S02 FINAL Combined Synopsis Solicitation 36C25625Q1104 Lynx Upgrade Expansion Houston 07-25-2025.pdf

PDF 699 KB Posted

Attached to
Facility Wide Lynx Duress Notification System Upgrade and Expansion Services, Michael E DeBakey VA Medical Center, Police Services, 2002 Holcombe Boulevard, Houston, TX 77030-4211
Solicitation number
36C25625Q1104
Issued by

About this file

This document is a Combined Synopsis/Solicitation for a Facility Wide Lynx Duress Notification System Upgrade and Expansion Services contract for the Michael E. DeBakey VA Medical Center in Houston, Texas. The Department of Veterans Affairs is seeking a small business contractor to upgrade and expand the existing Lynx Duress Notification System for the medical center's Police Services, which involves enhancing hardware and infrastructure at the main facility located at 2002 Holcombe Blvd and extending the system to 13 Community Based Outpatient Clinics (CBOCs) in the surrounding area.

The solicitation (Number 36C25625Q1104) is set aside 100% for small businesses, with a NAICS code of 561621 (Security Systems Services) and a size standard of $25 million. Quotes are due by August 11, 2025, at 1:00 p.m. Eastern Time, with a period of performance not to exceed one year. The project requires brand-specific Lynx system equipment, including SIP interface servers, messenger pro software, network duress devices, wireless input devices, LED signs, and integration with existing access control and CCTV systems. Contractors must possess current Lynx Integrator Certification and comply with specific technical requirements outlined in the Performance Work Statement.

View the file

Other files

File Type Posted
S06 Final Amendment 36C25625Q1104 0001 Solicitation Close Dates and Times.pdf PDF
2NDKYPL overall - 1.pdf PDF
4THKYPL OVERALL PLAN 12-4-2017.pdf PDF
List of Attachments.pdf PDF
VA Katy CBOC 2nd - Current FP.pdf PDF
Conroe CBOC 4th SF Floor Plan.pdf PDF
Brand Name Justification Lynx Only Lynx Upgrade Expansion Houston with Cost Retracted.pdf PDF
BSMTKYPL OVERALL 1 12-4-17.pdf PDF
Richmond CBOC - Current FP.pdf PDF
1st floor base plan OVERALL PLAN 6-7-2021.pdf PDF
LynxWLS Repeater Installation Map - VA Houston - 6th floor - Locating.pdf PDF
Final SugarLand Floorplan.pdf PDF
Lufkin Floor plan.pdf PDF
VA Katy CBOC 3rd - Current FP.pdf PDF
6THKYPL OVERALL PLAN 12-4-2017.pdf PDF
Humble CBOC.pdf PDF
Solicitation Questions Request Form.docx DOCX document
Dom Floor Plan.pdf PDF
LynxWLS Repeater Installation Map - VA Houston - 1st floor - Locating.pdf PDF
BOPC.pdf PDF
5THKYPL OVERALL PLAN 12-4-2017.pdf PDF
Conroe CBOC 3rd SF Floor plan.pdf PDF
LynxWLS Repeater Installation Map - VA Houston - 1st floor - Static.pdf PDF
Tomball floor plan.PDF PDF
Wage Determination 2015-5233 REV 30 Dated 05-15-2025.pdf PDF
10103-Suite 470--Vet Center.pdf PDF
Texas City-CBOC CURRENT 2020 FP.pdf PDF
3RDKYPL OVERALL PLAN 12-4-2017.pdf PDF
Lake Jackson floor plan.pdf PDF
Galveston CBOC - Current FP.pdf PDF
Show all 30

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

Combined Synopsis/Solicitation Notice

SUBJECT* Facility Wide Lynx Duress Notification System Upgrade and Expansion Services, Michael E DeBakey VA Medical Center, Police Services, 2002 Holcombe Boulevard, Houston, TX 77030-4211

GENERAL INFORMATION

CONTRACTING OFFICE’S ZIP CODE* 39531

SOLICITATION NUMBER* 36C25625Q1104

RESPONSE DATE/TIME/ZONE 08-11-2025 1300 EASTERN TIME, NEW YORK,

USA

ARCHIVE 99 DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS N

SET-ASIDE SBA (Total Small Business)

PRODUCT SERVICE CODE* L063

NAICS CODE* 561621

CONTRACTING OFFICE ADDRESS Department of Veterans Affairs

Gulf Coast Veterans Health Care System Network Contracting Office 16 400 Veterans Avenue BLDG 10 Engineering Biloxi MS 39531

