S02 CS Attachment B Scope of Work Sol 36C24822Q0842.pdf

Combined Synopsis 36C24822Q0842

0B.2 SCOPE OF WORK

DESCRIPTION/SPECIFICATION/STATEMENT OF WORK

TERM OF CONTRACT

The resulting contract will contemplate a one (1) year Base Period and four one (1) year Option Period. The effective date of contract is to be determinate based on award processing time after evaluation of quotation.

GENERAL

The contractor shall furnish preventive maintenance (PM) service and repairs for the Integrated Security Electronic System at the San Juan, Puerto Rico VA Caribbean Healthcare System (VACHS), Ponce Outpatient Clinic (POPC), Arecibo Community Base Outpatient Clinic (ACBOC), Guayama Community Base Outpatient Clinic (GCBOC), Utuado Rural Outpatient Clinic, Comerio Rural Outpatient Clinic, St Thomas Community Base Outpatient Clinic (St. Thomas CBOC) and St Croix Community Base Outpatient Clinic (St. Croix CBOC), Ceiba Outpatient Clinic (COPC), Vieques Rural Outpatient Clinic and VACHS Carolina Warehouse.

The Contractor shall furnish all labor, supplies/parts, materials, tools, travel/transportation, shipping expenses, and supervision necessary to accomplish the service described herein. Firmware updates for APC’s panels are not included in the contract.

Quotation will be considered only from offerors who are regularly established in the business called for, who are financially responsible, and able to show evidence of their reliability, ability, experience, facilities and personnel directly employed or supervised by them to render prompt and satisfactory service.

Contractor shall, or have the capability, to be a distributor or access to original replacement parts in support to schedule equipment for the Software House CCURE product line. The Contractor shall have technicians certified by C-Cure 9000 Management Software, Software House I Star control Panel, Exacqvision NVR Systems, APC, APC Control panels, DSC Alarm Systems, CAT-6 Certifier.

Also, shall maintain adequate stock to support the system and the equipment identified herein and provide system upgrades as part of the maintenance program; which includes phone support and updates released. This facility is currently using C-CURE 9000 Version 2.90.

The contractor shall have adequate knowledge to accomplish complete maintenance and repairs to the system. Along with quote submission, quoter shall furnish to the procurement point of contact the following information: Demonstration of Experience with the product by submitting three (3) references (address, contact person and phone numbers) of similar Software House CCURE 9000 systems that have been installed and are presently being maintained by the contractor, a list of qualified personnel who will perform under this contract, showing length and type of experience with the system covered under this contract. Also, identify training received by Software House on the CCURE 9000, APC, APC Control Panels, DSC alarm systems.

Contractors shall conduct a site visits to location listed in the first paragraph of this section, General, prior to quotation submission and contract execution to acquaint themselves with the conditions as they actually exist and verify quantity of all components included in this documents.

Failure to do so will not relieve the contractor from performing in accordance with the contract requirements.

STATEMENT OF WORK

General maintenance Requirements:

Contractor shall furnish a 3 day in-house technical support preferably Monday, Wednesday and Friday from 8:00am to 5:00pm at the VA Medical Center in San Juan, VACSH. Any changes in schedule will be done thru communication directly with the Contracting Officer Representative (COR).

Primary Responsibility: To provide accurate technical and operational support to VACHS CCTV, Access Control Management System, Intrusion Alarms Security, video, and security networking systems. Troubleshoot related problems and preventive maintenance. Recommended and implement resolution strategies in conjunction with COR.

Service or Emergency Calls: Will be a four (4) hour on-site response time when the In-House Technician is not present. This is to include after normal working hours, weekends, Federal and Local holidays.

