorizes the request for additional service, the contractor will be notified of the request and at that point, shall complete it within 10 business days. Any requests the contractor completes outside of the knowledge and approval from the CO will be considered unapproved. NF/SGVHS will not reimburse the contractor for any unapproved requests or services.

3.1.5. The bins shall be kept locked always to ensure the protection of the confidential materials enclosed. The contractor will provide a set of master keys for each site to the Privacy Officer, and COR. In the event NF/SGVHS staff identify a bin that is unlocked, the COR or Privacy Officer will use his/her master set of keys to lock the bin and notify the contractor. If there are three or more reported instances of the contractor providing unlocked bins, the contractor will need to formally address this noncompliance with staff, and provide documentation of these remediation efforts to the COR.

3.2. Shredding Specifications

3.2.1. The contractor shall provide shredding document destruction services for all secure materials that are collected both in the locked bins and special bulk pick-ups. The contractor will shred paper material in accordance with VA Directive 6371. This directive requires that final destruction of paper records is pulped, macerated, or shredded to a degree that ensures documents are not readable or re-constructible to any degree.

3.2.2. The contractor will shred all collected material onsite via appropriate shredding devices approved by COR and facility Privacy Officers. Prior to beginning performance of the contract, the shredding process will be inspected by COR and/or Privacy Officers during the Post Award Briefing for readiness.

3.2.3. The Contractor will be responsible to ensure Contractor employees providing work on this contract are fully trained and completely competent to perform the required work. The contractor will provide telephone information sufficient to contact management and other contractor officials for customer service during normal business hours. The Contractor will provide a quarterly Diverted Waste report to the COR to account for paper waste tonnage diverted from landfills. Periodic site evaluations with site managers will be conducted to ensure the shredding program is up to date and customized to the specification of the VA.

3.2.4. The contracted facility should either be:

A National Association for Information Destruction (NAID) certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction who has contracted to provide sufficient reasonable safeguards to protect the temporary paper records throughout the entire destruction process; or A non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in the Minimum Standards for Information Destruction listed in Appendix A of VA Directive 6371.

3.3. Certificates of Destruction:

3.3.1. The Contractor shall submit a legible report (Interim) documenting first line destruction, which shall include detailed description of the shredding accomplished on-site. The contractor shall implement reasonable physical safeguards to protect VA temporary paper records during transportation, transfer, or short-term storage prior to the completion of their final destruction. Contractor shall maintain certifications of responsibility and provide documentation to the COR that meet the VA Directive 6371 Final destruction requirements.

3.3.2. Written documentation known as a certificate of destruction (COD) shall be provided by the contractor to attest to that final destruction of records has occurred. The COD can be a memo, letter, or any format attesting to the documents’ complete destruction. The COD should contain sufficient information to attest to the final destruction including:

· the date destroyed

· the name of the campus serviced

· the location of each bin serviced

· the bin identification number

· the timestamp of each bin serviced

· what destruction method was used (i.e. shredding)

· the name and location where final destruction occurred

· the weight (in pounds) of material destroyed The contractor shall send the COD to the COR immediately after destruction is complete. There shall be one COD for each campus.

3.4. Incident Notification:

3.4.1. The contractor shall notify the Privacy Officer immediately after discovery of any incident which may potentially be a data breach. Per the methodology specified by the Department of Health and Human Services (HHS) in guidance issued under §13402(h)(2) of the Health Information Technology for Economic and Clinical Health (HITECH) Act, the contractor’s notice shall include the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the contractor to have been, accessed, acquired, or disclosed during such breach.

3.4.2. The contractor will coordinate with the COR and Privacy Officers to the extent necessary to help remediate any issues related to data breaches that occur once the contractor officially maintained possession of the temporary paper records.

3.5. Contractor Vehicles:

3.5.1. The onsite shredded material must be transported via locked secured vehicles from NF/SGVHS locations to the contractor’s (or subcontractor’s or third party’s) location.

3.5.2. All contractor vehicles utilized in the performance of this contract shall maintain insurance (at least the minimum coverage required by the state where the vehicle is registered) and shall maintain current state vehicle registration.