POINT OF CONTACT*

C. Robert Oravetz / Contracting Officer Department of Veterans Affairs Network Contracting Office 16 Gulf Coast Veterans Health Care System 400 Veterans Avenue BLDG 10 c/o Engineering Biloxi, MS 39531

PLACE OF PERFORMANCE

ADDRESS Department of Veterans Affairs Gulf Coast Veterans Health Care System Engineering Service 400 Veterans Avenue BLDG 10 Biloxi MS

POSTAL CODE 39531

COUNTRY USA

ADDITIONAL INFORMATION

AGENCY’S URL https://www.va.gov/

URL DESCRIPTION VA

AGENCY CONTACT’S EMAIL ADDRESS christopher.oravetz@va.gov EMAIL DESCRIPTION CO e-mail address

This is a combined synopsis/solicitation for commercial items, prepared in accordance with the format in Federal Acquisition Regulation (FAR 12.6) as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; offers are being requested, and a written solicitation will not be issued.

Solicitation number 36C25625Q1104 is issued as a Request for Quote (RFQ). This solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2025-04.

The Michael E DeBakey VA Medical Center (Houston, TX) requires the following: Facility Wide Lynx Duress Notification System Upgrade and Expansion Services. The existing Lynx Duress Notification System must be upgraded and expanded to meet the needs of Police Service. Such an initiative requires an upgrade to the existing hardware and infrastructure at the main facility located at 2002 Holcombe Blvd, Houston, TX 77030, expansion of this hardware at designated locations, and extension of this system to its 13 Community Based Outpatient Clinics (CBOCs) in the surrounding area.

The applicable NAICS code for this procurement is 561621-Security Systems Services (except Locksmiths). The associated small business size standard is $25 Million.

The Performance Work Statement (PWS) contained within this solicitation is a non-negotiable document. Quotes shall not include edits, revisions, additions, deletions, alterations, or track change comments to the Performance Work Statement (PWS). Questions or needed clarifications about the Performance Work Statement (PWS) shall be addressed via the submission of offeror/contractor questions about this solicitation.

This solicitation has been set aside 100% for Small Business contractors (Total Small Business set aside). Offerors/contractors are eligible to respond to this solicitation providing that they meet the following requirements: 1). Possess a socioeconomic category/status of no special category small business, 8(a), HUB Zone, Small Disadvantaged Business, Minority Owned, Native American Owned, Service-Disabled Veteran Owned, Veteran Owned, or Women-Owned Small Business and meet the small business size standard for the applicable NAICS code for this procurement.

When preparing quotes in response to this solicitation offerors/contractors shall refer to FAR 52.212-1 (Instructions to Offerors – Commercial Items), FAR 52.212-2 (Evaluation-Commercial Items), and Addendum FAR Part 52.212-2. These sections contain specific instructions, guidance, format, and exact requirements for what constitutes a complete and responsive quote. As specified in these sections an incomplete and/or non-responsive quote shall not be considered for contract award by the contracting officer.

PAGE34 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

580-25-4-5166-0226

36C25625Q1104 07-25-2025

C. Robert Oravetz No Phone Calls 08-11-2025

1300 EDT

36C256 Department of Veterans Affairs Gulf Coast Veterans Health Care System Network Contracting Office 16 400 Veterans Avenue BLDG 10 Engineering

X 100

X

561621

$25 Million

N/A

X

36C256

Department of Veterans Affairs Michael E. DeBakey VA Medical Center Police Services 2002 Holcombe Blvd Houston TX 77030

36C256

Department of Veterans Affairs Gulf Coast Veterans Health Care System Network Contracting Office 16 400 Veterans Avenue BLDG 10 Engineering

FSC e-Invoice Payment http://www.fsc.va.gov/fsc/einvoice.asp Invoice Setup Information 1-877-489-6135 invoice must be submitted electronically

1-877-489-6135 vafsccshd@va.gov

See CONTINUATION Page

Contractor shall perform the following services in support of Michael E. DeBakey VA Medical Center: (Facility Wide) Lynx Duress Notification System Upgrade and Expansion Services in accordance with Performance Work Statement (PWS) requirements. Brand name only (Lynx system) equipment, accessories, and components are required for this effort.

Contractor shall refer to the Performance Work Statement, the Schedule of Services (Price/Cost Schedule), and all other requirements and conditions that are contained within this solicitation that pertain to the execution of services and the completion of tasks/deliverables.

Contractor shall refer to FAR 52.212-1, 52.212-2, and Addendum FAR Part 52.212-2 when submitting quotes in response to this solicitation. Solicitation is set aside 100% for small business (Total Small Business Set Aside).