Contractor shall furnish all labor for normal, routine maintenance. Components of the system includes, both audio and visual, such as motion detectors, wiring, microwaves, modems, circuitry, duress buttons, electronic/IP cameras, monitors, DVR’/ NVR’s, switches, alarms, card readers, computers, boards, intercoms, equipment for data transmission and storage, and other items described herein for the following medical facilities in Puerto Rico and the US Virgin Islands:

VA Caribbean Healthcare System (VACHS) San Juan, Ponce Outpatient Clinic (POPC), Arecibo Community Base Outpatient Clinic (ACBOC), Guayama Community Base Outpatient Clinic (GCBOC), Utuado Rural Outpatient Clinic, Comerio Rural Outpatient Clinic, St Thomas Community Base Outpatient Clinic (St. Thomas CBOC), St Croix Community Base Outpatient Clinic (St. Croix CBOC), Ceiba Outpatient Clinic (COPC), Vieques Rural Outpatient Clinic and VACHS Carolina Warehouse.

Service shall include one (1) PM on a monthly basis. The Contracting Officer Representative (COR) shall approve PM schedule. This also includes equipment and components that send information to equipment and components at the Police Service. Maintenance service shall consist of inspection, cleaning, dust control, lubrication when appropriate, adjustment, calibration, reprogramming after memory loss and replacement of nonfunctioning equipment. All material used in the course of normal, routine, testing and inspections are to be included. All parts shall be provided and replaced as necessary at no additional charge. All testing and inspection of appropriate equipment will be done in accordance with the manufacture’s recommendations and VA standards. Applicable codes and inspection certificates will be displayed as appropriate. Contractor shall maintain equipment in complete operating condition. All components and accessories of the system will be covered under this contract, including adjustment of door switches, cameras, etc. This includes relays that are installed to activate a device or send a signal from a device, such as, but not limited to gates and doors. Contractor will maintain an adequate inventory of parts and components for immediate replacement or repair of malfunctioning equipment. The system shall be left functional at the close of each workday.

There will be no additional charge for time spent at the site during, or after normal hours of coverage awaiting the arrival of additional Service Technicians and/or delivery of parts.

Contractor must be able to obtain a security clearance, they will be provided with remote access to the VHASAJAPVICTOR and VHASAJAPPLYNX virtual servers, to be able to service the same in the event of malfunction, service interruptions, updates and other events that may occur. To obtain the remote access contractor will complete and maintain a background investigation, will complete mandatory TMS training as mandated by ITOPS and ISO.

Contractor must abide by the Department of Veterans Affairs Information Security Rules of Behavior for Organizational Users which identifies specific responsibilities and expected behavior for organizational users of VA information and information systems as required by Office of Management and Budget Circular A-130, Appendix I, paragraph 4h (6-7) and VA Directive 6500, VA Cybersecurity.

These rules of behavior are included in the annual VA Privacy and Information Security Awareness and Rules of Behavior training.

Replacement Parts/components:

The Contractor will repair or replace worn parts with new components of quality acceptable to the COR or his/her designee and fully compatible with equipment services. All parts shall be of current manufacturer and shall have full versatility/compatibility with presently installed equipment. Contractor shall furnish only new standard parts (manufactured by make of equipment or equal thereto). The Contractor shall immediately replace any unacceptable parts at no additional cost. Each service technician shall carry all tools and test equipment necessary to perform all preventive maintenance and repairs. They will also carry necessary parts to complete all PM calls.

The equipment that is currently installed are listed as following:

1. VACHS/OPA ACCES CONTROL

Qty Description 1 Ccure 800 Application Software SSA 10 Apc Control Panel 8 readers 4 Apc’L Control Panel 2 readers 30 APS Power Supply

241 Proximity Readers 211 Request to Exit Device 211 Status Switch 2507AD 10 Star Coupler Module 9 Electric Door Strike

202 Electromagnetic Lock 107 Power Supply 24-3 w/battery 9 Delay Egress System 40 Input/ output Board 12 Istar Pro 16 readers panel