3.5.3. All contractor employees shall possess a valid state driver’s license and have a clean driving record. The contractor and its employees shall not use personal vehicles to transport containers to and from the government and contractor site while performing under this contract.

3.5.4. The contractor shall ensure that all contractor vehicles used in connection with this contract are kept in proper working condition. The contractor vehicles shall be locked and properly secured at all times while at the government site or travelling to and from contractor site(s). Vehicles used in the performance of the contract shall not be left unattended and unlocked at any time while transporting NF/SGVHS sensitive information.

4.0—CONTRACT MONITORING AND ADMINISTRATION

4.1. Quality Control:

PURPOSE: This QASP is a Government developed document used to ensure that the Government receives quality services and pays only for services provided. The QASP provides a systematic method to evaluate the services the Contractor is required to furnish.

This Quality Assurance Surveillance Plan (QASP) provides a systematic method to evaluate performance for the stated contract. This QASP explains the following:

• What will be monitored?

• How monitoring will take place?

• Who will conduct the monitoring?

• How monitoring efforts and results will be documented?

This QASP does not detail how the contractor accomplishes the work. Rather, the QASP is created with the premise that the contractor is responsible for management and quality control to meet the terms of the contract. It is the Government’s responsibility to be objective, fair, and consistent in evaluating performance.

2. SCOPE: The role of Government Quality Assurance is to ensure contract standards are achieved. The QASP provides guidelines and methods for the Government's oversight of the Contractor's quality control efforts to assure timely, effective services are provided IAW the contract order. The Contractor, and not the Government, is responsible for management and quality control actions to meet the terms of the contract.

3. ROLES AND RESPONSIBILITIES:

Contracting Officer (CO) - A person duly appointed with the authority to enter into, administer and terminate contracts on behalf of the Government. The CO is the only person who can legally commit the Government and only the CO, as the Government's agent, can modify the contract/order. The CO is the final authority for determining the adequacy of the Contractor's performance. CO decisions arising under or relating to the contact are final.

Contracting Officer's Representative (COR) — an individual designated in writing by the CO to perform specific technical and administrative functions within the scope and limitations of their written appointment (e.g., surveillance of Contractor's performance, accept services). The COR is not empowered to make any contractual commitments or authorize any changes to the order/contract or in any way obligate additional funds by the Government; such authority' rests solely with the CO.

4. METHOD OF SURVEILLANCE: Simplified methods of surveillance will be used by the Government to evaluate contractor performance. The primary methods of surveillance are periodic assessments of service and customer feedback.

Periodic Assessment of Services — for services that occur over a number of months, the COR will evaluate Contractor performance on a quarterly basis and upon completion of services. Generally, the Government will rely on the Contractor's Quality Control system to ensure that services conform to contract quality requirements before they are tendered to the Government for acceptance.

Customer Feedback — Customer feedback is typically obtained via telephone or email. Telephonic customer complaints must be followed up in writing/email. To be considered valid, the customer complaint must clearly articulate the nature of the complaint, time, date, etc. The COR will investigate the complaint; if determined valid, the COR will advise the CO and the Contractor of the deficiency. Copies of valid complaints and the resolution must be retained in the official contract file.

5. SURVEILLANCE PROCEDURES:

The COR will evaluate the Contractor's performance quarterly against Performance Standards established in the contract/order. Evaluations will be to the extent practical to assure the contractor provides quality services IAW the requirements of the contract. Evaluations could be evaluation, validation of contractor supplied performance data, as well as analysis of Customer feedback, for performance trends and to ensure valid customer concerns are resolved timely.

If at any time the COR receives indicators (e.g. valid customer complaints or notes Performance Standards are not being met) that the Contractor's performance is less than acceptable, the COR will investigate to determine if this is a onetime issue that has been promptly corrected, or if the discrepancy is systemic in nature. If the issue is determined to be an isolated occurrence, the COR will continue with Quarterly Evaluations. If the issue is recurring and systemic in nature, the COR will perform more frequent evaluations.