The expected performance period of this acquisition is (NTE) not to exceed one year following performance start date by contractor.

See CONTINUATION Page

X X

X 1

C. ROBERT ORAVETZ, CONTRACTING OFFICER

VA-VHA-RPOC-2023-0071

36C25625Q1104

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 PRICE/COST SCHEDULE & ITEM INFORMATION JB = JOB

B.2-1 ADDENDUM-SCHEDULE OF SERVICES - PRICE COST SCHEDULE

B.3 PERFORMANCE WORK STATEMENT

B.4 ADDENDUM PRESOLICITATION PROCUREMENT QUESTIONS AND RESPONSES 12

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 52.228-5 INSURANCE—WORK ON A GOVERNMENT INSTALLATION (JAN 1997)14

C.3 SUPPLEMENTAL INSURANCE REQUIREMENTS

C.4 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020) ... 15

C.5 CONTRACTOR PERFORMANCE ASSESSMENT REPORTING SYSTEM

C.6 IT CONTRACT SECURITY

C.5 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR

EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (JAN 2025)

(DEVIATION FEB 2025)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998) 39

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.3 52.204-29 FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT ORDERS—

REPRESENTATION AND DISCLOSURES (DEC 2023)

E.4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)43

E.5 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.6 VAAR 852.233-70 PROTEST CONTENT/ALTERNATIVE DISPUTE RESOLUTION (OCT 2018)

E.7 VAAR 852.233-71 ALTERNATE PROTEST PROCEDURE (OCT 2018)

E.8 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (NOV

2021)

E.9 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES (MAY 2024) (DEVIATION FEB 2025) ... 47

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: Unknown until contract award

b. GOVERNMENT: Contracting Officer 36C256 C. Robert Oravetz

Department of Veterans Affairs Gulf Coast Veterans Health Care System Network Contracting Office 16 400 Veterans Avenue BLDG 10 Engineering Biloxi MS 39531

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Upon successful project completion

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Vendor e-Invoice Set-Up Information:

•Tungsten e-Invoice Setup Information: 1-877-489-6135 •Tungsten e-Invoice email: VA.Registration@Tungsten-Network.com •FSC e-Invoice Contact Information: 1-877-353-9791 •FSC e-invoice email: vafsccshd@va.gov vafscenterprisesupport@va.gov

Additional information regarding invoicing can be provided via a request to the Contracting Officer.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

mailto:VA.Registration@Tungsten-Network.com mailto:vafscenterprisesupport@va.gov

B.2 PRICE/COST SCHEDULE & ITEM INFORMATION JB = JOB

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

1.00 JB __________________ __________________

Lynx Duress Notification System Upgrade and Expansion Services in accordance with Performance Work Statement requirements for the expansion and upgrade areas, sites, and locations identified at Michael E. DeBakey VA Medical Center, 2002 Holcombe Blvd, Houston, TX 77030. Contractor total quote price shall also include the items listed in Addendum-Schedule of Services - Price Cost Schedule, Period of performance is NTE (not to exceed) one year following performance start date by contractor.

PRINCIPAL NAICS CODE: 561621 - Security Systems Services (except Locksmiths) PRODUCT/SERVICE CODE: L063 - Technical Representative - Alarm, Signal, and Security Detection Systems

GRAND TOTAL __________________

B.2-1 ADDENDUM-SCHEDULE OF SERVICES - PRICE COST SCHEDULE

Addendum-Schedule of Services - Price Cost Schedule

The Facility Wide Lynx Duress Notification System Upgrade and Expansion includes the following Lynx System (brand) equipment, components, and accessories which are needed to successfully complete this effort.

Contractor total quote price (to be annotated in Line Item 0001) shall include and/or otherwise incorporate the following listed below.

**Only brand name only (Lynx System) equipment, components, and accessories shall be accepted by the government to be utilized for this specific (Lynx System) acquisition. Non-brand name / Non-Lynx system equipment, components, and accessories shall not be accepted by the government.