7 Istar Ultra SE 16 readers panel 72 Istar EDGE POE-1 reader Panel 1 Istar Ultra EX 37 I/O Input Boards 8 Output Boards

1 APC I/32 INPUT BOARD

66 RM-4 Personality Module

100 HUB-M Panic Buttons

2. VACHS/Pharmacy/ Access Control OPA Qty Description 1 Ccure 800 Application Software SSA 5 Apc Control Panel 8 readers 1 Istar Pro 16 readers panel 6 APS Power Supply 40 Proximity Readers 24 Request to Exit Device 24 Status Switch 2507AD 5 Star Coupler Module 12 Electric Door Strike 1 Electromagnetic Lock 1,200lbs 6 Power Supply 24-6 w/battery 1 Interlock Power Supply SDC631RF 2 Lantronix US110000 11 Electromagnetic Lock 600lbs 31 RM-4 Personality Module

3. VACHS/OPA Cashier

2 Apc Control Panel 8 readers 2 APS Power Supply 1 Lantronix US110000 16 Proximity Readers 8 Status Switch 2507AD 2 Star Coupler Module 2 Power Supply 24-3 w/battery 8 Request to Exit Button PBE 8 Electromagnetic Lock 600lbs.

16 RM-4 Personality Module 4 I/O Input Boards 32 HUB-M Panic Buttons

4. Ponce CCTV

28 Analog Cameras

2 DVR

1 19” Color monitors LCD-TFT

1 DVR 500GB HDD

5. Ponce Access Control

2 Apc Control Panel 8 readers 2 APS Power Supply 1 Lantronix US110000 16 Proximity Readers 8 Status Switch 2507AD 2 Star Coupler Module 2 Power Supply 24-3 w/battery 8 Request to Exit Button PBE 8 Electromagnetic Lock 600lbs.

16 RM-4 Personality Module 4 I/O Input Boards 32 HUB-M Panic Buttons

6. VACHS ADM/ER Access Control

7 Proximity Readers 7 Status Switch 2507AD 7 Electromagnetic Lock 1,200lbs 1 Power Supply 24-3 w/battery

7. VAMC 2nd Floor Breezeway Access Control

1 Proximity Readers 1 Status Switch 2507AD 1 Electromagnetic Lock 600lbs 1 Request to Exit Button Push Bar

1 Delay Egress System

8. Community Living Center CCTV System

2 Outdoor Ultra VIII Speedome Camera 2 1 position J box Power Supply

9. Arecibo CBOC -CCTV

7 Color Fixed Camera w/lens

10. Arecibo CBOC –Access Control

1 Apc Control Panel 2 readers 1 APS Power Supply 2 Proximity Readers

2 Status Switch 2507AD 2 Electromagnetic Lock 600lbs 1 Power Supply 24-3 w/battery 1 Lantronix Network Device RS232-RS485

11. Guayama CBOC -CCTV

3 Color Fixed Camera w/lens

12. St. Thomas OPC -CCTV

2 Color Fixed Camera w/lens

13. St. Croix OPC -CCTV

2 Color Fixed Camera w/lens

14. Comerio Rural Clinic Access Control/IT Room

1 Apc’l Control Panel 2 readers 1 Proximity Readers 1 Status Switch 2507AD 1 Electromagnetic Lock 600lbs 1 Power Supply 24-6 w/battery 1 Lantronix Network Device RS232-RS485 1 Alarm System

15. Utuado Rural Clinic Alarm

1 Alarm System

16. Record Room VACHS

2 Proximity Readers 1 DS150 Motion Detector 2 Electric Door Strike

17. VACHS Alarm Systems

7 Alarm Systems

Locations:

Pharmacy In/Outpatients Pharmacy Cache Canteen Service Laundry Room Mail Room Cashier Medical Media Receiving / Distribution Area (Warehouse)

18. VACHS Duress Button

253 Duress Buttons

17. Clinics Duress Button

61 Duress Button

18. South Bed Tower CCTV

3 IP Cameras Axis 215PTZ-E

24 IP Cameras Axis 216MFD/ (8 analog) 1 Dell Monitor 19” VGA 1 AOC Monitor 19” 2 NVRR-1000C (Located 4th floor SBT) 1 DVR Intellex 1 Remote Monitoring Station Latitude E05400 2 UPS Battery Back up 1 Dell Inspiron 250GB HDD, Remote Administration Station