The COR will notify the Contractor each time an unacceptable observation has been recorded and ask the Contractor to correct the problem. The COR will record the contract requirement, the specific deficiency to the requirement, the date and time it was discovered, and have the Contractor initial the entry. The Contractor shall be given two working days after notification to correct the deficiency in accordance with requirements of the contract. Deficiencies that cannot be corrected within two working days will be reported to the Contracting Officer.

The COR will re-examine services that are found deficient. Failure to complete corrective actions will be reported immediately to the CO for further action. Upon satisfactory completion of the work, the COR will accept the services provided and authorize payment, by approving the Contractor's invoice in OB10.

6. SURVEILLANCE STANDARD:

The Performance Standard set forth in the SOW and Line items is the standard the Contractor shall meet for services to be deemed acceptable. Generally, under commercial services contracts, the Government is relying on the Contractor's assurances that the services conform to contract requirements. Consistent with FAR 52.212-4, Contract Terms and Conditions, (a) Inspection and Acceptance, the Contractor shall only tender for acceptance those services that conform to the requirements of the contract/order. The Government may require re-performance of nonconforming services at no increase in contract price. The Government reserves the right to refuse acceptance of nonconforming services. In no case shall the Government's right to inspect services under the inspection clauses of the contract be prejudiced.

7. PERFORMANCE REQUIREMENT STANDARDS:

The Government shall use the standards below to determine contractor performance and shall compare contractor performance to the Acceptable Quality Level (AQL).

Rating

Unsatisfactory = Not per Schedule or at all.

Unsatisfactory = not received on time or not at all

Unsatisfactory= Invoices Not Received on Time

Unsatisfactory= misconduct complaint received

8. RECORDS: All records will be retained for the life of this contract. The COR will forward these records to the CO upon completion of the contract/order.

9. The contractor shall only tender for services properly performed in accordance with the SOW and AQL.

4.2. Safety:

4.2.1. The contractor shall have a documented and comprehensive Health and Safety program to ensure all shredding activities are provided in a safe and secure manor.

4.3. Payment and Invoicing:

4.3.1. The contractor shall only invoice and receive payment for bins that are serviced during the billing period. Servicing will be documented on a receipt of temporary records, which will identify the location of every bin the contractor comes in contact with during the scheduled pick up day. Servicing can include the complete swap of a used bin with an empty bin. Servicing can also include the contractor observing a bin to note it is empty and leaving it in place for the following week. In the event the contractor leaves an empty bin in place, the contractor still needs to account for said bin on the receipt. In the event the contractor fails to empty/replace a bin because they missed it, they have 24 hours from the time of notification to empty/service the container and provide the COR the receipt. If a bin cannot be serviced, the contractor shall notify the COR of the reason that the bin was not able to be serviced.

4.3.2. The contractor must, prior to departing each NF/SGVHS campus for the day, provide the certificate of destruction to the COR or designated representative who will forward the COD to the COR. This documentation is required per VA Directive 6371 and is critical for privacy and information security matters. If the contractor does not provide this documentation to the designated representatives on the day of servicing before leaving the campus, the COR is unable to establish appropriate custody of the sensitive documents. Therefore, the COR will not be able to pay for the bins serviced that day, as the facility will be noncompliant with VA Directive 6371. This is a zero-tolerance matter.

4.3.3. In the event a discrepancy arises in which NF/SGVHS staff advise a bin was not emptied for the week, the contractor will work with the COR to resolve the matter. The contractor can either come back to NF/SGVHS within 48 hours to service that bin or not include fee for the bin on the monthly invoice.

4.3.4. The facility will pay the contractor for each bin serviced as noted on the receipts of temporary records. Reimbursement rates will be established for each service shown below as part of the bid/award process:

· price for servicing one 95-gallon bin

· price for servicing one 64-gallon bin

· price for servicing one 32-gallon bin

· price for servicing one temporary 95-gallon bin for special projects, as described in paragraph 3.1.3.

· price for shredding one standard records box (1800 cubic inches), as described in paragraph 3.1.3.

