SFVA Reference Lab Machaon PWS_Reference_Lab Testing.1.docx

I SCHEDULE OF SERVICES

The Contractor shall provide all personnel, equipment, and services to perform laboratory services to include transport of specimens to its laboratory; pre-analytic processing as defined in its laboratory user’s manual; analysis, reporting of analytic results, and consultation regarding selection, collection, transportation and result interpretation for the San Francisco VA Health Care System as further described in the Performance Work Statement (PWS) included herein.

See Attachment A for a list of the tests ordered over the previous 12 months and estimated annual volumes for each. This list is not all inclusive as patient testing needs may fluctuate throughout the contract period. These fluctuations can occur in both the volume of tests and the test menu.

Place of Performance: Services shall be provided at the Contractor’s reference laboratory. The primary reference laboratory is defined as the location where at least 85% of the total volume of tests specified in Attachment A are performed. It is acceptable for some tests (15% or less of the total volume of tests) to be sent to an alternate or more specialized testing laboratory.

Period of Performance:

PERFORMANCE WORK STATEMENT (PWS)

REFERENCE LABORATORY TESTING SERVICES

GENERAL

1.1. SERVICES REQUIRED:

The Department of Veterans Affairs San Francisco VA Health Care System (SFVAHCS) requires Contractor to provide reference laboratory testing services on an as needed basis.

1.2. PLACE OF PERFORMANCE:

Services shall be provided at the Contractor’s laboratory.

1.3. AUTHORITY: Title 38 USC 8153, Health Care Resources (HCR) Sharing Authority.

1.4. POLICY AND REGULATIONS: The Contractor shall comply with all applicable OSHA, federal and state laws and regulations as required for performing the type of services required, including the Centers for Medicare and Medicaid Services, Clinical Laboratory Improvement Amendments (CLIA).

1.5. DEFINITIONS/ACRONYMS:

1.5.1. CAP: College of American Pathologists. Laboratory Accreditation agency that has deemed status from the Centers for Medicare & Medicaid Services.

1.5.2. CDR: Contract Discrepancy Report

1.5.3. CLIA: Clinical Laboratory Improvement Amendments. United States federal regulatory standards that apply to all clinical laboratory testing performed on humans in the United States.

1.5.4. CMS: Centers for Medicare and Medicaid Services

1.5.5. Contracting Officer (CO): The person executing this contract on behalf of the Government with the authority to enter into and administer contracts and make related determinations and findings.

1.5.6. Contracting Officer’s Representative (COR): A person appointed by the CO to take necessary action to ensure the Contractor performs in accordance with, and adheres to, the specifications contained in the contract and to protect the interest of the Government. The COR shall report to the CO promptly any indication of non-compliance in order that appropriate action can be taken.

1.5.7. CPARS: Contractor Performance Assessment Reporting System

1.5.8. IAW: In Accordance With

1.5.9. POP: Period of Performance

1.5.10. PWS: Performance Work Statement

1.5.11. QA/QI: Quality Assurance/Quality Improvement

1.5.12. QM/PI: Quality Management/Performance Improvement

1.5.13. QASP: Quality Assurance Surveillance Plan

1.5.14. Veterans Health Administration (VHA): The central office for administration of the VA medical centers through throughout the United States. The VHA is located in Washington, D.C.

1.5.15. Veterans Integrated Services Network (VISN): The regional oversight for the VA medical center.

1.5.16. Veterans Affairs Medical Center (VAMC): Unless identified with the name of a different VA Medical Center, for purposes of this contract, this term shall mean the San Francisco VA Health Care System, 4150 Clement Street, San Francisco, CA 94121

CONTRACTOR QUALIFICATIONS

1.6. LICENSING AND ACCREDITATION: Contractor shall have and maintain all licenses, permits, accreditation and certificates required by law to operate as a CLIA-certified laboratory. This requirement shall also apply to any subcontractors performing services under this contract. Contractor shall provide evidence of Laboratory accreditation upon receipt of a written request.

1.7. PROFESSIONAL LIABILITY INSURANCE: Contractor shall maintain professional liability insurance by a commercial insurance company in the business of providing the required insurance coverage. The Contractor shall provide a copy of the Insurance Certificate upon receipt of a written request by the VA.

1.8. CONFLICT OF INTEREST: Contractor is responsible for identifying and communicating to the CO and COR conflicts of interest at the time of proposal and during the entirety of contract performance. At the time of proposal, the Contractor shall provide a statement which describes, in a concise manner, all relevant facts concerning any past, present, or currently planned interest (financial, contractual, organizational, or otherwise) or actual or potential organizational conflicts of interest relating to the services to be provided. The Contractor shall also provide statements containing the same information for any identified consultants or subcontractors who shall provide services. The Contractor must also provide relevant facts that show how it’s organizational and/or management system or other actions would avoid or mitigate any actual or potential organizational conflicts of interest.

1.9. ANNUAL OFFICE OF INSPECTOR GENERAL (OIG) STATEMENT:

1.9.1. In accordance with HIPAA and the Balanced Budget Act (BBA) of 1977, the VA OIG has established a list of parties and entities excluded from Federal health care programs. Specifically, the listed parties and entities may not receive Federal Health Care program payments due to fraud and/or abuse of the Medicare and Medicaid programs.

1.9.2. Therefore, all Contractors shall review the OIG List of Excluded Individuals/Entities on the OIG web site at www.hhs.gov/oig to ensure that the proposed Contractors and/or firm(s) are not listed. Contractors should note that any excluded individual or entity that submits a claim for reimbursement to a Federal health care program, or causes such a claim to be submitted, may be subject to a Civil Monetary Penalty (CMP) for each item or service furnished during a period that the person or entity was excluded and may also be subject to treble damages for the amount claimed for each item or service. CMPs may also be imposed against the Contractors and entities that employ or enter into contracts with excluded individuals or entities to provide items or services to Federal program beneficiaries.

1.9.3. By submitting their proposal, the Contractor certifies that the OIG List of Excluded Individuals/Entities has been reviewed and that the Contractor(s) and/or firm(s) are not listed as of the date the offer/bid was signed.

SCHEDULE

1.10. SCHEDULE: The Contractor shall provide services 24 hours a day, 7 days per week, including federal holidays, as required by VA. All services shall be provided within the timeframes specified in Section 4 below. The Contractor shall provide specimen transport at a time mutually agreed upon by the COR and the Contractor.

1.11. FEDERAL HOLIDAYS: The following holidays are observed by the Department of Veterans Affairs:

1.11.1. New Year’s Day

1.11.2. Martin Luther King’s Birthday

1.11.3. Presidents Day

1.11.4. Memorial Day

1.11.5. Juneteenth Independence Day

1.11.6. Independence Day

1.11.7. Labor Day

1.11.8. Columbus Day

1.11.9. Veterans Day

1.11.10. Thanksgiving Day

1.11.11. Christmas Day

1.11.12. Any day specifically declared by the President of the United States to be a national holiday.

1.12. Unless a state of emergency has been declared or SFVAHCS facilities are closed, the Contractor shall be responsible for providing services.

CONTRACTOR RESPONSIBILITIES

1.13. SERVICES REQUIRED: SFVAHCS requires the Contractor to provide reference laboratory testing for the tests described in Attachment A for the most frequently ordered tests and estimated volumes for each. This list is not all inclusive as patient testing needs may fluctuate throughout the contract period. These fluctuations can occur in both the volume of tests and the test menu.

1.14. STANDARDS OF PRACTICE: Contractor shall perform services according to the requirements contained in this PWS and services shall be performed in a manner that is equal to or greater than CLIA and CAP standards.

1.15. SPECIMEN PICK-UP TIMES: ALL SPECIMEN PICKUPS (ROUTINE, SAME-DAY, AFTER HOURS/WEEKEND/HOLIDAY) WILL BE PROVIDED FREE OF CHARGE.

1.15.1. Routine: The Contractor shall provide test requisition forms, shipping containers for specimen if applicable, and provide courier service for specimen transport.

1.15.2. Same day: The Contractor shall provide test requisition forms, shipping containers for specimen if applicable, and courier service for specimen transport same day if requested by SFVAHCS.

1.15.3. After hours/Weekends/Holiday: The Contractor shall provide test requisition forms, shipping containers for specimen if applicable, and courier service for specimen transport after normal business hours and weekend courier service if requested by SFVAHCS.

1.16. TEST RESULTS:

1.16.1. Routine: The Contractor shall provide routine test results to the ordering VA facility within twenty-four (24) hours following test completion, except when specimens are picked up the day before a weekend or holiday (in which case the results will be provided the following business day) and for tests with published longer turnaround times. Test procedures requiring a turnaround time longer than 24 hours (excluding the above exceptions) shall be identified in the Contractor’s Laboratory User’s manual (paper or electronic or on-line).

1.16.2. Telephone Consultation: The Contractor shall consult with the VA COR, requesting Clinician or designee at the VA by telephone as needed.

1.16.3. Critical Values: The Contractor shall immediately telephone the COR; requesting Clinician or designee to report Critical Values or test result that may indicate a life-threatening condition.

1.16.4. Reporting of Results: A report is defined as a printed final copy in duplicate of laboratory testing results. This report shall be received by an electronic interface or available to be printed by an online user account. If results are telephoned to VA, the report must include the name of the individual who was notified by telephone of the results. Each test report shall indicate, at minimum, the following information:

1.16.4.10. Flag abnormals

1.16.4.11. Reference range

1.16.4.12. Toxic and/or therapeutic range where applicable

1.16.4.13. Testing laboratory specimen number

1.16.4.14. Name of testing laboratory (contractor and/or subcontractor)

1.16.4.15. Type of specimen

1.16.4.16. Any additional comments related to test provided by submitting labs.

1.16.4.17. Any other information the laboratory has that may indicate a questionable validity of test results.

1.16.4.18. Unsatisfactory specimen shall be reported with regard to its unsuitability for testing.

1.17. STORAGE OF SPECIMENS:

1.17.1. The Contractor shall store all specimens as required by regulatory agencies (RA).

1.17.2. Upon request by the COR or designee, the Contractor shall provide a copy of the regulatory requirements for each participating RA.

1.18. MONTHLY TESTS SUMMARY:

1.18.1. The Contractor shall provide to the VA a cumulative (year-to-date) and monthly report of all tests received during the month and for all outstanding results. The report will also include turn around statistics, cost per test (including any additional charges), and specimen or testing issues.

1.19. SERVICE:

1.19.1. The Contractor shall provide telephone number(s) and a contact person to be used by the VA to make specimen problem inquiries and for problem solving at all times, including weekends and holidays.

1.19.2. The Contractor shall include names and telephone numbers of technical Directors and Pathologists available for consultation.

1.19.3. The Contractor agrees to maintain the minimum acceptable service, reporting systems and quality control as specified herein. Immediate (within 24 hours) notification must be given to VA upon adverse action by a regulatory agency (RA).

1.19.4. The Contractor shall assign a specific local account representative to the VA.

1.19.5. The Contractor shall advise the COR of any changes in methodology, procedure, reference ranges, delays in testing, and any new tests introduced within a timely manner and prior to changes being made.

1.19.6. In the event that the Contractor changes the assay procedure of a critically important component of an assay (e.g., and antibody, purified antigen, etc.), the Contractor shall notify the COR prior to the intended change and provide documentation that the quality and efficacy of the test will remain unchanged or be improved when desirable for all tests. All new tests shall have CPT codes and LOINC coding. Changes in the assay materials or procedure may be sufficient cause for changing to an alternate contractor for the assay(s) for the duration of the contract at the sole discretion of the CO/COR.

1.19.7. If it is deemed that the removal of the test from the test menu is required, due to any changes by the Contractor, then it will be communicated to the Contractor by the CO, COR or designee.

1.20. TELECOMMUNICATIONS/ELECTRONIC RESULT REPORTING:

1.20.1. Receiving Electronic Results. The VA shall receive results through a web based online account established for users at SFVAHCS. The completed and/or partial test results shall be available online to SFVAHCS facility personnel within published turnaround time (TAT) except where specified. The Contractor is responsible for all supplies required for transmission of test results.

1.20.2. The web based online account must allow the SFVAHCS user to:

1.20.2.1. Print copies of the laboratory reports

1.20.2.2. Provide a report format of the copies equal to the current facilities format.

1.20.2.3. Reprint capability of a report at the VA laboratory.

1.20.3. The Contractor shall:

1.20.3.1. Provide for individual user accounts for SFVAHCS laboratory personnel.

1.20.3.2. Have the responsibility to train medical center personnel in routine operations of the online account and

1.20.3.3. Provide a validation service (fax or telephone) in the event of transmission or online account failure.

1.21. TESTING METHODOLOGY & REFERENCE:

1.22. Testing methodology and reference ranges for a test must be defined in the laboratory user manual.

1.23. LOCATION OF PRIMARY TESTING LABORATORY. The primary reference laboratory is defined as the main facility where samples are transported and received, and a minimum of 85% of the submitted samples for testing are performed at that location. Up to 15% of the submitted samples may be referred to other Contractor’s testing laboratories within its network, and may be located in another time zone, provided there is a mechanism to maintain the samples’ integrity.

1.24. CONTRACTOR PERSONNEL:

1.25. The Contractor shall make sure employees have current and valid professional certifications before starting work under this contract. The Laboratory Director, medical technologists, medical technicians, cytotechnologists shall meet personnel qualifications required by CLIA '88 Guidelines. Pathologists must have graduated from an approved school of medicine or osteopathy and completed a residency or fellowship in pathology acceptable to the United States Surgeons General and must possess a valid license to practice clinical reference laboratory services from a United States jurisdiction; and shall have provided pathology services a minimum of 24 months within the past 36 months and pathology consultation services a minimum of 36 months within the past 48 months.

1.26. The Contractor shall maintain current licenses and certificates and provide copies of such to VA upon reasonable written request.

1.27. The courier personnel shall be trained and certified to handle biological and infectious samples as defined by the Department of Transportation. Copies of training certificates shall be made available upon request.

1.28. PERFORMANCE STANDARDS, QUALITY ASSURANCE AND QUALITY IMPROVEMENT:

1.28.1. The Contractor shall be subject to Quality Assurance measures, using the standards as outlined in this PWS and methods of surveillance detailed in the Quality Assurance Surveillance Plan (QASP). The QASP shall be attached to the resultant contract and shall define the methods and frequency of surveillance conducted.

1.28.2. The Government will evaluate the Contractor’s performance to ensure services are performed in accordance with this Contract to include monitoring test results for consistency to ensure results correlate with diagnosis. If any of the services do not conform to the contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no additional cost to the Government. When the defective services cannot be corrected by re-performance, the Government may:

1.28.3. Obtain the service from another source and charge the Contractor with any resultant charges plus actual administrative costs.

1.28.4. Require the Contractor to take necessary action to ensure that future performance conforms to contract requirements; and

1.28.5. Take other actions as appropriate, including but not limited to termination of this Contract.

1.28.6. For contracts with a period of one year or less, the CO will perform a single evaluation when the contract is complete. For contracts exceeding one year, the CO will evaluate the Contractor’s performance annually. Interim reports will be filed each year until the last year of the contract, when the final report will be completed. The report shall be assigned in CPARS to the Contractor’s designated representative for comment. The Contractor will have sixty (60) days to submit any comments and re-assign the report to the CO.

1.28.7. Failure of the Contractor to respond to the evaluation within those sixty (60) days will result in the Government’s evaluation being placed on file in the database with a statement that the Contractor failed to respond; the Contractor’s representative will be “locked out” of the evaluation and may no longer send comments.

1.28.8. To ensure proper handling and test performance, the Contractor shall provide the following updated information to VA upon request during the life of contract:

1.28.8.1. For quality purposes, tests routinely performed in duplicate should be indicated.

1.28.8.2. Indication of average monthly volume of specified tests in the Schedule that the laboratory performs.

1.28.8.3. Coefficient of variation of quality control samples of all tests or specified tests the laboratory performs.

1.28.8.4. Proficiency testing data shall include a list of tests outside of the acceptable range for past two years.

1.28.8.5. Contractor shall provide address of processing sites under contract, including subcontracted testing location sites.

1.28.8.6. The Contractor(s) facilities, methodologies (defined as the principal of the method and the references), and quality control procedures may be examined by representatives of the government upon prior written notice and during normal business hours during the life of the contract.

1.29. RECORDS:

1.29.1. The Contractor shall be responsible for creating, maintaining and disposing of only those government required records that are specifically cited in the work statement or required by the provisions of a mandatory directive listed in section (d) Applicable Publications and Forms. If requested by the COR, the Contractor shall provide the original record, or a reproducible copy of any such record, promptly of receipt of the written request.

1.30. PATIENT LISTS:

1.30.1. The Contractor shall treat patient lists, no matter how developed, as privileged information. Lists and/or names of patients shall not be disclosed to or revealed in any way for any use outside the VA without prior written permission by the COR or Chief of Staff.

1.31. RELEASE OF MEDICAL INFORMATION:

1.31.1. The Contractor and its subcontractors shall not release any medical information obtained during the course of this contract to anyone outside the VA, unless authorized in writing by the COR and the patient, as required by applicable law.

1.32. PROFESSIONAL LIABILITY INSURANCE:

1.32.1. Professional liability insurance shall be by a commercial insurance company in the business of providing the required insurance coverage. The Contractor shall provide a copy of the Insurance Certificate upon receipt of a written request by VA.

1.33. SAFETY:

1.33.1. The Contractor shall comply with all applicable OSHA, Federal, State, laws, and regulations as required for performing the type of services required.

1.34. END OF CONTRACT PERFORMANCE:

1.34.1. At the end of the period of contract performance, SFVAHCS will notify the Contractor of the quantity of unused supplies and arrange a pick-up time. All Contractor-provided equipment shall be disconnected by the Contractor from SFVAHCS’ facilities upon contract expiration and removed within five working days.

1.35. GENERAL DEFINITIONS:

1.35.1. Critical Value: A test result that requires evaluation by a physician or other health care provider as soon as verified. Failure to take appropriate action as a result of a critical value might cause harm or undue suffering for a patient. A list of critical values is to be made available to SFVAHCS upon request.

1.35.2. Reference or Referral Laboratory. The contract laboratory that provides testing, and examination of specimens provided by the VA.

1.35.3. Reference Value. A range of test values expected for a designated population of individuals.

1.35.4. Specimen. A body fluid or tissue sample removed for medical examination and analytical testing.

1.35.5. STAT. A designated category of tests that requires immediate processing to expedite results to physicians handling potentially life-threatening cases.

1.35.6. Surgical Specimen. A sample or part of an organ or tissue removed during surgery for medical examination and analytical testing.

1.35.7. Tests. Diagnostic assays to evaluate a patient's physiological condition.

1.35.8. Routine Test. A test that is usually performed at high volume in which the result is required in 24 hours generally.

1.35.9. Specialized Test. A test that is performed in low volume but the technology, expense, or time-consuming nature of each test, is such that some delay is expected. However, results should be received within a reasonable amount of time to meet patient care needs. The delay usually occurs to allow tests received from different enters to be batch to make the operation cost-effected.

1.35.10. Esoteric Test. A test that is similar to specialized tests, except they can only be done in a few laboratories throughout the country.

1.35.11. TAT. Turnaround time. The length of elapsed time between pick-up or dispatch of specimen from the contractor’s laboratory until the receipt of the completed printed/ electronically transmitted report back in the lab. Exception: For STAT tests, the TAT shall begin at the time of notification by the SFVAHCS laboratory to the Contractor. These definitions apply whether the contractor or a subcontractor performs the test.

1.35.12. Special handling. Unusual circumstances may dictate the need for a specimen to be picked up, run out of sequence at a special time, or reported within a shorter than usual time.

1.35.13. Overflow. A test usually performed in a SFVAHCS laboratory, which might be referred to the Contractor’s laboratory in case of instrument breakdown or other circumstances interfering with the VA’s ability to analyze the specimens.

1.35.14. Proficiency Testing. An assessment of the accuracy of testing by a laboratory based on the analysis of an unknown specimen analyzed by a large number of other labs. The proficiency survey is conducted by an organization or agency authorized by HHS to do so.

GOVERNMENT RESPONSIBILITIES

1.36. OVERSIGHT OF SERVICE/PERFORMANCE MONITORING: After award of contract, all inquiries and correspondence relative to the administration of the contract shall be addressed to the Contracting Officer (CO) or the Contracting Officer Representative.

1.37. SAMPLE PREPARATION:

1.37.1. SFVAHCS will provide laboratory specimens prepared according to the Contractor's laboratory user’s manual, identified, and labeled for testing. The Contractor shall be responsible for transporting and storing specimens according to industry standards. Contractor shall supply any special preservatives required for specimen preservation.

1.37.2. SFVAHCS is responsible for packaging the specimens for transport.

1.38. CO RESPONSIBILITIES:

1.38.1. The CO is the only person authorized to approve changes or modify any of the requirements of this contract. The Contractor shall communicate with the CO on all matters pertaining to contract administration. Only the CO is authorized to make commitments or issue any modification to include (but not limited to) terms affecting price, quantity or quality of performance of this contract.

1.38.2. The CO shall resolve complaints concerning Contractor relations with the Government employees or patients. The CO is final authority on validating complaints. In the event the Contractor effects any such change at the direction of any person other than the CO without authority, no adjustment shall be made in the contract price to cover an increase in costs incurred as a result thereof.

1.38.3. In the event that contracted services do not meet quality and/or safety expectations, the best remedy will be implemented, to include but not limited to a targeted and time limited performance improvement plan; increased monitoring of the contracted services; consultation or training for Contractor personnel to be provided by the VA; replacement of the contract personnel and/or renegotiation of the contract terms or termination of the contract.

1.39. COR Responsibilities:

1.39.1. After contract award, the CO will designate a VA employee as the Contracting Officer’s Representative (COR). The COR will be responsible for overseeing the services performed by under this Contract. The COR shall be the VA official responsible for verifying contract compliance. After contract award, any incidents of Contractor noncompliance as evidenced by the monitoring procedures shall be forwarded immediately to the CO.

1.39.2. The COR will certify monthly invoices for payment and will be responsible for monitoring the Contractor’s performance to ensure all specifications and requirements are fulfilled.

SPECIAL CONTRACT REQUIREMENTS

1.40. DELAYS IN REPORTING TEST RESULTS:

If for any reason, there will be a delay in reporting of test results the Contractor will contact the VA as soon as they are aware that a delay will occur. Such notification must be made by telephone or facsimile to the COR and the Contractor will provide an estimated time for delivery of delayed results. Email notification will not be accepted.

1.41. BILLING/INVOICES:

1.41.1. SFVAHCS will maintain a record-keeping system comprising daily logs specimens sent to the Contractor for processing. The COR will review this data against monthly invoices submitted by the Contractor to ensure invoices accurately reflect the services performed.

1.41.2. Payment made during all periods of performance of this agreement shall constitute the total cost for services rendered by the contractor, and shall not exceed the amounts specified in the “Schedule of Supplies and Services” without written request and the written approval from the CO.

1.41.3. Invoices rendered by the contractor to SFVAHCS for services furnished under this agreement, will be invoiced in full for each month in which services were performed. All payments made under this contract will be made monthly in arrears in accordance with FAR Clause 52.212-4. No advance payments will be authorized. Invoices shall be electronically sent, using the form Tungsten/OB10 e-Invoice, to the Department of Veterans Affairs, PO Box 149971 Financial Services Center (FSC), Austin, Texas 78714-8971. For more information on how to send invoices electronically, visit http://www.ipps.fsc.va.gov.

1.41.4. All invoices applicable to this contract must be submitted no later than thirty (30) days after the end of the contract period. Any problems regarding unpaid invoices should be directed to the COR.

1.41.5. At a minimum, each invoice must contain the following: Dates of service, description of test(s) performed, unit price, and total cost of services provided, purchase order number, contract number, and remittance address. All invoices must include the name, title and phone number of person to be notified in the event of defective invoicing. Refer to FSC policy in completing and submitting Form OB-10 e-Invoice.

1.41.6. All invoices must be submitted for actual services performed by the Contractor. Invoices shall be submitted in accordance with, and at the prices specified in the continuation of SF Form 1449, Schedule of Supplies and Services of this agreement.

1.41.7. Invoice requirements and supporting documentation: Supporting documentation and invoices must be submitted no later than the 20th workday of the month. Subsequent changes or corrections shall be submitted by separate invoice. In addition to information required for submission of a “proper” invoice in accordance with FAR 52.212-4 (g), all invoices must include all information necessary using electronic means in accordance with the policy set forth by the VA Financial Services Center, Austin, Texas (see previous paragraph).

1.42. SUBCONTRACTING:

If during the course of the Contract, the Contractor elects to subcontract to a different laboratory for the purpose of performing any of the services required under this Contract, the Contractor shall provide advance written notification to the CO and COR. SFVAHCS shall have the right to approve or disapprove the use of any proposed subcontractor(s) based on a determination of the subcontractor(s)’ ability to perform the services in accordance with VA’s standards for quality and consistency. The Contractor shall be responsible for ensuring that subcontractor possess and maintain the same qualifications, accreditations and certifications as required for the Contractor as described above.

6.4 CHANGES:

If it is deemed by VA that the removal of the test from the test menu is required, due to any changes by the Contractor, then it will be communicated by the CO, COR or designee.

The VA may need to add test to the test list during the contract term without contract modification. This may be due to a change or discontinued test previously done by another laboratory. VA may make requests for pricing, specimen requirements and methodology. The CO, COR or designee will make the final decision on the appropriateness of adding the subject test to the test list.

INFORMATION SECURITY REQUIREMENTS

1.43. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

1.44. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

1.44.1. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

1.44.2. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

1.44.3. The contractor or subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The CO must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

1.45. VA INFORMATION CUSTODIAL LANGUAGE

1.45.1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

1.45.2. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

1.45.3. The Contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

1.46. SECURITY INCIDENT INVESTIGATION

1.46.1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

1.46.2. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

1.47. LIQUIDATED DAMAGES FOR DATA BREACH

1.47.1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

1.47.2. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including: (a) date of occurrence; (b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

1.47.3. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1.47.3.1. Notification;

1.47.3.2. One year of credit monitoring services consisting of automatic daily monitoring of at least relevant credit bureau reports;

1.47.3.3. Data breach analysis;

1.47.3.4. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

1.47.3.5. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

1.47.3.6. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

1.48. TRAINING:

1.48.1. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

1.48.1.1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

1.48.1.2. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

1.48.1.3. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

1.48.1.4. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

1.48.2. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

1.48.3. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

1.49. SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES

1.49.1. The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

1.50. SECURITY ACCREDITATION PACKAGE

1.50.1. The C&A requirements do not apply and a Security Accreditation Package is not required.

RECORDS MANAGEMENT

The following standard items relate to records generated in executing the contract and should be included in a typical Electronic Information Systems (EIS) procurement contract:

1.51. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

1.52. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

1.53. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

1.54. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

1.55. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

1.56. The Government Agency owns the rights to all data/records produced as part of this contract.

1.57. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

1.58. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

1.59. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

1.60. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

Attachment A

TESTS BASED ON UTILIZATION (06/01/2021 TO 05/31/2022).

This is not an exclusive or complete listing of tests, but an estimate of the tests required and the annual volume of tests. Other tests not listed will be needed during this contract period.

image1.emf