19. South Bed Tower Access Control

1 Istar Control Panel 16 readers 1 APS Power Supply 2 Proximity Readers

14 Status Switch 2507AD 14 Electromagnetic Lock 1,200lbs 1 Power Supply 24-3 w/battery

14 Delay Egress System

20. Access Control and Alarm System Research Room B3 VACHS

Qty Description 1 Proximity Reader 1 Exit Button 1 Alarm Keypad 1 Alarm buzzer 1 Motion detector

21. Operating Room Access Control-VACHS

2 Proximity Reader HID 6125 2 Exit Buttons AcT69 2 Magnetic Lock 1,200SMR

22. PAICU CCTV System-VACHS

1 Converter VC1VAQ 1 21” LCD Monitor

1 SEAGATE 500 GB HDD

8 Cameras

23. VACHS-MRI Area Access Control 1 Proximity Reader HID6125 1 Magnetic Lock 1200SMR 1 Exit Button ACTS9 1 Indoor Intercom System AIPC 123LA

24. VACHS Nursing Service Area Access Control

2 Proximity Readers 3 Magnetic Lock 1200SMR 2 Exit Buttons TS2 1 Indoor Intercom w/ video HFX700M 1 Comelit Slave w/ Video EX700H 1 Exit delay Timer SEBCA XDT12 2 Duress Buttons 1 APC Panel 8 readers 1 Exit Door Panic Bar

1 APS POWER SUPPLY

25. VACHS PIC CCTV SYSTEM

1 Robot DMV96q Multivision Quest DVR 1 Everplex 4CDX 8 Fix cameras (mini domes) 3 17” Monitors

25. Ceiba Outpatients Clinic CCTV System

4 215PTZ Cameras 7 216MFD Fix cameras 1 Joystick 1 DVR Exacqvision

25. Ceiba Outpatient Clinic Access Control System

1 Local Alarm Arms Room/Exit Button/Card Reader/Magnetic Lock

3 HID ICLASS Reader RP40N 1 HID ICLASS Reader RPK40 3 Magnetic Locks 600Lbs.

4 Status Switch GRI4400A 2 Status Switch 2507AD 2 Alarm System Panel 2 360 Motion Detectors 3 Glass Break Detector 13 Shock Sensor 1 Magnetic Lock 1,200lbs.

1 Exit delay egress system 1 Panic Bar 1 8 Readers Istar Control Panel 1 IP Fixed Camera w/IR 1 Joystick 2 Request to exit button 5 PIR Motion detector

26. VACHS SICU/ISCU CCTV SYSTEM)

1 Monitor

1 DVR

2 Cameras

27. MICU CCTV System

2 Monitors Speco Technologies 6 Cameras Elevator mount (corner) 1 Digimerge Touch DVR-DH216000 1 Access Control System 2 doors

28. CCU CCTV System South Bed Tower

2 Speco Technologies Monitors 9 Cameras Elevator/corner mounts 1 Digimerge Touch DVR-DH216000 1 Access Control System 1 door

29. SICU CCTV System

1 Monitor Dell 19”

1 Everfocus Mod-EDSRA00H 2 Cameras mini domes

30. Administrative Building CCTV and Access Control

22 Magnetic Locks

10 Exit Buttons 12 Emergency Exit Buttons 2 Power Supplies 4 Exit Delay Timers 2 Batteries 28 Access Readers 39 Fix Cameras 4 PTZ Cameras

2 I Star Panels

38. New Multilevel Parking CCTV and Access Control

Qty Description 6 Istar Control Panel 16 readers 6 APS Power Supply 6 6AMP Power SUPPLY 12VDC 23 Proximity Readers 4 Electromagnetic Lock 1,200lbs 12 Electric Door Strike 15 DS150 Request to Exit Motion Detector 1 Request to Exit Button PBE 17 Status Switch 2507AD 16 IP Fixed Cameras IllustraADCi610-D023 24 IP AD PTZ Cameras ADVEIPSD35N 1 IP08-64T-2Z-2 Rackmount 2U recorder 64TB 40 ADVE1SSA SSA Video Edge Per Camera License 1 ADNSNVR-RR Reinstatement per NVR

31. Servers, Workstations, and Components

1 VICTOR VMS Workstation 1 CCCURE 9000 Workstation 1 Lynx Sever 4 Video Wall High Performance PC 2 Nurse Station Mini PC ABHICU

10 42” LG Video Monitors 3 Wall Flush Tote Vision Monitor (ABHICU) 1 5KVA UPS Back up

32. NEW Arecibo CBOC -CCTV

Qty Descriptions

28 EXACQ ENTERPRISE CAM LICENSE

1 IP 2U recorder with 4 IP cameras licenses

1 43" MONITOR FULL HD LED

1 Rackmount Sliding Rail Kit for ExacqVision

6 OUTDOOR PTZ (EXISTING)

4 OUTDOOR PTZ CORNER MOUNT

6 OUTDOOR PTZ WALL MOUNT LONG

6 POE INJECTOR

20 4MP INDOOR CAMERA

6 4MP OUTDOOR CAMERA

6 OUTDOOR CAMERA PENDANT KIT

6 WALL MOUNT FOR M3206-LVE

1 2MP CUBE CAMERA

10 CAT6 1000' BOX

17 READER PROX

3 READER PROX W/KEYPAD

21 STATUS SWITCH

8 REX BUTTON

9 MAGLOCK

9 Z BRACKET FOR M32

20 RM-1

1 12/24VDC DBA

1 ARMORED LOOP

1 16 READERS ISTAR

1 8 READERS ISTAR

2 PSX-75-1

1 12VDC 10AMP POWER SUPPLY

3 12VDC 7AH BATTERY

33. 5TH Floor Admin Building Elevators and exit control

7 READER PROX

2 STATUS SWITCH

8 REX BUTTON

2 MAGLOCK

2 Z BRACKET FOR M32

2 RM-1

1 12/24VDC DBA

1 ARMORED LOOP

2 8 READERS ISTAR

4 PSX-75-1

1 12VDC 10AMP POWER SUPPLY

4 12VDC 7AH BATTERY

2 M3066-V Axis Camera 4MP 3 AS0074 8 Output modules

3 RM-4

2 ESTAR-002 –POE-1

35. New Urology Area

13 READER PROX

9 STATUS SWITCH

3 REX BUTTON NO TOUCH

13 RM-1

1 ARMORED LOOP

1 16 READERS ISTAR

1 PSX-75-1

1 12VDC 7AH BATTERY

36. Carolina Warehouse

9 READER PROX

9 STATUS SWITCH

8 REX BUTTON NO TOUCH

9 RM-1

1 16 READERS ISTAR

1 PSX-75-1

1 12VDC 7AH BATTERY

Evaluation Factors:

The contractor must be certified on the following security systems and credentials:

Victor Video Management System Ccure9000 Access Control Management Software LYNX Panic Buttons Software Software House Istar Control Panel Exacqvision NVR Systems Axis Cameras and Peripherals APC, APC’L Control Panels DSC Alarm Systems CAT 6 Certified

Authorized Services:

Only the services specified by this agreement are authorized. Contractor is cautioned that only the Contracting Officer may authorize additional services and that reimbursement will not be made unless prior authorization is obtained for such services.

The contractor shall immediately notify the Contracting Officer and the COR in writing not later than 24 hours the services requested by any VA employee that is beyond the scope of the contract. The Contractor shall provide the CO and COR with a written estimate of the cost to make necessary repairs prior to begin the service and must wait for the notice to proceed from the CO that is the employee authorized to notify and authorize the work.

Service Report:

An operational and status report shall be issued after each service and after each Monthly inspection with the Customer acknowledgement. Contractor shall submit a Service Report to the COR or his/her designee every time maintenance, part replacement, or repairs are done. This report shall include date, the name of the employee(s) performing the work, the title of the employee(s), the time in and out, a brief description of what was done, a list of parts used, and hours of labor expended. The Service report must be in a format acceptable to the COR or designee.

Warranty:

The Contractor shall extend to the Government full coverage of any standard commercial warranty normally offered in a similar commercial sale. Acceptance of the warranty does not waive the Government’s rights under the Inspection Clause, nor does it limit the Government’s rights with regard to the other terms and conditions of this contract. In the event of a conflict, the term and conditions of the contract shall take precedence over the warranty.

Competency of personnel providing Services:

Contractor shall authorize all personnel performing the services requested. Fully qualified and competent personnel shall perform all work. The contractor shall provide written assurance of the competency of their personnel and a list of credentials of approved personnel for each make and model the Contractor services at each VA building. The CO may authenticate the training requirements, request training certificates or credentials from the Contractor at any time for any personnel, who are serving or installing any VA equipment. The CO and/or the COR specifically reserve the right to reject any of the Contractor’s personnel and refuse them permission to work on the VA equipment.

A written confirmation/certification is required from the Contractor such as:

“This is to certify that Mr. /Mrs. /Ms. ________________meets all the qualification requirements for the position of _________, is properly trained (credentials, if applicable) and competent to perform the tasks as described in the statement of work and that we maintain employee records updated with the following: health annual certificates, Good Conduct Certificate from the Puerto Rico Police department, educational documents, job descriptions, evaluation methods and qualification standards.

Document shall be dated and signed by contractor procurement representative.

If subcontractors are used, the main contractor shall meet the guideline establish in 13 CFR § 125.6 - Code of Federal Regulations and FAR 52.219-14 incorporated by reference. Subcontractor shall meet the same requirement of the main contractor.

Subcontractor information shall be submitted to CO along with any proposed changes for review and approval.

Security Clearance Background Check:

Contractor shall accept complete liability for technicians who will be providing maintenance and repairs to the Government’s security system.

Identification, Parking, Smoking and VA Regulations:

Contractor’s personnel shall always wear visible identification while on the premises of any VA building. It is the responsibility of the Contractor to park in the appropriate designated parking areas.

The VA will not invalidate or make reimbursements for parking violations done by the Contractor under any condition. Smoking is prohibited inside any VA buildings. Possession of weapons is also prohibited. Any violation to these regulations may result in citation in the United States federal district Court, not a local District, State or Municipal Court.

Vandalism:

Vandalism is defined as renewals or repairs necessitated by reasons of negligence of misuse of the equipment by persons other than the contractor, his representatives and employees, or by reason of any other cause beyond the control of the contractor, except normal wear and tear. Claims for additional compensation for repair of vandalism will be considered upon presentation of satisfactory evidence that vandalism has occurred. During normal working hours, the contractor shall contact the COR or his/her designee and have them verify the damage prior to repair of vandalism.

Safety and performance requirements violation:

In the performance of this contract, the Contractor shall take all safety precautions and measurements to be reasonably necessary to protect the lives and the health of the occupants of any building. The contracting Officer or his/her designee will notify the Contractor of any noncompliance with the foregoing provisions and the action to be taken. After receipt of such notice, the Contractor or his/her designee shall immediately correct the condition to which attention has been directed. Such notice, when served on the Contractor or his/her designee at the site of work, shall be deemed sufficient for the purpose aforementioned. If the Contractor fails or refuses to comply promptly, the CO may stop all or any part of contract performance and terminate Contractor of default as provided in FAR 52-212-4 Contract Terms and Conditions-commercial Items (NOV 2021).

VHA SUPPLEMENTAL CONTRACT REQUIREMENTS FOR ENSURING ADEQUATE COVID-19

SAFETY PROTOCOLS FOR FEDERAL CONTRACTORS:

a. Contractor employees who work in or travel to VHA locations must comply with the following:

1. Documentation requirements:

a. If fully vaccinated, shall show proof of vaccination.

1. NOTE: Acceptable proof of vaccination includes a signed record of immunization from a health care provider or pharmacy, a copy of the COVID-19 Vaccination Record Card (CDC Form MLS- 319813 R, published on September 3, 2020), or a copy of medical records documenting the vaccination.

2. If unvaccinated and granted a medical or religious exception, shall show negative COVID-19 test results dated within three calendar days prior to desired entry date. Test must be approved by the Food and Drug Administration (FDA) for emergency use or full approval. This includes tests available by a doctor’s order or an FDA approved over-the-counter test.

3. Documentation cited in this section shall be digitally or physically maintained on each contractor employee while in a VA facility and is subject to inspection prior to entry to VA facilities and after entry for spot inspections by Contracting Officer Representatives (CORs) or other hospital personnel.

4. Documentation will not be collected by the VA; contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

b. Contractor employees are subject to daily screening for COVID-19 and may be denied entry to VA facilities if they fail to pass screening protocols. As part of the screening process contractors may be asked screening questions found on the COVID-19 Screening Tool. Check regularly for updates.

c. Contractor employees who work away from VA locations, but who will have direct contact with VA patients shall self-screen utilizing the COVID-19 Screening Tool, in advance, each day that they will have direct patient contact and in accordance with their person or persons who coordinate COVID-19 workplace safety efforts at covered contractor workplaces. Contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

d. Contractor must immediately notify their COR or Contracting Officer if contract performance is jeopardized due to contractor employees being denied entry into VA Facilities.

e. Each contractor has to submit a complete assessment of vaccinated, exempted, and unvaccinated non-exempted contract employees under your purview.

f. Vaccinated contract employees are free to continue their duties as detailed in their contract.

g. Un-vaccinated with valid medical/religious exemption: require weekly COVID-19 testing with negative results to continue entering our Facility (PCR or antigen testing).

1. Contractor responsibilities: Un-vaccinated without exemption may not enter the VACHS Facility and may require permanent replacement arranged by the Contractor; if the employee refuses vaccination and is not able to provide a valid exemption. Contract employee termination and/or replacement must be arranged between the Contracting Office and the Contractor.

2. Exception: one-time or occasional contract employees that visit our Facility for less than one calendar week (trainings, equipment or program installations, equipment maintenance assessments, etc.). In this case, a COVID-19 PCR must be obtained and presented within less than 72 hours prior to entering the Facility.

INFLUENZA VACCINATION:

a. All contract employees shall comply with VHA Directive 1192.01, Seasonal Influenza Vaccination Program for VHA Healthcare Personnel. This policy applies to all individuals who, during the influenza season, work in VHA locations or who come into contact with VA patients or other Health Care Personnel (HCP) as part of their duties.

b. Masking requirements for unvaccinated HCP: HCP who do not receive influenza vaccination due to medical or religious exemptions must designate this at the VA Employee Health Unit on the HCP

Influenza VA Form 10-9050 and wear a face mask while in any VHA location, including both clinical and non-clinical areas. In addition, HCP are required to wear a face mask during performance of their assigned duties and responsibilities. The face mask shall be worn throughout the influenza season, or until the individual HCP receives a flu vaccination and completes the required VA Form 10-9050.

Contacts:

Contractors shall provide the name and phone number of a company representative or group from which services may be obtained. This contact will be available during those hours for which the services are contracted: Name, email address and telephone number.

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

VA INFORMATION CUSTODIAL LANGUAGE:

a. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

b. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor, third party and terminate contract for cause under the authority procedures of Federal Acquisition Regulation (FAR) part 12 and FAR 52-212-4(m) included in this procurement.

c. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

d. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

SECURITY INCIDENT INVESTIGATION:

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH:

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non- Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

SECURITY CONTROLS COMPLIANCE TESTING:

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

TRAINING:

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete VA Privacy and Information Security Awareness and Rules of Behavior Training before being granted access to VA information and its systems.

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Rules of Behavior before being granted access to VA information and its systems.

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

The Certification and Accreditation (C&A) requirements do not apply, and a Security Accreditation Package is not required for this SOW.