4.3.5. The contractor will submit a consolidated invoice monthly. This invoice shall encompass the total amount billed, based on the total number of bins serviced at all campuses throughout the entire month. The COR will compare the weekly receipts of temporary records for each campus to calculate the total amount owed for the month. Due to special projects and the possible fluctuation of the quantity of bins, the monthly invoice total is expected to vary.

4.4. Security Requirements:

4.4.1. Due to the sensitive nature of equipment and data present at all NF/SGVHS locations, contractor personnel requiring facility access shall meet the NF/SGVHS Security Program Procedural Requirements to obtain badges, complete information security and privacy training, and sign the Rules of Behavior. An escort will be provided when required for access into restricted work areas. All security requirements must be met, and the employees must be cleared prior to the contractor performing work under the contract. Employees that cannot meet the security requirements and clearance requirements will not be allowed to perform work under this contract. Upon contract award, COR will assist awardee to ensure the appropriate type of background investigation and/or fingerprints are initiated, and ultimately completed, on contract personnel in accordance with the contract terms and conditions and the VA/VHA Directive and Handbook 0710 Series. This also includes any required training for contract personnel (e.g. VA Cyber Security Awareness, VHA Privacy Policy, etc.) including Compliance and Business Integrity (CBI) Training. The COR will work security issues with the Contractor, as needed, to ensure that sensitive, private, and protected information is safeguarded. While on NF/SGVHS premises, contractor’s employees will strictly adhere to current procedures for registering entry, wear of identification/visitor badge, and departure from NF/SGVHS. Alternatively, Contractor personnel who expect to be at NF/SGVHS frequently may undergo an appropriate level background investigation for their level of access and complete specified training needed to obtain a longer-term badge unique to the person holding it.

Talent Management System (TMS) Self – Enrollment Instructions link: http://vaww.visn8.portal.va.gov/northflorida/cos/education/shared/MSE-Profile-Creation-Contractors-JobAid-508.pdf Required Classes:

4.4.2. Under HIPAA Privacy and Security Rules, the contractor providing services under this contract has access to protected health information and is not considered to be a “covered entity.” Thus, the contractor is required to enter into a Business Associate Agreement with VA or provide a copy of a National Business Associate Agreement already in place.

GENERAL:

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS:

A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE:

Information made available to the contractor or subcontractor by VA for the Performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

Prior to termination or completion of this contract, contractor/subcontractor must Not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

If a VHA contract is terminated for cause, the associated BAA must also be Terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

The contractor/subcontractor must store, transport, or transmit VA sensitive Information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

SECURITY INCIDENT INVESTIGATION:

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH:

including the following:

4.5. Contract Transition:

4.5.1. In the event NF/SGVHS awards a follow-on contract to other than the incumbent contractor, the contractor will cooperate to the extent required to allow for an orderly changeover to the successor contractor. This transition shall be as smooth and transparent as possible to ensure no interruption in the services currently being provided.

NF/SG Veterans Health System Note: POC information for each location will be provided at the time of the contract kick-off

COJ-Sun Center 201 SE 2nd Ave Ste. 215 Gainesville, FL 32607

Tues -Fri

Weekly

Bi-weekly

Bi-weekly

Bi-weekly

Bi-weekly

Bi-weekly

Bi-weekly

Weekly

Weekly

Weekly

Bi-weekly

Bi-weekly

Bi-weekly

Weekly

Weekly

Bi-weekly

Every 4 weeks

Bi-weekly

Bi-weekly

Bi-weekly

Bi-weekly

Bi-weekly

Every 4 weeks

Weekly

Weekly

Bi-weekly

Marianna CBOC 4970 Highway 90 Marianna, FL 32446

Bi-weekly

MAS Lease (Coding) 6020 NW 4th Pl Ste. D Gainesville, FL 32607

Bi-weekly

Bi-weekly

Every 4 weeks

Every 4 weeks

Bi-weekly

Weekly

Bi-weekly

Bi-weekly

Bi-weekly

Bi-weekly

Every 4 weeks

Bi-weekly

Weekly

Bi-weekly

Bi-weekly

Bi-weekly

Bi-weekly

Every 4 weeks

Weekly

Bi-weekly