VA Houston Expansion Qty Lynx P/N Lynx Description

SIP Interface Server Software Options

1 780-LYNX-IP-INT SFTWR,LYNX,SIP PHONE INTERFACE

Popup logged off Server Software Options

780-LYNX-

MSGPRO SFTWR,LYNX,MESSENGERPRO,100 CLIENTS LICENSES

LynxNet Inputs Network Duress Devices- CBOCs - requires install and configuration

125 950-LYNX-N-P2-M ASYM,LYNX,NETWORK,POE,PANIC BUTTON

LynxNet Input Wireless Input Devices 1-5 floors - requires install and configuration

5 950-LYNX-WLS-3 ASYM,LYNX,WIRELESS REC,POE

80 950-WLR-INDOOR ASYM,LYNX,WLR,REPEATER,INDOOR

625 950-WLT-PANIC-A ASYM,LYNX,WLT,PANIC,SINGLE

25 950-WLT-IDPNC-4 ASYM,LYNX,WLT,PANIC,INDOOR,HUB,LOCKING

125 950-WLT-IDPNC-5 ASYM,LYNX,WLT,PANIC,INDOOR,SMALL,W COVER

LynxNet Input Wireless Input Devices 6th Floor - requires install and configuration

1 950-LYNX-WLS-3 ASYM,LYNX,WIRELESS REC,POE

151 950-WLR-INDOOR ASYM,LYNX,WLR,REPEATER,INDOOR

150 950-WLT-PANIC-A ASYM,LYNX,WLT,PANIC,SINGLE

LynxNet Output LED Signs - requires install and configuration

40 950-LYNX-SIGN-2 ASYM,LYNX,SIGN,LED,2X16,POE++

LynxNet Output HDMI to Customer supplied Monitor - rrequires install and configuration

100 950-LYNX-NM-2 ASYM,LYNX,NETWORK,MESSENGER2,POE

Other Miscellaneous Accessories / Components Quantity Description

500 Cat6 Cabling 1 Conduit/junction boxes/J-hooks 1 Misc hangers and straps 1 Misc cabling and connectors 1 Lynx Integration with legacy Open Option DNA Fusion Physical Access Control System 1 Lynx Integration with legacy Avigilon CCTV systm

Supplemental, Associated Equipment Services – Description

Increment (Month or Year)

Duration (Approximate)

Project Management Labor Month 8

Programming Labor Month 3 Engineering/Design Labor Month 1 Field Technician and Installation Labor Month 8

B.3 PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS) (Facility Wide) Lynx Duress Notification System Upgrade

Michael E. DeBakey VA Medical Center 2002 Holcombe Boulevard Houston, TX 77030-4211

I. GENERAL REQUIREMENT

The Michael E. DeBakey VA Medical Center requires the existing Lynx Duress Notification System to be upgraded and expanded to meet the needs of Police Service. This requires an upgrade to the existing hardware and infrastructure at the main facility at 2002 Holcombe Blvd, Houston, TX 77030, expansion of this hardware at designated locations, and extension of this system to its 13 Community Based Outpatient Clinics (CBOCs) in the surrounding area.

II. DESCRIPTION OF WORK

The Contractor shall provide all labor, calibration, materials, parts, repairs, equipment, tools, onsite/remote monitoring, professional services, technical support, transportation, software, personnel, and travel as to complete this installation and deployment. The Contractor shall adhere to all Original Equipment Manufacturer

(OEM) requirements and have all required access to the OEM software. Completion of the project will be determined when all components of the system are deployed and fully functional.

A. Existing Panic alarm system

The Lynx Duress Notification System is currently installed and functional at the main MEDVAMC hospital, and it’s CBOCs, via a local server and the Lynx Messenger Pro software clients on all OIT user PCs. This enables the F9/F11 function on employee’s keyboards to send a duress notification/panic alarm to Police in the event of a safety incident requiring dispatch. The system also maintains a record to update locations of each computer periodically through user updated prompts during login. The scope of this upgrade includes updating these licenses (7000) and upgrading/replacing the current server to the latest version and hardware specs.

There is also a collection of legacy physical, single, panic alarm buttons installed throughout the facility.

Some were decommissioned in prior years, and some are still currently functional. The scope of this upgrade includes replacing all of these with new, single panic alarm buttons, expanding the single panic alarm button installations in designated areas, and connecting these to the Lynx server. The areas requiring physical alarm buttons are nurse’s stations, waiting rooms/reception desks, mental health group rooms, patient advocate offices, lobbies, travel office, compensation and pension office, canteen, patriot store, and other patient-facing administrative areas.

B. Areas of Expansion

In addition to the Lynx messenger pro function and physical alarm buttons, MEDVAMC also requires wireless panic alarm buttons in the Inpatient Mental Health (6th floor) and Emergency Department (1st floor) clinics. This includes installation, configuration of wireless receivers and repeaters, and wireless panic alarm buttons on lanyards at each of these areas. Wireless Panic Buttons will also be installed under desks and configured on floors 1-5 in strategic locations, as well as wireless recessed wall-mounted buttons and Locking/Latching HUB buttons.

Physical hardwired PoE panic alarm buttons are also needed to be connected to the network, installed and configured at MEDVAMC’s 13 CBOCs: Beaumont CBOC, Conroe CBOC, CRRC CBOC, Domicillary CBOC, Galveston CBOC, Humble CBOC, Katy CBOC, Lake Jackson CBOC, Lufkin CBOC, Richmond CBOC, Sugar Land CBOC, Texas City CBOC, and Tomball CBOC. These will be needed at the nurse’s station and waiting room/reception desks of these locations.

PoE++ LED Signs need to be mounted on the walls, connected to the network, and configured as well as the HDMI override appliances need to be configured and connected to the network, and HDMI monitors throughout the facilities.

C. Integration with Legacy physical security systems

The Contractor will be required to integrate with MEDVAMC’s legacy Open Option DNA Fusion Physical Access Control System and its legacy Avigilon CCTV security camera system. This will also for doors to be remoted locked and for cameras to turn to the specified location, in the event a panic alarm is placed.

In addition to the notification of Police Service’s dispatch during a duress notification, it is also required to have a secondary notification in the form of a visible alarm on the user’s PC, a separate monitor, or an audible alarm at the location of the incident.

III. DESIGN/LINE ITEMS

With this requirement structured as a Performance Work Statement, the Contractor is responsible for the design and implementation play to ensure a fully functional system. Project milestones and the project plan will be discussed before onsite work begins and established to meet the period of performance.

VA Houston Expansion Qty Lynx P/N Lynx Description

SIP Interface Server Software Options

1 780-LYNX-IP-INT SFTWR,LYNX,SIP PHONE INTERFACE

Popup logged off Server Software Options

780-LYNX-

MSGPRO SFTWR,LYNX,MESSENGERPRO,100 CLIENTS LICENSES

LynxNet Inputs Network Duress Devices- CBOCs - requires install and configuration

950-LYNX-N-P2-

M ASYM,LYNX,NETWORK,POE,PANIC BUTTON

LynxNet Input Wireless Input Devices 1-5 floors - requires install and configuration

5 950-LYNX-WLS-3 ASYM,LYNX,WIRELESS REC,POE

950-WLR-

INDOOR ASYM,LYNX,WLR,REPEATER,INDOOR

950-WLT-PANIC-

A ASYM,LYNX,WLT,PANIC,SINGLE

950-WLT-IDPNC-

4 ASYM,LYNX,WLT,PANIC,INDOOR,HUB,LOCKING

950-WLT-IDPNC-

5 ASYM,LYNX,WLT,PANIC,INDOOR,SMALL,W COVER

LynxNet Input Wireless Input Devices 6th Floor - requires install and configuration

1 950-LYNX-WLS-3 ASYM,LYNX,WIRELESS REC,POE

950-WLR-

INDOOR ASYM,LYNX,WLR,REPEATER,INDOOR

950-WLT-PANIC-

A ASYM,LYNX,WLT,PANIC,SINGLE

LynxNet Output LED Signs - requires install and configuration

950-LYNX-SIGN-

2 ASYM,LYNX,SIGN,LED,2X16,POE++

LynxNet Output HDMI to Customer supplied Monitor - rrequires install and configuration

100 950-LYNX-NM-2 ASYM,LYNX,NETWORK,MESSENGER2,POE

Other Miscellaneous Accessories / Components Quantity Description

500 Cat6 Cabling 1 Conduit/junction boxes/J-hooks 1 Misc hangers and straps 1 Misc cabling and connectors

1 Lynx Integration with legacy Open Option DNA Fusion Physical Access Control System 1 Lynx Integration with legacy Avigilon CCTV systm

Supplemental, Associated Equipment Services – Description

Increment (Month or Year)

Duration (Approximate)

Project Management Labor Month 8 Programming Labor Month 3 Engineering/Design Labor Month 1 Field Technician and Installation Labor Month 8

IV. CONFORMANCE STANDARDS

A. Contractor shall ensure that the equipment functions in conformance with the OEM specifications used when the equipment was procured by the VAMC, and any upgrades/updates, as well as following most current published standards/ specifications/regulations:

B. Manufacturer’s specifications, Association for the Advancement of Medical Instrumentation (AAMI), Joint Commission for the Accreditation of Healthcare Organizations (JCAHO), National Fire Protection Agency 99 (NFPA-99), Center for Device and Radiological Health (CDRH), Original Equipment Manufacturer (OEM), American Hospital Association (AHA), Institute of Electrical And Electronic Engineers (IEEE), Underwriters Laboratories (UL) ,Occupational Safety and Health Administration (OSHA), College of American Pathologists (CAP), VAMC standard operating procedures, and any other Federal, State, and Local regulations pertaining to the equipment listed for this contract.

