Solicitation-36C24726Q0605.docx

Combined Synopsis/Solicitation Notice Combined Synopsis/Solicitation Notice

GENERAL INFORMATION

VISN 7 Network Contracting Office LaVista Business Park - Bldg A 2008 Weems Road Tucker GA 30084

POINT OF CONTACT*

Contract Officer Leonard Robinson leonard.robinson@va.gov

PLACE OF PERFORMANCE

POSTAL CODE

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

Table of Contents

36C24726Q0605

Page 1 of

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C247 Leonard Robinson Department of Veterans Affairs Network Contracting Office 07 LaVista Business Park – Bldg. A 2008 Weems Road Tucker GA 30084

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Department of Veterans Affairs-FMS-VA-2(101) Electronic Submission to: http://www.fsc.vs.gov/einvoice.asp ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

36C24726Q0605

B.2 STATEMENT OF WORK

1.0 GENERAL INFORMATION

1.1 Title: VISN Virtual Pharmacy Services

1.2 Background: Virtual pharmacy services are required to process pending outpatient mail prescriptions for VISN 7 medical centers and remote clinics. This support addresses ongoing regional staffing shortages caused by personnel vacancies and extended sick leave. Additionally, it helps manage increased workloads driven by expanding patient access and national/VISN initiatives to transition patients to contracted agents.

1.3 Type of Contract: VISN 7 intends to establish a five 1-year Indefinite Delivery, Indefinite Quantity (IDIQ) contract

1.4 Participating Facilities: Tasks under this SOW shall be provided for VISN 7 VAMCs remotely at Contractor facility (ies). The VISN 7 VAMCs to be included for coverage are, but not limited to, the following:

Decatur, GA 30033

Augusta, GA 30904-6258

Birmingham, AL 35233

Dublin, GA 31021

Montgomery, AL, 36109

Charleston, SC 29401

Columbia, SC 29209-1638

Tuscaloosa, AL 35404-5099

1.5 IDIQ Pricing Periods:

TABLE 2: ESTIMATED PRICING PERIODS

1.6 Yearly Estimated Outpatient Prescriptions: 1,800,000 (150,000 Per Monthly)

1.7 Applicable Laws, Regulations and Policies: The Contractor shall comply with all applicable federal, state, and local laws, regulations, directives, and Department of Veterans Affairs (VA) policies, including, but not limited to, the following:

1.6.1 Health Insurance Portability and Accountability Act (HIPAA)

1.6.2 Federal Information Security Management Act (FISMA)

1.6.3 Privacy Act of 1974

1.6.4 VA Handbook 6500 and VA Directive 6500

1.6.5 Department of Veterans Affairs Acquisition Regulation (VAAR)

1.6.6 Section 508 of the Rehabilitation Act

1.6.7 21st Century Integrated Digital Experience Act (IDEA)

1.6.8 National Institute of Standards and Technology (NIST) Special Publications (e.g., NIST SP 800-53, NIST SP 800-171)

1.6.9 Americans with Disabilities Act (ADA) Title III

1.6.10 All other federal and state laws and regulations

2.0 SCOPE, REQUIREMENTS, AND DELIVERABLES

2.1 Scope: Contractor shall provide professional virtual pharmacy services to complete pending clinic and outpatient prescription orders for the Department of Veterans Affairs, VISN 7 located in Georgia, Alabama, and South Carolina. Contractor shall provide enough licensed Pharmacists to perform remote prescription order review/order entry services for inpatient pharmacy services. This includes the professional review and problem solving needed to ensure safe and appropriate medication processing. The contractor shall provide pharmacists, technical support personnel, medical and telecommunication equipment, supplies, and supervision necessary to perform and implement virtual pharmacy services to meet the needs of VINS 7. The contractor must be a U.S. based corporation capable of providing remote pharmacy services to be completed via secure web-based system provided by the contractor.

2.2 Requirements of Virtual Pharmacists/Pharmacy Service:

2.2.1 The prescriptions will be verified by the pharmacists and sent electronically to the centralized mail-out pharmacy (CMOP) or suspended for local mail.

2.2.1 The pharmacist will evaluate each prescription for drug-drug interactions, contraindications for recorded drug allergies, appropriate doses, accurate directions and assure the printed label will be understandable to the patient.

2.2.2 Using formulary information provided by the VISN 7 Pharmacist Executive (VPE), VISN 7 pharmacy informaticist, and/or pharmacy service of specific sites, the pharmacist will review pending prescriptions for formulary status and process only new, renewed, and refills for formulary medications. New non-formulary prescriptions will not be processed by virtual pharmacist services.

2.2.3 Access to the Veterans Health Information Systems and Technology Architecture (VistA) computer system is required and virtual pharmacists will have to meet all information security and privacy requirements as required by the Department of Veterans Affairs.

2.2.4 Pharmacists must have knowledge of the VA Formulary and the VistA computer system, including outpatient prescription processing/verification workflows for pending outpatient prescriptions (i.e., completing pending outpatient prescriptions in VistA Outpatient Pharmacy, conducting required clinical screening such as allergy and drug interaction checks, using CPRS as needed to review relevant notes/labs, and dispositioning prescriptions to CMOP or suspending for local mail, as applicable). Pharmacists must also have a working knowledge of the processing requirements for proper completion of prescriptions and understand and be competent in accessing Computerized Patient Record System (CPRS) to read notes, check labs, etc. prior to completing prescriptions that have questionable doses, special needs, etc.

2.2.5 The VA will not provide laptops, computers or any electronic equipment to the virtual pharmacist services.

2.2.6 The work will be performed remotely

2.2.7 Prescriptions will be verified based on daily backlog (pharmacy pending prescription file).

2.3 Deliverables:

2.3.1 Prescriptions will be verified Sunday through Saturday with emphasis on after hours (after 5:00 pm local time on weekdays) and weekends, to include holidays.

2.3.2 Contractor will process and verify approximately 120,000 to 150,000 pending outpatient prescriptions per month (this estimation is subject to change depending on workload and local staffing).

2.3.3 Payment will be made upon the verification of the number of prescriptions processed in the prior month.

2.4 Personnel Qualifications:

2.4.1 Pharmacists must be citizens of the United States.

2.4.2 Graduate of a degree program in pharmacy from an American College of Pharmacy Education (ACPE) accredited college or university.

2.4.3 Full current and unrestricted license to practice pharmacy in a State, Territory, Commonwealth of the United States or the District of Columbia.

2.4.4 Pharmacists must have recent experience using VistA and CPRS to process and verify outpatient prescriptions (including processing pending outpatient prescriptions for mail). For purposes of this SOW, “outpatient prescription processing/verification” includes reviewing and completing pending outpatient prescriptions in VistA Outpatient Pharmacy, performing required clinical screening (e.g., allergies, drug-drug interactions, contraindications, dose/directions appropriateness), using CPRS as needed to review relevant notes/labs, and dispositioning prescriptions appropriately (e.g., releasing electronically to CMOP or suspending for local mail). The VA will not provide training on VistA/CPRS or outpatient prescription processing workflows; pharmacists must be able to perform these duties upon start. Experience with VistA/CPRS outpatient prescription processing must have been gained within the last three (3) years and must include a minimum of twelve (12) months cumulative experience processing outpatient prescriptions in the VA during the past three (3) years.

2.4.5 Pharmacists are familiar with VA formulary and restrictions including Prior Authorization requirements and Criteria for use of non-formulary drugs.

2.4.6 Must be able to provide at least six (6) qualified pharmacists at all times.

2.4.7 Pharmacists must provide their own computer equipment and must be able to obtain clearance from the VISN 7 Department Veterans Affairs Medical Center Information Security Officer.

2.5 Qualifications

2.5.1 Personnel assigned by the contractor to perform the services covered by this contract shall be licensed (as applicable) in a State, Territory, or Commonwealth of the United States or the District of Columbia. The qualifications of such personnel shall also be subject to review by VA Service Line Executives, Specialty Care, VA Chief of Staff and approval by the VA Network Director. Pharmacists must be citizens of the United States.

2.6 Payment for Services Rendered

2.6.1 The VA agrees to reimburse the Contractor on a monthly basis for services rendered as specified in the statement of work of this contract. Failure to carry out the specified services will result in non-payment and/or, at the discretion of the VA, a proration of agreed upon reimbursement based on extent of compliance with contract specifications and timeliness of services rendered.

2.6.2 The Contractor will be responsible for submitting a bill on a monthly basis for services provided to the OB1-/Tungsten electronic invoice system. The bill for services provided in a month should be received by the Fiscal Office by the 10th of the following month; however, every month of service completed should be billed no later than 90 days from date of service. Failure to comply with these requirements will result in non-payment.

2.6.3 Billings rendered by the Contractor to the VA for services furnished to a VA beneficiary under the terms of this contract shall be billed in full. Neither the beneficiary, his/her insurer, nor any other third party shall be billed.

2.7 Acceptable Quality Level: Monitoring will be based on procedures established by the VA Pharmacy Service to ensure services are appropriate, complete and satisfactory. The Contracting Officer’s Representative (COR), to be designated upon contract award, will be responsible for monitoring contract compliance and reporting any noncompliance as evidenced by the established monitoring procedures to the Contracting Officer for necessary action. In addition, the COR may designate appropriate VAMC personnel to monitor Contractor employee(s) work hours/services through one or a combination of the following mechanisms:

2.7.1 The COR will be responsible for verifying contract compliance. Any incidents of Contractor non-compliance as evidenced by the monitoring procedures shall be forwarded immediately to the Contracting Officer.

2.7.2 Documentation of services performed shall be reviewed prior to certifying payment. The COR will perform periodic spot checks and document with the using service to ensure monitoring reports. VAMC will pay only for services actually performed and in strict accordance with the schedule of price/costs. Contract monitoring and record keeping procedures shall be sufficient to ensure proper payment and allow audit verification that services were provided.

2.7.3 Contractor’s performance shall be monitored by the COR or his/her designee and reported to the VISN 7 VPE, Pharmacy Chiefs, and vendor. The contract Virtual Pharmacy Services shall be monitored through a variety of mechanisms including:

3.0 CONTRACT OFFICER REPRESENTATIVE (COR)

3.1 The Contracting Officer’s Representative (COR) will serve as the primary technical point of contact for this contract. The COR is responsible for overseeing contractor performance, ensuring compliance with contract requirements, and verifying that services and deliverables meet the standards outlined in the Statement of Work (SOW).

3.2 The COR’s responsibilities include, but are not limited to, the following:

3.2.1 Monitoring the contractor’s progress and performance.

3.2.2 Providing technical guidance and clarifications regarding contract requirements.

3.2.3 Reviewing and approving invoices and deliverables.

3.2.4 Ensuring project milestones, timelines, and specifications are adhered to.

3.2.5 Communicating any issues or concerns to the Contracting Officer (CO) for resolution.

3.2.6 Ensuring compliance with VA regulations, policies, and information security requirements.

3.3 No Government personnel, other than the Contracting Officer, have the authority to change or alter these requirements. The COR shall clarify technical points or supply relevant technical information, but no requirements in this scope of work may be altered as a sole result of such verbal clarification.

3.4 COR and designees' contact information will be provided upon award. If there are any changes pertaining to the appointed COR, the contractor will be notified by the CO and/or the previous COR.

4.0 INVOICES

Payment will be made upon receipt of a properly prepared, detailed invoice, prepared by the Contractor, validated by the Contracting Officer’s Representative (COR), and submitted electronically through OB-10 (https://portal.tungsten-network.com/).

4.1 A properly prepared invoice will contain:

4.2.1 Invoice Number and Date

4.2.2 Contractor’s Name and Address

4.2.3 Accurate Purchase Order Number

4.2.4 Supply or Service provided

4.2.5 Total Amount Due

4.2.6 CLIN, Description, Unit price, quantity, and CLIN Total

4.3 Invoices shall be submitted and paid monthly, in arrears. Invoices shall be submitted within the 1st week of the month. This will also apply to final invoices following the contract expiration date. Any invoices submitted for supplies and services performed beyond the contract expiration date and/or not covered under the contract will be refused and identified as unauthorized commits (UAC).

5.0 SECURITY REQUIREMENTS FOR CONTRACTOR EMPLOYEES

1. Contractor shall ensure the confidentiality of all patient and employee information and shall be held liable in the event of breach of confidentiality. Any person who knowingly or willingly discloses confidential information from the Veterans Affairs Medical Center may be subject to fines of up to $20,000.00.

2. Records: Contractor personnel who obtain access to hardware or media which may manipulate or store drug or alcohol abuse data, sickle cell anemia treatment records, records or tests or treatment for or infection with HIV, medical quality assurance records, or any other sensitive information protected under 38 U.S.C. 4132 or 3305, as defined by the Department of Veterans Affairs, shall not have access to the records unless absolutely necessary to perform their contractual duties. Any individual who has access to these data will disclose them to no one, including other employees of the Contractor not involved in the performance of the particular contractual duty for which access was obtained. Violation of these statutory-provisions as stated in department regulations by the Contractor’s employees may involve imposition of criminal penalties.

3. System of Records: The Contractor personnel will have access to The Veterans Administration system(s) of records in order to maintain patient medical records.

4. Procedures for User Access: Access requirements to VA information systems by Contractors and Contractor personnel shall meet or exceed those required for Veteran’s Health Administration (VHA) employees as described in VistA Directives (and others) and in any subsequent VistA policy statements. A written and signed request for user access by VistA Management, or designee(s), constitutes management approval (sponsorship) to initiate a request for access to any sensitive automated information system. Access shall be granted to non-VA users only if the purpose for access meets criteria of the Privacy Act and VA Confidentiality regulations and transfer.

5. Contractor will be required to sign and abide by the VA Computer Access Security Agreement and Confidentiality Agreement.

6. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS: All contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access. If the investigation is not completed prior to the start date of the contract, the contractor will be responsible for the actions of those individuals they provide to perform work for VA.

Position Sensitivity – The position sensitivity has been designated as a low risk.

Background Investigation – The level of background investigation commensurate with the required level of access is National Agency Check with Inquiries.

Contractor Responsibilities – The contractor, their personnel, and their subcontractors if applicable shall be subject to the Federal laws, regulations, standards, and VA Directives and handbooks regarding information and information system security as delineated in this contract.

a. The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM), the contractor shall reimburse VA within 30 days.

b. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak and understand the English language.

c. The contractor shall submit or have their employees submit the following required forms to the VA Office of Security and Law Enforcement within 30 days of receipt:

(1) Standard Form 85P, Questionnaire for Public Trust Positions

(2) Standard Form 85P-S, Supplemental Questionnaire for Selected Positions

(3) FD 258, U.S. Department of Justice Fingerprint Application Chart

(4) VA Form 0710, Authority for Release of Information Form

(5) Optional Form 306, Declaration for Federal Employment

(6) Optional Form 612, Optional Application for Federal Employment

d. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract.

e. Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

Government Responsibilities

f. Perform a suitability assessment of each contract pharmacist nominated by the contractor to perform under this contract, to include:

(1) Background Investigation and Personnel Security Adjudication Center (PSAC) adjudication completed with a favorable decision

(2) Complete VetPRO enrollment for verification and tracking of professional licensure.

g. Upon successful adjudication, the issuance of a Personal Identity Verification (PIV) card to log into the Citrix Access Gateway (CAG).

(1) If pharmacist is a moonlighter (i.e., current VA employee outside VISN 7), a PIV will not be issued and account will be granted 2FA exemption

h. Local sites will provide login credentials into the electronic health record environment (e.g., VistA, CPRS, or any future EHR).

Property Damage

The contractor shall take all necessary precautions to prevent damage to any government property. The contractor shall report any damages immediately and shall be assessed current replacement costs for property damaged by the contractor, unless corrective action is taken. Any damaged material (i.e., shelving, pharmacy equipment, etc.) will be replaced in a timely manner or corrected by the contractor with like materials, at no extra cost to the government, upon approval of the Contracting Officer.

Record Retention

Upon completion or termination of the applicable contract(s) or agreement(s), return and/or destroy, at Covered Entity’s option, VA information gathered, created, received, or processed during the performance of the contract(s) or agreement(s). No data will be retained by Business Associate, or contractor, subcontractor, or other agent of Business Associate, unless retention is required by law and specifically permitted by Covered Entity. As deemed appropriate by and under the direction of Covered Entity, Business Associate shall provide written assurance that all VA information has been returned to Covered Entity or destroyed by Business Associate. If immediate return or destruction of all data is not possible, Business Associate shall notify Covered Entity and assure that all VA information retained will be safeguarded to prevent unauthorized Uses or Disclosures.

Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

Termination of contract Note: If the vendor maintains any records whether hardcopy or electronic, they must be returned to the VA per contract and VA regulations by vendor. All files (hardcopy or electronic) shall not be shared with a 3rd party (unauthorized) unless authorized in writing by the COR or contracting Officer. If any disclosures of VA records to any 3rd party, an accounting of the disclosure must be kept by the vendor.

Privacy and Security

The contractor will comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and maintain the minimum necessary protected health information data required for the survey process. The contractor will develop and use proprietary patient satisfaction measurement tools, methodologies, and databases to advise and assist health care providers improve the quality of patient care. The VISN 7 Network and pharmacies are each a health care provider and will engage the contractor to assist with health care operations, specifically to provide services to help the medical center with internal quality oversight review, with conducting quality assessment and improvement activities which include evaluating outcomes, and evaluating practitioner and provider performance. In connection with services to be provided by the contractor, the VISN 7 Network and pharmacies may disclose patient information (as defined below) which the medical centers have obtained or created as part of the patient’s treatment. Under the business relationship between the contractor and the VISN 7 Network and pharmacies, the medical centers will allow the contractor limited access to certain patient information, which is the sole property of the medical centers. The contractor will provide reasonable administrative, technical and physical safeguards to protect the integrity and confidentiality of patient information within its control. The contractor will also prevent reasonably anticipated threats to the security or integrity of such patient information as well as unauthorized uses or disclosures of such patient information, and will secure compliance by its representatives.

Definitions:

“Patient information” means any individually identifiable health information which: (a) contains personal identifying demographic information which would, either alone or in combination with other publicly available information, allow identification of an individual, such as the patient’s name, address, phone number, social security number, or other information; and (b) relates to the past or present physical or mental health or condition of an individual.

“The VISN 7 Network and pharmacies’ information” means patient satisfaction measurement data, analyses and reports created for the medical center by the contractor based on data furnished by the medical center and by medical center’s patients and that is readily identifiable to the medical center as the source of the information.

“Representatives” include directors, officers, employees, accountants, attorneys and other agents.

Restrictions on the use and re-release of patient information: The parties agree that the contractor and its representatives may use patient information (a) to do statistical analyses and create reports to be released only to the VISN 7 Network and pharmacies. The contractor will not re-release patient information or the VISN 7 Network and pharmacies’ information to any person other than to the VISN 7 Network and pharmacies and to contractor representatives who have a need to know such information for providing services to the VISN 7 Network and pharmacies in accordance with the underlying agreement between the parties, except with the written consent of The VISN 7 Network and pharmacies. All contractor representatives will be required to sign a non-disclosure agreement as a condition of their employment, a copy of which is available for review upon request by the VISN 7 Network and pharmacies. The vendor will be required to perform background checks on all contractor representatives having access to the VISN 7 Network and pharmacies’ patient information and be able to provide information upon request related as to the information obtained in the background check to the VISN 7 Network and pharmacies.

De-identification of patient information: Within the contractor’s base, any VISN 7 Network and pharmacies’ patient information will be required to be de-identified and stripped of indicators such that one skilled in administering medical records could not link medical information to a specific patient. Data which has been stripped of patient identifying indicators such as patient name and address and incorporated into the contractor’s comparative or benchmark databases shall cease to be patient information creates large comparative or benchmark patient satisfaction databases to help health care providers improve the efficiency and effectiveness of health care delivery. The contractor may include in their database data that has been de-identified and stripped of indicators such that one skilled in administering medical records could not link medical information to a specific patient.

Security Controls Compliance Testing

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day’s notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

9. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, VA HANDBOOK 6500.6 APPENDIX D relating to access to VA information and information systems;

(2) Successfully complete the appropriate VA privacy training and annually complete required privacy training: VA Privacy and Information Security Awareness and Rules of Behavior -VA10176 and Privacy and HIPAA Training-VA10203;

(3) The contractor is to log into TMS and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

6.0 VA INFORMATION AND INFORMATION SYSTEMS SECURITY/PRIVACY LANGUAGE

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

4. TRAINING.

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role-based information security training].

b. The contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

5. SECURITY INCIDENT INVESTIGATION.

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA.