Sources Sought-36C24726Q0840.docx

Sources Sought Notice Sources Sought Notice

GENERAL INFORMATION

SET-ASIDE

VISN 7 Network Contracting Office 3 FL Directors Office 3700 Crestwood Parkway Duluth GA 30096

POINT OF CONTACT*

Thomas Nicholls Thomas.Nicholls@va.gov

PLACE OF PERFORMANCE

Atlanta VA Medical Center

1670 Clairmont Road

Decatur, GA 30033

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

This is not a solicitation announcement. This is a sources sought synopsis for market research purposes ONLY. The purpose of this synopsis is to gain knowledge of potential qualified vendors that can provide the Abbott i-STAT Handheld Analyzer Point-of-Care Testing - Cost-Per-Test or equivalent IAW the Statement of Work (SOW) below. The applicable North American Industry Classification System (NAICS) for this requirement is 334516 (Analytical Laboratory Instrument Manufacturing) (size standard of 1,250 employees). Responses to this synopsis will be used by the Government to make appropriate acquisition decisions. After review of the responses to this source sought synopsis, a solicitation announcement may be published in SAM.gov. Responses to this sources sought synopsis are not considered adequate responses to the solicitation announcement. All interested offerors will have to respond to the solicitation announcement in addition to responding to this source sought announcement.

The Department of Veterans Affairs, Network 07 Contract Office, is seeking sources to provide:

Abbott i-STAT Handheld Analyzer Point-of-Care Testing - Cost-Per-Test or Equivalent IAW the Statement of Work (SOW) for the Atlanta, GA VA Medical Center If you are interested and can provide the required supplies, please provide the requested information as indicated below.

All RFI’s must provide the following information in this format:

1. Company Name:

Address:

Phone Number:

2. Point of Contact:

Email:

Phone Number:

All RFI’s must provide the answers to the following questions:

(1) Is your company considered small under the NAICS code identified under this RFI?

(2) Please submit your capabilities regarding the Statement of Work to establish capabilities for planning purposes.

Responses to this notice shall be submitted via email to: Thomas.Nicholls@va.gov Telephone responses will not be accepted. Responses must be received no later than 08/13/2026 at 15:00 PM EST. If a solicitation is issued, it shall be announced later, and all interested parties must respond to that solicitation announcement separately from the responses to this request for information. Responses to this notice are not a request to be added to a prospective bidders list or to receive a copy of the solicitation.

STATEMENT OF WORK

1.0 GENERAL INFORMATION

1.1 Title of Requirement: Abbott i-STAT Handheld Analyzer Point-of-Care Testing - Cost-Per-Test

1.2 Purpose: Cost-Per-Test: Contractor is required to provide a price for each test that can be performed on its equipment. The price per test shall include costs covering:

1.2.1 Equipment: Abbott iSTAT Analyzer(s), printer(s), downloader/recharger(s), and Electronic Stimulator(s)

1.2.2 Required reagents, controls, standards, supplies, consumables/disposable items (this includes any initial on-site reagent validation).

1.2.3 Parts, accessories, and any other item required for the proper operation of the contractor’s equipment and necessary for the generation and reporting of a test result (this includes an interface and any necessary additions to the interface to connect to the hospital’s LIS/HIS system and be bi-directional with the laboratory for data management and quality oversight).

1.2.4 All necessary maintenance to keep the equipment and accessories in good operating condition (this includes software calibration updates and parts replacement/emergency repair).

1.2.5 Replacement of handheld analyzers, printers, downloader/rechargers, and electronic quality control simulators, at no additional charge, within 24 hours.

1.2.6 Training on equipment, including maintenance on equipment

1.2.7 Delivery, installation, and removal of equipment at no additional charge

1.3 Background: VA Augusta Healthcare System (VAAHCS), Augusta, GA, currently uses a portable, handheld system to perform a variety of point-of-care testing (POCT) through a cost-per-test (CPT) order. Timely diagnostic information is critical to optimizing patient care, especially for acutely ill or critically compromised patients. Traditionally, laboratory testing at the VA Augusta Healthcare System has relied on centralized laboratory services that require specimen transport and processing before results are available to providers. While central laboratories offer comprehensive testing, this approach can introduce delays in patient care decisions—particularly in high-acuity settings such as emergency departments, intensive care units, and operating rooms.

1.4 Point-of-care (POC) blood analyzers were developed to address these challenges by enabling immediate diagnostic testing at or near the site of patient care. Handheld, portable POC analyzers facilitate rapid testing. These devices leverage advanced cartridge systems, making them easy to operate and requiring minimal user training.

1.5 The adoption of handheld POC analyzers within the VA Augusta Healthcare System supports the goals of enhancing patient safety, improving clinical workflow efficiency, and reducing the time from specimen collection to actionable results. This technology aligns with the Department of Veterans Affairs’ commitment to continuous quality improvement, patient-centered care, and leveraging innovative solutions to meet the evolving needs of veteran beneficiaries.

1.6 Type of Contract: The intent is to award a base plus one (1) four (4) year option, firm-fixed priced contract.

1.7 Period of Performance:

PERIOD OF PERFORMANCE

1.8 Cost Per Test Definition: Contractors are required to provide a price for each test that can be performed on equipment. The per test price shall include costs covering (1) 5 year equipment use, (2) all reagents, standards, quality controls, supplies, consumable/disposable items, parts, accessories and any other item required for the proper operation of the Contractor’s equipment and necessary for the generation and reporting of a test result, (3) all necessary maintenance to keep the equipment in good operating condition (This element includes both preventive maintenance and emergency repairs) and (4) training for Government personnel. Contractors are required to provide delivery, installation, and removal of equipment at no additional charge.

1.9 Scope: VAAHCS requires cost-per-test point-of-care testing on the i-STAT platform. All required testing shall be available on each analyzer. The analyzer shall be a specialized, portable, handheld instrument that uses self-contained, disposable reagent cartridges to perform the identified tests at the point of care, using less than two drops of venous, arterial, or capillary blood, with test times ranging from two to 15 minutes without any pre-treatment.

1.10 The analyzer (in quantities specified below) shall perform the laboratory assays currently performed by VAAHCS. Additionally, there shall be flexibility for future expansion of testing, using the same instrumentation. New tests may be added to the menu as requested. Required tests are as follows:

1.10.1 The following (CG8+) tests must be available on one single-sample test cartridge for use on the i-Stat Analyzer: Sodium, Potassium, TCO2 (Total Carbon Dioxide), Ionized Calcium, Glucose, Hematocrit, Hemoglobin, pH (Potential of Hydrogen (Acidity/Alkalinity)), PCO2 (Partial Pressure of Carbon Dioxide), PO2 (Partial Pressure of Oxygen), HCO3 (Bicarbonate), sO2 (Oxygen Saturation), BE (Base Excess)

1.10.2 The following (Chem8+) tests must be available on one single-sample test cartridge for use on the i-Stat Analyzer: Sodium, Potassium, TCO2, Ionized Calcium, Glucose, Hematocrit, Hemoglobin, Chloride, Creatinine, BUN

1.10.3 The following (CG4+) tests must be available on one single-sample test cartridge for use on the i-Stat Analyzer: TCO2, pH, PCO2, PO2, HCO3, sO2, Lactate

1.11 One single-sample cartridge must be available for high-sensitivity cardiac Troponin I testing on the i-Stat Analyzer.

1.12 One single-sample cartridge must be available for ACT testing on the i-Stat Analyzer.

1.13 One single-sample cartridge must be available for Creatinine testing on the i-Stat Analyzer.

1.14 Test volumes are based upon prior history and are not a guaranteed minimum. An annual review will be conducted to confirm adjusted shipment quantities through VA contracting. Annual test volumes are as follows:

1.15 Specific quarterly shipping schedule to be determined/established in conjunction with VAAHCS Point-of-Care Testing Coordinator, or designee. Shipments will be made to VAAHCS as scheduled through the established standing order/shipping schedule.

2.0 TASK AND ASSOCIATED DELIVERABLES

2.1 The Contractor shall provide all supplies and services as described herein. The Schedule of Pricing below shall be utilized to submit the required cost proposal. Any additional costs, such as Industrial Funding Fees, special shipping and handling fees, or other usage fees, shall be clearly indicated in the price quote.

2.2 The Contractor shall provide all the most current state-of-the-art POCT instrumentation available. Remanufactured and discontinued models shall not be accepted.

2.3 The Contractor must provide Food and Drug Administration (FDA)-approved portable analyzers/equipment for performance of chemistry, coagulation, and blood gas testing in either the laboratory or at the bedside. Models shall be handheld, lightweight, and portable with rechargeable power packs, equipped with a built-in laser barcode scanner for entering operator identification, patient identification, and reagent information, require minimal maintenance, and be easy to operate. Models shall be movable to the bedside without recalibration. Models shall have onboard, internal, automated quality controls with customizable intervals and lockout protocols.

2.4 Model shall provide accurate test assay results for sample specimens up to the manufacturer’s defined maximum test per hour without excessive malfunctions, breakdowns, or service calls.

2.5 All tests on board shall have final FDA clearance and approval at the time proposals are submitted. Adequate College of American Pathologists (CAP) proficiency testing groups, available at the time of the proposal, must be available for analytical evaluation.

2.6 Units required through cost-per-test: 22

2.7 Appropriate controls and calibrators shall be available for testing described above.

2.8 There shall be flexibility for future expansion of testing, using the same instrumentation footprint.

2.9 Equipment Functionality: The analyzers must have a comprehensive QC program for all tests, which includes, at a minimum, the following options:

2.9.1 On-board quality control data storage and reporting capabilities

2.9.2 The ability to view and print daily and monthly QC results

2.10 The system must be redundant with respect to the POC analyzers, having identical analyzers, each capable of operating independently of the others. This enables high peak throughput volume with the ability to cover for analyzer failure

2.11 System shall utilize single-sample test cartridges, reducing the risk of carryover

2.12 System shall have positive sample identification to reduce possible sources of error/delay and to improve laboratory efficiency.

2.13 Equipment shall be able to store and retransmit records (24 hours of maximal instrument throughput) in case of interface downtime.

2.14 Interfacing requirements to be provided by the vendor:

2.14.1 Instrument LIS physical connection and translation (drivers). Must be compatible with VAAHCS’s current UniPOC Point-of-Care Data Management System. The UniPOC is the current browser-based web application that allows VAAHCS users to manage the VAAHCS POCT program from any computer throughout our healthcare facility. This is a vendor-neutral connectivity product that interfaces hardware products with information systems. UniPoc includes configurable features to automatically or manually forward patient and QC results to the medical record through VISTA/CPRS. This bi-directional interface allows data to be uploaded from and downloaded to all POCT instruments and Web Results Xpress, which is used for manual test ordering and verification.

2.14.2 Any additional hardware and software needed to interface the Contractor’s analyzer and technical assistance with interfacing the analyzer.

2.15 Installation and Validation: Installation and set-up of the system shall be performed by an authorized technician employed by the vendor.

2.16 Space Requirements, Systems, Specifications - Configuration of the proposed equipment must be able to conform to the space currently allotted for this function. All system specifications must be disclosed in the proposed space. A site visit/walk-through is available upon request and will be scheduled at the convenience of the VAAHCS POCT Coordinator or designee. Arrangements shall be made through the COR or designee to establish an acceptable time that minimizes interruption to patient care. The site visit/walk-through must be requested in time to be completed at least 5 days before the close of the subject solicitation.

2.17 Installation - The contractor shall be responsible for installation of the proposed/accepted equipment, which consists of in-house delivery, positioning, and mounting of all equipment listed on the delivery order and connections of all equipment in coordination with the facility's Biomedical engineer, P&LMS POCT Coordinator or designee, and P&LMS Laboratory Information Manager, as necessary. Upon receipt of the notice to proceed with installation, it shall be the contractor’s responsibility to inform the Contracting Officer of any problems that may be anticipated during installation or that will affect optimum performance once installation is completed. If the progress of the installation is interrupted through no fault of the contractor, the continuous installation referenced in the preceding paragraphs may be terminated until the cause of the delay has been eliminated, and then shall be resumed within 24 hours after the contractor has been notified that work may again proceed.

2.18 The Contractor shall provide, at installation/set-up and when bringing new tests online, a technical support specialist who shall perform all validation studies, including: installation/set-up, correlation studies (evaluation/comparison data enough to satisfy JC/CAP standards), normal range studies, staff training, in-services to testing personnel and clinicians, and assist with any methodology problems and questions. This service shall be available during regular office hours, 5 days per week.

2.19 Service and Maintenance: Contractor must provide parts, maintenance, training, and tech support. Additional training shall be provided as needed at no additional cost, in accordance with the vendor’s training schedule.

2.20 Contractor shall provide telephone technical support service to assist in troubleshooting 24 hours per day, 7 days per week, 365 days per year. Once it is determined that service is required, technical support must be provided.

2.21 Emergency response within 24 hours and will have all repairs completed within 48 hours, after telephone notification is made to the vendor, or the vendor will supply a replacement system in full working condition. All labor travel costs and associated expenses for repairing and maintaining the analyzer system will be included and covered by the vendor at no additional cost.

2.22 The vendor will provide all standard and routine software and hardware upgrades to existing products for VAAHCS at no additional charge to the Government.

2.23 The Contractor shall provide a service agreement to include replacement, at no charge, of handheld readers, printers, downloaders, and electronic quality control simulators within 24 hours.

2.24 Patient Data Handling – Due to the nature of this requirement (clinical laboratory diagnostic testing system), the contractor’s maintenance/service repair/installation person(s) may have incidental access to patient information during installation or servicing of the contractor’s equipment. Any access to this information is incidental; it is not required by the contractor to perform the work outlined herein.

2.25 No equipment/hardware is to be removed from any VA location without written approval. Before removal, the hard drive (s) must be removed in the presence of the VAAHCS Information Security Officer (ISO), a VA Biomedical Engineer, and/or another VA-designated authority, and retained by VAAHCS for destruction in accordance with VAAHCS policy/procedure. Failure to comply with this VA requirement may result in prosecution.

2.26 The appropriate risk designation of the Field Representative/Service Engineer, as determined by the Position Determination Automated Tool (PDAT), is: Low Risk – Tier 1

2.27 All portable media (laptop, thumb drive, compact disk, etc.) shall be scanned for viruses by VAAHCS Biomedical Engineering before use on a VA system.

2.28 Contractor Representatives must check in upon arrival at the designated VAAHCS location.

2.29 Contractor’s Field Representative/Service Engineer shall always wear an identification badge while on station at VAAHCS and will be escorted by VAAHCS laboratory staff while in the laboratory area(s).

2.30 Computer Hard Drives: Per VAMC policy, no hard drives or computer disks containing VA patient information will be removed from VA facilities. At the time of turn-in or removal due to failure, the VA facility will remove all sensitive data from information systems and storage devices or render the data on these systems unreadable. No Federal Information Processing equipment will be discontinued from rental/lease or exchange without compliance with this requirement.

2.31 Training Requirements: The contractor shall provide in-depth training for VAAHCS POCT staff. This training shall be coordinated with and timely to the equipment installation. This training shall include comprehensive instruction in system operation, data manipulation, basic troubleshooting, and maintenance. The contractor shall provide operator and service manuals along with CLSI-compliant procedures for the instrument/tests.

2.32 Reagents and Supplies: Inventory Management - The Contractor shall provide a continuously stocked inventory of reagents, calibrators, troubleshooting controls, required consumable supplies, including all routinely replaced parts, disposables, and any other materials required to perform tests on the equipment properly. All i-STAT product shipments are initiated at the request of VAAHCS staff. Alerts/Notifications of all technical advisories/recalls/alerts, before or simultaneously with field alerts, should be forwarded to lab chiefs or designees. Failure to reserve adequate inventory will result in default.

2.33 Items Included - The vendor shall provide/install any routine and special items required to operate/maintain the equipment/analyzer in optimal condition. Any items excluded by the vendor but required for operation of the system at any time must be delineated in the technical proposal. The cost of any excluded items must be disclosed in the cost proposal.

2.34 Quality of Reagents and Supplies - All supplies provided/ordered for use on the contractor’s equipment will be of the highest quality necessary to ensure sensitivity, specificity, and tested to assure precision and accuracy. The reagent quality must be sufficient to meet the proficiency testing standards of the College of American Pathologists (CAP) and the Joint Commission (JC). If the supplies are found to be defective and unsuitable for use with the contractor's equipment or the contractor has failed to comply with the requirements herein, the contractor is required to deliver the supplies within 24 hours of receipt of the verbal order, if the verbal order is received by 1 pm EST, for priority delivery to the government activity. This shall be done at no cost to the government, in sufficient quantity to allow operation of the contractor's equipment for one week (under normal government test load volume).

2.35 Shipping Charges - No delivery charges for shipping or fee handling for shipments made at normal priority. Any additional costs, such as Industrial Funding Fees, special shipping and handling fees, or other usage fees, must be clearly indicated in the price quote and included in CPT.

2.36 Shipping Schedule – The specific shipping schedules for VAAHCS shall be determined/established in conjunction with the VAAHCS POCT Coordinator or designee. Shipments will be made to VAAHCS as scheduled through the established standing order/shipping schedule.

2.37 Ownership and Equipment: Ownership of the equipment will be established at contract inception, whether contractor-owned or VA-owned. All accessories (unused consumables, etc.) furnished by the contractor shall accompany the equipment upon its return to the contractor.

2.38 Equipment Removal: The contractor, upon expiration of order(s), at termination and/or replacement of equipment, shall remove the equipment after written authorization from the VAAHCS Information Security Officer (ISO), VAAHCS Office of Information and Technology (OI&T), VAAHCS Biomedical (BME) representative, or appropriate VAAHCS designee(s) in accordance with current VAAHCS policy/procedure.

2.39 If applicable, the contractor shall disconnect the analyzers and shall be responsible for decontamination of the system, packing, and shipping required to remove the analyzers.

2.40 The vendor shall remove all equipment within 30 days after notification of the expiration of the terms of this contract, but not until the completion of the new contractor's equipment installation, inclusive of completed cross-over studies.

3.0 CONTRACT OFFICER REPRESENTATIVE (COR)

3.1 The Contracting Officer (CO) will appoint a qualified Contracting Officer's Representative (COR) for oversight of this contract. The COR will be the primary VA point of contact for technical and administrative requirements.

3.2 The COR’s responsibilities include, but are not limited to, the following:

3.2.1 Serve as the primary point of contact for the Contractor regarding technical requirements for the supplies and services.

3.2.2 Monitor the Contractor’s performance to ensure compliance with all technical requirements and deliverables as outlined in the SOW.

3.2.3 Review, verify, and document that services (e.g., instrument calibration, maintenance, materials, and CPT testing results) conform to contract requirements.

3.2.4 Facilitate coordination with clinical, laboratory, and biomedical engineering teams as required.

3.2.5 Review and approve invoices for accuracy.

3.2.6 Maintain records of all correspondence and reports relating to the contract.

3.2.7 Report any performance issues or noncompliance to the CO immediately.

3.2.8 Safeguard VA sensitive information and ensure all privacy and security protocols (including PHI/PII) are strictly adhered to, in accordance with HIPAA and VA policies.

3.3 No Government personnel, other than the Contracting Officer, have the authority to change or alter these requirements. The COR shall clarify technical points or supply relevant technical information, but no requirements in this scope of work may be altered as a sole result of such verbal clarification.

3.4 COR and designees' contact information will be provided upon award. If there are any changes pertaining to the appointed COR, the contractor will be notified by the CO and/or the previous COR.

4.0 INVOICES

4.1 Payment will be made upon receipt of a properly prepared, detailed invoice, prepared by the Contractor, validated by the Contracting Officer’s Representative (COR), and submitted electronically through OB-10 (https://portal.tungsten-network.com/).

4.2 A properly prepared invoice will contain:

4.2.1 Invoice Number and Date

4.2.2 Contractor’s Name and Address

4.2.3 Accurate Purchase Order Number

4.2.4 Supply or Service provided

4.2.5 Total Amount Due

4.2.6 Corresponding CLIN

4.2.7 Quantity

4.3 Invoices shall be submitted and paid monthly, in arrears. Invoices shall be submitted within the 1st week of the month. This will also apply to final invoices following the contract expiration date. Any invoices submitted for supplies and services performed beyond the contract expiration date and/or not covered under the contract will be refused and identified as unauthorized commits (UAC).

5.0 ACCEPTABLE QUALITY LEVELS

5.1 The Acceptable Quality Levels (AQLs) define the minimum performance standards the Contractor must meet to ensure successful delivery of equipment, reagents, services, and support associated with the Abbott i‑STAT Point‑of‑Care Testing (POCT) Cost-Per-Test Program. The Government will use these measurable standards to evaluate performance. Failure to meet the AQLs may result in corrective actions, withholding of payment, termination for cause, or other remedies in accordance with the contract.

5.2 The Contractor shall meet or exceed the performance thresholds established in this section.

6.0 VA INFORMATION AND INFORMATION SYSTEM SECURITY AND PRIVACY LANGUAGE

GENERAL SECURITY INFORMATION

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

VA INFORMATION CUSTODIAL LANGUAGE.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA.The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

TRAINING

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role-based information security training].

b. The contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

SECURITY INCIDENT INVESTIGATION

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach involving any VA sensitive personal information the contractor/subcontractor processes or maintains under the contract; the contractor shall pay liquidated damages to the VA as set forth in clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs.

NARA RECORDS MANAGEMENT LANGUAGE:

1. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

2. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

6. The Government Agency owns the rights to all data/records produced as part of this contract.

7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

8. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records,…