C Contract service shall ensure that the equipment functions in conformance with the latest published edition of NFPA-99, UL, OSHA, VA, and CDRH.

V. CERTIFICATIONS:

Technicians and/or other personnel who will executing/supporting this upgrade & expansion effort must possess the following: Lynx Integrator Certification from the manufacturer that is current.

VI. HOURS OF COVERAGE

Normal hours of coverage are Monday through Friday from 8:00 a.m. CST to 6:00 p.m. CST, excluding holidays. The Federal Holidays that are currently being observed by the facility are listed in the table below.

New Year’s Day January 1

Martin Luther King‘s Birthday Third Monday in January

President’s Day Third Monday in February

Memorial Day Last Monday in May

Juneteenth Independence Day June 19th

Independence Day July 4

Labor Day First Monday in September

Columbus Day Second Monday in October

Veterans Day November 11

Thanksgiving Day Fourth Thursday in November

Christmas Day December 25

Other Federal Holidays (that could occur)

Any other day specifically declared to be a national holiday (per Federal Statute, Executive Order, or by the President’s Proclamation).

VII. CONTRACT DISCREPANCY REPORT (CDR)AND DAMAGES

A. Contractor shall be liable to the Government for losses of production due to significant equipment downtime.

B. A Contract Discrepancy Report (CDR) will be issued for performance below the Acceptable Quality Levels (AQL). The Contractor will have five workdays to provide a response that includes an improvement strategy for addressing the issues. If performance does not comply with the SOW, the CO will be notified and performance documented.

C. Contractor shall be liable to the Government for any damage done to Government property caused by themselves or their employees.

VIII. PAYMENT

Invoices shall be paid in arrears on either a monthly or quarterly basis. Invoices, SHALL INCLUDE, at a minimum, the following information: Contract No., Purchase Order No., Item(s) covered (to include serial #'s) by the PMI and covered period of service. Each invoice shall be provided in triplicate.

IX. COMPETENCY OF PERSONNEL SERVICING EQUIPMENT

A. Each respondent must have an established business, with an office and full-time staff. The staff includes a "fully qualified" FSE (Field Service Engineer) and a "fully qualified" FSE who will serve as the backup.

B. "Fully Qualified" is based upon training and on experience in the field. For training, the FSE(s) has successfully completed a formalized training program, for the equipment and is OEM Certified. For field experience, the FSE(s) has a minimum of two years of experience (except for equipment newly on the market) with respect to scheduled and unscheduled preventive and remedial maintenance, on Siemens equipment.

C. The FSEs shall be authorized by the OEM to perform the maintenance services. All work shall be performed by "Fully Qualified", OEM Certified competent FSEs. The Contractor shall provide written assurance of the competency of their personnel and a list of credentials of approved FSEs for each make and model the Contractor services at the VAMC prior to award. The COR may authenticate the training requirements, request locations, training certificates or credentials, and technician location from the Contractor at any time for any personnel who are servicing or installing any equipment. The CO and/or COR specifically reserve the right to reject any of the Contractor's personnel and refuse them permission to work on the VAMC equipment if evidence is not provided when requested.

D. If subcontractor(s) are used, they must be approved by the COR; the Contractor shall submit any proposed change in subcontractor(s) to the CO for approval/disapproval.

X. MOBILE MEDIA SCANNING

The Contractor will identify if removable media (i.e. USB or DVD/CD Device) is required to perform his/her duties. Personally owned USB thumb drive utilization is prohibited. Non-VA support personnel must furnish their own FIPS140-2 certified USB thumb drives, and only with the permission of a designated VA supervisor.

All USB drives must be scanned with an antivirus program running current virus definitions by the local VA staff, prior to connection to any VA device. COR or designee will ensure the removable media is scanned with anti-virus software running current virus definitions prior to connection to any medical device system. The computer system for scanning removable media is located in the Biomedical Engineering shop, Building 100, Room BA200.

XI. PRIVACY/SECURITY:

The Contractor will need to access VA systems to perform software upgrades, preventative maintenance, and maintenance repairs.

The Contractor will have electronic connectivity to the devices and will have access to patient databases or receive screenshots with PHI present.

Any electronic or magnetic data storage devices such as hard drives, etc. shall be turned into the ISSO.

Electronic or magnetic data storage devices are not to be removed from VA property.

B.4 ADDENDUM PRESOLICITATION PROCUREMENT QUESTIONS AND RESPONSES

Miscellaneous Questions and Responses (Facility Wide) Lynx Duress Notification System Upgrade

Michael E. DeBakey VA Medical Center 2002 Holcombe Boulevard Houston, TX 77030-4211

Question Government Response

Please confirm that all listed CBOC floor plans are final and inclusive of all active VA sites.

Yes

What integration is required between the Lynx system and existing systems such as access control, CCTV, or other infrastructure?

Listed in PWS, Section II(C). Integration with our PACS system to lock nearby doors and integrate with our CCTV system to move cameras to the incident location.

The manufacturer has already built this integration with these systems; the scope is to deploy this at MEDVAMC.

How will power be provided to repeaters? Will it use Power over Ethernet or separate power supplies?

The line items in Section III that are POE are listed in the description. The repeaters, with part number 950-WLR- INDOOR, are hardwired

Will remote access to the Lynx server be permitted for maintenance and support purposes?

Yes, will be enabled to mirror the current server setup.

Will installation activities take place during normal business hours or outside of those hours?

Normal hours are listed in Section VI, 0800-1800 CST M- F. Work outside of hours is negotiable, pending the post-award deployment plan.

Will vendors be allowed to conduct a site visit before submitting a bid?

Not at this time, given the time constraints required for award this fiscal year. Facility floor plans and drawings have been provided.

Can normal working hours and access to areas for installation be confirmed.

Confirmed in Section VI of PWS and question (5) above.

Will 120V power be required or will the repeaters be POE?

Answered in Section III of PWS and question (3) above.

SECTION C - CONTRACT CLAUSES

FAR

Number

Title Date

52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES

NOV 2023

ADDENDUM to FAR 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES

Clauses that are incorporated by reference (by Citation Number, Title, and Date), have the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

The following clauses are incorporated into 52.212-4 as an addendum to this contract:

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/browse/index/far https://www.va.gov/oal/library/vaar/

(End of Clause)

FAR

Number

Title Date

52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE OCT 2018

52.204-18 COMMERCIAL AND GOVERNMENT ENTITY CODE

MAINTENANCE

AUG 2020

52.229-3 FEDERAL, STATE, AND LOCAL TAXES FEB 2013

52.237-2 PROTECTION OF GOVERNMENT BUILDINGS,

EQUIPMENT, AND VEGETATION

APR 1984

52.246-4 INSPECTION OF SERVICES—FIXED-PRICE AUG 1996

852.203-70 COMMERCIAL ADVERTISING MAY 2018

852.204-70 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR

PERSONNEL

MAY 2020

852.215-70 SERVICE-DISABLED VETERAN-OWNED AND VETERAN-

OWNED SMALL BUSINESS EVALUATION FACTORS

(DEVIATION)

JAN 2023

852.215-71 EVALUATION FACTOR COMMITMENTS OCT 2019

852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS NOV 2018

852.237-75 KEY PERSONNEL OCT 2019

C.2 52.228-5 INSURANCE—WORK ON A GOVERNMENT INSTALLATION (JAN 1997)

(a) The Contractor shall, at its own expense, provide and maintain during the entire performance of this contract, at least the kinds and minimum amounts of insurance required in the Schedule or elsewhere in the contract.

(b) Before commencing work under this contract, the Contractor shall notify the Contracting Officer in writing that the required insurance has been obtained. The policies evidencing required insurance shall contain an https://www.acquisition.gov/browse/index/far https://www.va.gov/oal/library/vaar/ endorsement to the effect that any cancellation or any material change adversely affecting the Government's interest shall not be effective—

(1) For such period as the laws of the State in which this contract is to be performed prescribe; or

(2) Until 30 days after the insurer or the Contractor gives written notice to the Contracting Officer, whichever period is longer.

(c) The Contractor shall insert the substance of this clause, including this paragraph (c), in subcontracts under this contract that require work on a Government installation and shall require subcontractors to provide and maintain the insurance required in the Schedule or elsewhere in the contract. The Contractor shall maintain a copy of all subcontractors' proofs of required insurance, and shall make copies available to the Contracting Officer upon request.

(End of Clause)

C.3 SUPPLEMENTAL INSURANCE REQUIREMENTS

In accordance with FAR 28.307-2 and FAR 52.228-5, the following minimum coverage shall apply to this contract:

(a) Workers' compensation and employers liability: Contractors are required to comply with applicable Federal and State workers' compensation and occupational disease statutes. If occupational diseases are not compensable under those statutes, they shall be covered under the employer's liability section of the insurance policy, except when contract operations are so commingled with a Contractor's commercial operations that it would not be practical to require this coverage. Employer's liability coverage of at least $100,000 is required, except in States with exclusive or monopolistic funds that do not permit workers' compensation to be written by private carriers.

(b) General Liability: $500,000.00 per occurrences.

(c) Automobile liability: $200,000.00 per person; $500,000.00 per occurrence and $20,000.00 property damage.

(d) The successful bidder must present to the Contracting Officer, prior to award, evidence of general liability insurance without any exclusionary clauses for asbestos that would void the general liability coverage.

(End of Clause)

C.4 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020)

The Contracting Officer reserves the right to designate an Administrative Contracting Officer (ACO) for the purpose of performing certain tasks/duties in the administration of the contract. Such designation will be in writing through an ACO Letter of Delegation and will identify the responsibilities and limitations of the ACO. A copy of the ACO Letter of Delegation will be furnished to the Contractor.

(End of Clause)

C.5 CONTRACTOR PERFORMANCE ASSESSMENT REPORTING SYSTEM

Contractor Performance Assessment Reporting System

(a) FAR 42.1502 directs all Federal agencies to collect past performance information on contracts. The Department of the Department of Veterans Affairs (VA) has implemented Contractor Performance Assessment

Reporting System (CPARS) to comply with this regulation. One or more past performance evaluations will be conducted in order to record your contract performance as required by FAR 42.15.

(b) The past performance evaluation process is a totally paperless process using CPARS. CPARS is a web-based system that allows for electronic processing of the performance evaluation report. Once the report is processed, it is available in the Past Performance Information Retrieval System (PPIRS) for Government use in evaluating past performance as part of a source selection action.

(c) We request that you furnish the Contracting Officer with the name, position title, phone number, and email address for each person designated to have access to your firm's past performance evaluation(s) for the contract. Each person granted access will have the ability to provide comments in the Contractors portion of the report and state whether or not the Contractor agrees with the evaluation, before returning the report to the Assessing Official. The report information must be protected as source selection sensitive information not releasable to the public.

(d) When your Contractor Representative(s) (Past Performance Points of Contact) are registered in CPARS, they will receive an automatically-generated email with detailed login instructions. Further details, systems requirements, and training information for CPARS are available at http://www.cpars.csd.disa.mil/. The CPARS User Manual, registration for On Line Training for Contractor Representatives, and a practice application may be found at this site.

(e) The Assessing Official will complete an interim or final past performance evaluation and the report will be accessible at http://www.cpars.csd.disa.mil/. The Contractor Representative has the option to provide comments on the evaluation, indicate if they concur or do not concur with the evaluation, sign, and then return the evaluation to the Assessing Official. The Contractor Representative has a total of 60 days following the Assessing Official’s evaluation signature date to send comments. If the Contractor Representative sends comments within the first 14 days following the Assessing Official’s signature date and the Assessing Official or Reviewing Official closes the evaluation, the evaluation will become available in PPIRS-RC within 1 day. On day 15 following the Assessing Official’s evaluation signature date, the evaluation will become available in PPIRS-RC with or without Contractor Representative comments and whether or not it has been closed by the Assessing Official or Reviewing Official. If no Contractor Representative comments have been sent and the evaluation has not been closed, it will be marked as “Pending” in PPIRS-RC. If the Contractor Representative sends comments at any time prior to 61 days following the Assessing Official’s evaluation signature date, those comments will be reflected in PPIRS-RC within 1 day. On day 61 following the Assessing Official’s evaluation signature date, the Contractor Representative will be “locked out” of the evaluation and may no longer send comments.

(f) The following guidelines apply concerning Contractor Representative use of the past performance evaluation:

(1) Protect the evaluation as "source selection information." After review, transmit the evaluation by completing and submitting the form through CPARS. If for some reason you are unable to view and/or submit the form through CPARS, contact the Contracting Officer for instructions.

(2) Strictly control access to the evaluation within your organization. Ensure the evaluation is never released to persons or entities outside of your control.

(3) Prohibit the use of or reference to evaluation data for advertising, promotional material, pre award surveys, responsibility determinations, production readiness reviews, or other similar purposes.

C.6 IT CONTRACT SECURITY

IT CONTRACT SECURITY

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program.

The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance.

National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS).

Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default "program files" directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f. The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

g. The contractor/subcontractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

(a) The Systems of Records (SOR); and

(b) The design, development, or operation work that the contractor/ subcontractor is to perform;

(1) Include the Privacy Act notification contained in this contract in every…

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .