Sources Sought - 36C24726Q0893.docx

Sources Sought Notice Sources Sought Notice

GENERAL INFORMATION

SET-ASIDE

VISN 7 Network Contracting Office LaVista Business Park - Bldg A 2008 Weems Road Tucker GA 30084

POINT OF CONTACT*

Contract Officer Leonard Robinson leonard.robinson@va.gov

PLACE OF PERFORMANCE

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

Leonard Robinson Contract Officer Department of Veterans Affairs Regional Procurement Office East Network Contracting Office 7 LaVista Business Park-Building A 2008 Weems Road Tucker, GA 30084

This is a SOURCES SOUGHT NOTICE only for the purpose of Market Research. Response to this notice will be used for information and planning purposes. THIS IS NOT A SOLICITATION FOR PROPOSALS or QUOTES, and NO CONTRACT SHALL BE AWARDED FROM THIS NOTICE.

This RFI is issued only for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI that is marked as proprietary will be handled accordingly. Responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. Responders are solely responsible for all expenses associated with responding to this RFI.

This is NOT a solicitation announcement. This is a sources sought/RFI only. The purpose of this sources sought/RFI is to gain knowledge of potential qualified sources and their size classification relative to 621991 – Blood and Organ Banks (SBA Size Standard of $40M). Responses to this sources sought will be used by the Government to make appropriate acquisition decisions. After reviewing the responses to this sources-sought, a solicitation announcement may be published. Responses to this sources-sought synopsis are not considered adequate responses for a solicitation announcement.

The Department of Veterans Affairs, VISN 7, is seeking information on qualified contractors capable of supplying Blood and Blood-Related Products and Testing Services for facilities in South Carolina, Georgia, and Alabama IAW the Statement of Work.

Interested and capable respondents are requested to provide the following information:

1. Company Name

1. Company Address

1. Company Phone Number

1. Point of Contact Email

1. Point of Contact Phone Number

1. Unique Entity ID – SAM.GOV

1. Type of Small Business:

1. Capability Statement

1. Relevant Experience Narrative

1. Suggestions/ Input on SOW – Not Required but Welcomed

Responses to this notice shall be submitted via email to: leonard.robinson@va.gov. Telephone responses will not be accepted. Responses must be received no later than 09/03/2026 at 11:00 AM EST. If a solicitation is issued, it shall be announced later, and all interested parties must respond to that solicitation announcement separately from the responses to this request for information. Responses to this notice are not a request to be added to a prospective bidders list or to receive a copy of the solicitation.

STATEMENT OF WORK

1.0 GENERAL INFORMATION

1.1 Title: VISN 7 Blood and Blood-related Products

1.2 Purpose: The Department of Veterans Affairs, VISN 7, which includes facilities located throughout Alabama, Georgia, and South Carolina, is seeking a contractor to provide blood and blood-related supplies and services. The following facilities require these supplies and services:

TABLE 1: Participating Facilities (But not Limited to)

1670 Clairmont Road Decatur, GA 30033

950 15th Street Augusta, GA 30904-2608

One Freedom Way Augusta, GA 30904-6258

700 South 19th Street Birmingham, AL 35233

1826 Veterans Blvd.

Dublin, GA 31021

215 Perryhill Road Montgomery, AL, 36109

109 Bee Street Charleston, SC 29401

6439 Garners Ferry Road Columbia, SC 29209-1638

1.3 Background: The Department of Veterans Affairs (VA) is dedicated to providing comprehensive and timely healthcare services to Veterans throughout the United States. As part of this mission, VA medical facilities routinely require access to a reliable supply of blood and blood-related products, including associated testing and laboratory services that support patient care, emergency transfusions, surgeries, and ongoing medical treatments.

1.4 VISN 7, which encompasses VA facilities across Alabama, Georgia, and South Carolina, relies on contracted partners to ensure an uninterrupted supply of these critical products and services. Consistent access to blood, blood components, and required testing is vital for maintaining high standards of patient care and for responding effectively to both routine medical needs and emergencies. This procurement intends to establish reliable sources for the delivery, testing, and handling of blood and blood-related products for the VISN 7 medical centers and their affiliated clinics.

1.5 Type of Contract: VISN 7 intends to establish a five-year, indefinite delivery/indefinite quantity (IDIQ), firm-fixed price contract.

1.6 Period of Performance: The Government is anticipating awarding a 5-year firm-fixed-price Indefinite-Delivery Indefinite-Quantity Contract. The effect date will be from June 01, 2026, through May 31, 2031.

TABLE 2: PRICING PERIODS

1.7 Scope: The contractor shall furnish all necessary labor, materials, equipment, and qualified personnel to provide blood and blood-related products along with associated testing and laboratory services to Department of Veterans Affairs (VA) medical facilities within VISN 7 (Alabama, Georgia, and South Carolina). All supplies and services shall be provided in accordance with applicable federal, state, and local regulations, as well as VA policies and procedures.

2.0 TASK AND DELIVERABLES

2.1 All whole blood and blood components provided to patients in VA medical centers must meet the requirements of the American Association of Blood Banks (AABB) and/or the Food and Drug Administration (FDA), Department of Health and Human Services.

2.2 Allogeneic blood/blood components must be typed for ABO and Rho(D) in accordance with licensed methodologies, and must be tested for all transfusion-transmitted disease markers currently required by both the FDA and AABB.

2.2.1 All blood must be collected by the closed system under aseptic conditions, processed in appropriate solutions, and the container so labeled. The label must also bear the expiration date of the contents, which must not exceed the Food and Drug Administration (FDA) allowable limit for the type of anticoagulant in which the blood component is drawn.

2.2.2 All blood supplied must be free of hemolysis, clots, and excessive chyle.

2.3 Autologous blood/blood components must be typed for ABO and Rho(D) in accordance with licensed methodologies, and must be tested for all transfusion-transmitted disease markers currently required by the FDA.

2.4 The Contractor shall supply 100% “volunteer donor” blood as defined in 21CFR606.121(c)(5)(ii). All blood/blood components must be collected from donors in accordance with the requirements of the AABB and the FDA.

2.5 In the event of a recall, Contractor shall promptly send copies of the recall request to the Blood Bank Medical Director at the VA medical center where the blood product was issued.

2.6 Contractor shall make reference transfusion services available to all VA medical centers. The offeror must be capable of providing the blood components and specialized testing detailed in the Schedule of Supplies/Services and Prices/Costs (the Schedule) on a 24-hour-per-day, seven days per week basis. To include Immunohematology Reference Laboratories (IRL), histocompatibility testing(HLA), and Molecular testing.

2.7 The Contractor awarded this contract shall be VISN 7 VAs' primary supply source for blood and blood components. The Facilities shall obtain blood and blood components from a provider other than the awarded Contractor only if:

2.7.1 There is an emergent circumstance (as defined in the Facilities' reasonable discretion, with an explanation to be provided to the Contractor if requested); or

2.7.2 There is a Force Majeure Event (as provided herein); or

2.7.3 The Contractor is unable to provide blood or blood components within a reasonable time of an order being placed; or

2.7.4 The Contractor refuses to provide blood or blood components; or

2.7.5 At the request or direction of a patient or a patient's physician, the facility is directed to use autologous blood, which is available through a provider other than the awarded contractor

2.8 Changes in Testing Requirements for Transfusion-Transmitted: In the event that the FDA nationally mandates additional testing for transfusion-transmitted diseases during the contract period, specific price adjustments may be requested by the supplier to address the cost for the additional testing. In the event that this should occur, a letter detailing the rationale for the price increase must be submitted to the Contracting Officer at least 30 days before the intended implementation date.

2.9 Donor Requirements: The contractor shall maintain readily available blood donor lists, including names, addresses, and social security numbers. Such lists must indicate whether, and on what date, the blood of a particular donor was furnished to the VA under this contract.

2.10 Offeror’s donor identification numbers must be unique to the donor unit and must have an FDA-approved numbering scheme.

2.11 Donor selection must be in accordance with criteria established by the FDA and/or the AABB.

2.12 Each unit of blood collected through voluntary donation must minimally be tested for all transfusion-transmitted disease markers currently required by both the FDA and AABB.

2.13 Each platelet component must be tested for bacterial contamination (sterility) in accordance with AABB standard 5.1.5. effective March 1, 2004.

2.14 Orders/ Deliveries: Orders will be categorized into three types: routine, as soon as possible (ASAP), and STAT. These categories are defined as follows:

2.14.1 Routine shipments of blood products to maintain minimum inventory levels or blood products ordered to fulfill a standing request.

2.14.2 As Soon As Possible (ASAP) – Shipments of blood products to fill a request for a waiting outpatient, or a non-life-threatening need within several hours, or to replenish a depleted inventory of a particular blood product that has been used since the previous routine delivery. ASAP orders must be delivered within 4 hours of request.

2.14.3 STAT – A need for blood products so acute that a patient’s life could be jeopardized if the request for blood products is unfulfilled. STAT orders must be delivered to all sites within 90 minutes of the request.

2.15 Routine blood and blood component orders shall be delivered as specified within 24 hours following online, telephoned, or faxed orders or mutually agreed upon shipment of inventory. All online orders shall be followed up with a confirmation e-mail for facilities that use online orders. Telephone orders shall be confirmed at the time of order. To facilitate service to the Facilities, the contractor shall maintain service 24 hours a day, seven days a week. Contractor shall make delivery services for blood and blood components available to all VA sites 24 hours per day, seven days a week, 365 days a year, subject to blood product availability and a lack of force majeure events as outlined in 48CFR 52.212-4(f). Unless other arrangements are made, the contractor shall pay the expenses for the delivery of blood and blood components to and from each hospital, using the method of delivery or shipment appropriate to the circumstances. Contractor will ensure that all blood and blood components supplied to the Facilities are accompanied by appropriate documentation and transported in a validated manner, so that the blood and blood components remain within specification throughout the transfer period. Thereafter, the Facilities shall be responsible for any loss, destruction, or damage to the blood. The blood components provided to the Facilities may not be sold, exchanged, or transferred without the Contractor's prior authorization, except in the event of an emergency. The Facilities shall notify the Contractor of any such emergency and retain records to track the unit's disposition.

2.16 The estimated routine standing delivery schedule will be the following:

2.17 It is estimated that ASAP delivery services will occur at the following rate:

2.18 It is estimated that STAT delivery services will occur at the following rate:

2.19 Each VA medical center will establish the specific volumes distributed in a routine order. However, the contractor shall submit a proposed delivery and route schedule for approval within ten days after contract award. The schedule may be adjusted periodically.

2.20 Either leukoreduced or non-leukoreduced blood will be ordered on a site-specific basis (Refer to Attachment D for volumes).

2.21 Once a VA medical center receives units, those units become the property of the VA medical center, and payment will be made appropriately, based on contract terms and proper invoicing. They are not to be treated as though they are on consignment. However, for inventory control purposes, each VA medical center will make efforts to assist the contractor and other facilities in meeting patient transfusion needs.

2.22 The VA will be subject to and comply with all requirements and regulations associated with the recall and withdrawal of blood or blood components from its inventory due to health and safety risks.

2.23 Efforts will be made to assist the supplier in hosting blood donor drives at the VA medical center(s) in those cases where the hosting VA site can reasonably accommodate it, and where there are no previous commitments to other blood centers, including the Department of Defense. The annual number of blood donor drives will be negotiated between the contractor and the VA medical center.

2.24 Laboratory Tests: All laboratory tests must be performed by a laboratory accredited by AABB, certified by HCFA, or licensed and/or registered by the FDA. In the event the vendor implements a new laboratory test intended to improve the safety or quality of blood or blood components provided to the facilities, and as required by FDA or as advisable pursuant to professional standards including standards or recommendations through the AABB or other professional organizations, the contract may be modified at the discretion of the Government to add the test to the price schedule, section B.2.

2.25 VA Personnel Authorized to Place Orders: VA personnel authorized to place orders will be identified at the time of award

2.26 Shelf Life: All blood/blood components must be labeled, stored, and shipped in accordance with the current regulations of both the FDA and the AABB. In the event that these regulations change during the course of the contract, the contractor shall implement the necessary changes as directed/recommended by the regulatory and accrediting agencies.

2.27 For routine orders, allogeneic blood/blood components must be supplied with appropriate remaining shelf life, as detailed below.

2.27 For ASAP and STAT orders, the contractor shall provide units with the appropriate remaining shelf life IAW E.2 whenever possible; however, the VA understands that the urgency of the situation and the availability of the blood product may preclude this possibility.

2.28 When the VA returns units prior to expiration in accordance with the contractor's return policy, the contractor shall credit the VA for units that are returned, as detailed in the Schedule.

2.29 Value-Added Services: These services will be provided to the VISN 7 VA medical centers at no charge.

2.30 Contractor shall provide physician consultative services to the VISN 7 VA medical centers that are consistent with the services offered to other non-VA contracted customers. A description of the services must be included with the offeror’s proposal.

2.31 Contractor shall provide educational programs to the VISN 7 VA medical centers that are consistent with the programs offered to other non-VA contracted customers. A description of the educational programs must be included with the offeror’s proposal.

3.0 CONTRACT OFFICER REPRESENTATIVE (COR)

3.1 The Contracting Officer (CO) will appoint a qualified Contracting Officer’s Representative (COR) to provide oversight for all technical and administrative aspects of this contract. The COR will serve as the primary VA point of contact for issues related to blood and blood-related products and services furnished under this contract.

3.2 The COR’s responsibilities include, but are not limited to, the following:

3.2.1 Serve as the primary point of contact for all technical matters between the VA and the Contractor, including communication with participating facilities across VISN 7 (Alabama, Georgia, and South Carolina).

3.2.2 Monitor and evaluate contractor performance to ensure compliance with all technical requirements, deliverables, and standards outlined in the Statement of Work. This includes verifying that all blood and blood-related products meet FDA, AABB, and VA requirements, as well as any site-specific needs.

3.2.3 Review documentation, such as test records, inventory reports, donor lists, and delivery schedules, to verify accuracy and completeness in accordance with contract requirements.

3.2.4 Confirm all deliveries of blood and blood-related products (routine, ASAP, and STAT orders) are made in accordance with accepted timelines and specifications, and that documentation accompanies all shipments as required.

3.2.5 Oversee proper receipt, storage, and inventory management of blood and blood-related products at VA facilities, including shelf life and labeling compliance.

3.2.6 Facilitate coordination between VA clinical, laboratory, and biomedical teams and the Contractor, as needed, for clinical consultative services, laboratory testing, and educational programs.

3.2.7 Review and validate invoices for supplies and services delivered, ensuring all required contract information (e.g., accurate purchase order number, delivery dates, unit pricing, and totals) is present before submission for payment processing.

3.2.8 Maintain comprehensive records of all correspondence, documentation, and reports related to the contract, including incident reports (e.g., recall notifications, emergent circumstances, returns).

3.2.9 Promptly report instances of noncompliance, deficient performance, or service interruptions to the Contracting Officer for resolution and potential contract remedies.

3.2.10 Safeguard VA sensitive information, including protected health information (PHI) and personally identifiable information (PII), and ensure strict adherence to HIPAA and VA privacy/security protocols.

3.2.11 Assist in facilitating blood donor drives at VA medical centers, coordinating efforts with the Contractor and VA facility staff where appropriate.

3.3 No Government personnel, other than the Contracting Officer, have the authority to change or alter these requirements. The COR shall clarify technical points or supply relevant technical information, but no requirements in this scope of work may be altered as a sole result of such verbal clarification.

3.4 COR and designees' contact information will be provided upon award. If there are any changes pertaining to the appointed COR, the contractor will be notified by the CO and/or the previous COR.

4.0 INVOICES

4.1 Payment will be made upon receipt of a properly prepared, detailed invoice, prepared by the Contractor, validated by the Contracting Officer’s Representative (COR), and submitted electronically through OB-10 (https://portal.tungsten-network.com/).

4.2 A properly prepared invoice will contain:

4.2.1 Invoice Number and Date

4.2.2 Contractor’s Name and Address

4.2.3 Accurate Purchase Order Number

4.2.4 Supply or Service provided

4.2.5 Total Amount Due

4.2.6 CLIN, Description, Unit price, quantity, and CLIN Total

4.3 Invoices shall be submitted and paid monthly, in arrears. Invoices shall be submitted within the 1st week of the month. This will also apply to final invoices following the contract expiration date. Any invoices submitted for supplies and services performed beyond the contract expiration date and/or not covered under the contract will be refused and identified as unauthorized commits (UAC).

5.0 PERFORMANCE STANDARDS

5.1 Performance Standards define minimum performance standards for services. The Government performs surveillance to determine if the contractor exceeds, meets or does not meet these standards. The Government shall use these standards to determine the performance and shall compare contractor performance to the Acceptable Quality Level (AQL).

5.2 Failure to meet Acceptable Quality Levels may result in the withholding of payment, requirement to replace defective products/services at no additional cost, or other remedies as outlined in the contract. Persistent performance issues may lead to escalation to the Contracting Officer and potential termination of the contract.

6.0 DEFINITIONS

6.1 Allogeneic: Blood or blood components drawn from a non-related donor for subsequent transfusion to a patient (synonymous with homologous).

6.2 Antibody Work-Up: Serological work-up performed on potential transfusion recipients, per patient per episode (set of examples); may be defined as simple or complex.

6.3 Autologous: Blood drawn from a donor-patient for subsequent transfusion; in this case, restricted to pre-deposit units of blood, i.e., not including intra-operative or post-operative blood salvage.

6.4 Blood Group: ABO Blood group plus the Rho(D) type of the unit, specifically O+, O-, A+, A-, B+, B-, AB+, AB-.

6.5 CMV Negative: Unit from a donor who has been screened for antibody to Cytomegalovirus and deemed to be negative. Use of CMV-negative blood components are indicated in those patients who are undergoing transplantation or are otherwise severely immunocompromised.

6.6 Component (Blood Component): Portion of a unit of whole blood which has been physically separated by some mechanical means, e.g., centrifugation.

6.7 Cryoprecipitate: Plasma component that has been prepared to contain high concentrations of Factor VIII and fibrinogen. It is stored in the frozen state and thawed immediately prior to transfusion. The product is used to treat specific coagulation factor deficiencies, such as von Willebrand’s Disease, hypofibrinogenemia, and uremic thrombocytopenia, that have been shown to be unresponsive to DDAVP.

6.8 Derivative: Portion of a unit of whole blood or blood component which some type of fractionation process has chemically separated. Examples include albumin, plasma protein fraction, intravenous gamma globulin, and various coagulation products.

6.9 Fresh Frozen Plasma (Ffp): Plasma component that is stored in the frozen state and is thawed immediately prior to transfusion. Used for the treatment of significant multiple coagulation factor deficiencies or congenital factor deficiencies that are not treatable with cryoprecipitate. These may be associated with massive transfusion, severe liver disease, disseminated intravascular coagulation, hemolytic uremic syndrome, or thrombotic thrombocytopenia purpura, but not as a volume expander. Fresh frozen plasma 24 (FP24) is plasma frozen within 24 hours of collection and contains reduced levels of Factor VII and normal levels of Factor V. FP24 may be used interchangeably with FFP unless used to treat Factor VII deficiency.

6.10 Force Majeure: Each party shall be excused from any delay in performance or from failure to perform in accordance with the terms of this contract to the extent that such delay or failure to perform results from any cause beyond the reasonable control of the party, including without limitation, fires, floods, epidemics, quarantine restrictions, strikes, war, earthquake, acts of God, labor difficulties, riot, failure of public utilities, freight embargoes, unusually severe weather, delay in delivery of goods or services by suppliers or subcontractors to such party, loss of goods in transit, and Government or court action (the ‘Force Majeure Event’). Such party shall give notice to the other party promptly in writing upon learning of the Force Majeure Event. Notwithstanding any provision to the contrary, the affected party shall not be liable for any damages arising out of the Force Majeure Event.

6.11 Homologous: Blood or blood component drawn from a non-related donor for subsequent transfusion to a patient (synonymous with allogeneic).

6.12 Irradiated Component: Blood component that has been subject to a minimum central dose of 2500 cGy of irradiation.

6.13 Leukocyte-Reduced Blood Components: Cellular products prepared by an approved filtration method.

6.14 Plateletpheresis: The platelet component, which is drawn from a donor using apheresis equipment, is stored in the liquid state and is roughly equivalent to six to eight units of random platelets. Used for the treatment of significant thrombocytopenia as indicated for random platelets; however, it offers the advantage of minimizing donor exposures to prevent the patient from becoming refractory and/or contracting a transfusion-transmitted disease.

6.15 Platelets (Random): Platelet component that is prepared from a single unit of whole blood and is stored in the liquid state. Used for the treatment of significant thrombocytopenia associated with a variety of other clinical conditions, including active bleeding, massive transfusion, disseminated intravascular coagulation, and scheduled invasive procedures.

6.16 Recall: A request from the supplier of blood component to return a specific unit(s) which was inadvertently issued to the VA medical center, regardless of the reason, or was issued to the VA medical center prior to the receipt of information about a donor that would have prevented such release.

6.17 Red Blood Cells (Rbc): Red cell components that remain in the liquid state, i.e., not frozen, regardless of anticoagulant. Used for the treatment of anemia, which is not treated pharmacologically either due to etiology or time constraints.

6.18 Routine Orders: Orders that are generally placed regularly at a pre-established time to provide adequate inventory of specific blood components of specific blood groups.

6.19 Shelf Life: Number of days remaining prior to the expiration date from the date received in the facility.

6.20 Special Typings: Typings for RBC antigens other than ABO and Rho(D); performed in order to find red blood cell units appropriate for patients who have developed unexpected antibodies.

6.21 Standing Order: A type of routine order that allows for shipment of a specific volume of specific blood components according to an established delivery schedule; assists the supplier in projecting volumes of components required in order to improve recruitment and minimize waste.

6.22 Volunteer Donor: A person who does not receive monetary payment for blood donation. Benefits, such as monetary time off from work, membership in blood assurance programs, and cancellations on non-replacement fees that are not readily convertible to cash, do not constitute monetary payment.

7.0 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

The QASP will be provided upon award.

8.0 ESTIMATED QUANTITIES

The estimated quantities will be provided as an attachment.

9.0 VA INFORMATION AND INFORMATION SYSTEM SECURITY AND PRIVACY LANGUAGE

GENERAL SECURITY INFORMATION

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

VA INFORMATION CUSTODIAL LANGUAGE.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA.The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

TRAINING

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role-based information security training].

b. The contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

SECURITY INCIDENT INVESTIGATION

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation…