SOW_CCPC_DRAFT v12 RFI.docx

SOW - Connected Care Product Catalog

STATEMENT OF WORK (SOW)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration Office of Connected Care

Connected Care Product Catalog

Date: January 18, 2023 SOW Version Number: 12

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA), Veterans Health Administration (VHA) is to provide benefits and services to Veterans of the United States, their caregivers, and/or beneficiaries. VHA provides care for Veterans in person at more than 1,400 VA facilities, through the community care network, and through VA’s extensive use of connected care. In addition, VA connected care leverages advanced technologies to connect with increasing numbers of Veterans and provide them with access to VA care from their homes and communities.

The VHA Office of Connected Care (OCC) is charged with the design, development, implementation, and management of connected care programs, systems, and services throughout the VA. An outline of the current state of the Office of Connected Care is included in Attachment 1, Background.

Historically, all products and contractor support for VA’s connected care technology network have been delivered through the single-award Clinical Enterprise Video Network (CEVN) Blanket Purchase Agreement (BPA) (VA119-15A-0131), awarded in 2015, and the follow-on, single-award OCC Equipment and Services Transition Requirements Contract (36C10G21D0016), awarded in 2021. A list of all products that are currently acquired under the legacy contract are included in Attachment 2, Products Available on the Current Contract. Acquisition planning for future connected care technology network support has resulted in the development of three distinct and separate contracts to leverage innovation and flexibility to meet mission needs through establishing:

a) Program Support Integration (PSI), planned as a single-award IDIQ responsible for all program and project management functions required by OCC, including program integration and program support; project, release, and implementation management; communications; and training.

b) Connected Care Integrated Network (CCIN), planned as a single-award IDIQ responsible for all technical support services required by OCC, including product ordering, inventory, and asset management; help desk support; connected care technology software and mobile medical application design, development, enhancement, and remediation; infrastructure and architecture support.

c) Connected Care Products Catalog (CCPC), planned as a catalog of multiple BPAs outlined herein.

VHA will utilize the CCIN contract for product ordering, distribution, and inventory and asset management services. The CCIN Contractor will place orders against the CCPC Product List, which will be formed by awarding Blanket Purchase Agreements (BPA) to Original Equipment Manufacturers (OEM), suppliers, and authorized resellers of connected care technologies (referred to as “Authorized Suppliers” herein).

This procurement will establish multiple BPAs in direct support of VA’s Connected Care Program. This procurement is a key element in the success of the program as the BPAs will provide the mechanism that will supply connected care products for distribution to VHA facilities located in the United States (US) and US Territories. The CCPC Product List, SOW Attachment 3, will include all supplies awarded under BPAs.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

12. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

14. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

22. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

24. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

25. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

26. VA Handbook 6500.6, “Contract Security,” March 12, 2010

27. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

31. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

32. VA Directive 6300, Records and Information Management, February 26, 2009

33. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

34. NIST SP 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 5, 2014

35. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

36. OMB Memorandum, “Transition to IPv6”, September 28, 2010

37. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

38. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

39. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

40. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

41. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

42. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

43. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

44. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

45. NIST SP 800-116 Rev 1, Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, June 2018

46. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

47. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

48. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

49. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

50. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

51. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

53. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

54. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

55. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

56. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

57. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

58. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

59. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

60. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

61. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

62. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

63. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

64. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. Social Security Number (SSN) Fraud Prevention Act of 2017

68. National Fire Protection Association (NFPA) 99, Health Care Facilities Code, 2021 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=99

69. VA Directive 6550, “Pre-Procurement Assessment and Implementation of Medical Devices/Systems” June 3, 2019

SCOPE OF WORK

VA’s connected care technology network is an enterprise-wide, complex, and diverse system for the distribution, support, and sustainment of health care and related services. The scale of the program and its basis in unique, VA-developed products requires highly specialized industry support to successfully perform, implement and execute at the scope and complexity required. The objective of this procurement is to establish multiple BPAs for VA’s Connected Care Program. VA aims to ensure availability and consistency of connected care products and to obtain volume-based, standardized pricing.

For the purposes of this contract, connected care is defined as the use of electronic information or telecommunications technologies to support health care delivery, patient and professional health-related education, public health, and health administration at a distance. “Connected care products” are defined as the combined VA ecosystem of clinical video equipment and software; store and forward technologies; web and mobile health applications; software-as-a-service (SaaS) technologies; commercial-off-the-shelf (COTS) software products; mobile medical devices, peripherals, and wearables; remote patient monitoring technologies; online health portals; future connected care technologies; and ancillary items.

This language is not generated to inhibit the Government from ordering supplies already on any other designated Government contract instrument. VA’s Strategic Acquisition Center (SAC) and the VHA Office of Procurement will ensure that supplies are placed on appropriate catalogs/product Lists from which OCC and/or facilities may order.

At the direction of the Government, the CCIN vendor shall place orders based on their commercial agreements with BPA holders. The sole purpose of the BPA is to identify the products, prices, and sources. Although the Government does not anticipate placing any orders directly against this BPA, if that occurs, there is a $7.5M individual order limitation.

As part of the performance under this BPA, the Contractor and/or its subcontractors shall be required to work with other Government Contractors (firms working with the Government under other contracts), including those Contractors supporting the PSI and CCIN contracts. In performance of this BPA, the Contractor shall provide full cooperation with all Contractors working for and on behalf of OCC. To ensure cooperation and cohesiveness among different contract holders, the Government may require the Contractor to formulate a written agreement that maps out communication, coordination, and conflict resolution strategies.

The Government will conduct a regular review of all BPAs, including a review of terms, conditions, and pricing.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance is anticipated to be 60-months from the date of award.

PLACE OF PERFORMANCE

Work under this SOW shall be performed at Contractor facilities.

CONTRACT TYPE

Multiple, Single-Award BPAs.

WORK REQUIREMENTS

COMMERICAL AGREEMENTS

In order to participate in CCPC, the BPA awardee shall be required to enter into a commercial agreement with the CCIN Vendor who will provide product ordering, distribution, and inventory and asset management services to VA. The commercial agreement shall govern the terms and conditions of the CCIN Vendor and Authorized Supplier relationship and shall not conflict with nor contradict any underlying terms and conditions established by this BPA or the underlying CCIN contract. Failure to comply with the terms of this BPA, including provisions related to commercial agreements, shall be considered cause for cancellation of the BPA.

The commercial agreements prescribed in this section are solely between the CCIN vendor and Authorized Suppliers and will not involve the Government as a responsible party.

Upon BPA award, the Government will notify Authorized Suppliers of the name of and contact information for the CCIN vendor as soon as possible to enable formation of commercial agreements. The CCIN Vendor and Authorized Suppliers shall form commercial agreements within 60-calendar days after the Government notifies the Authorized Supplier of CCIN vendor contact information.

Authorized Suppliers are responsible for establishing commercial agreements. Either the CCIN Vendor or Authorized Suppliers may initiate a commercial agreement. The terms and conditions outlined in the commercial agreement must be mutually agreed-upon by both parties. Once a commercial agreement is established between an Authorized Supplier and the CCIN Vendor, the Authorized Supplier shall notify the Contracting Officer (CO) and Contracting Officer’s Representative (COR).

PRICING

Supply pricing established in BPAs between the Authorized Supplier and the Government will be made available to the CCIN vendor. The CCIN vendor will use the exact prices set forth in the BPA plus the product ordering fee agreed upon between the CCIN vendor and VA to invoice VA for CCIN product ordering services.

The Authorized Supplier BPA-holder shall not charge the CCIN awardees more than the prices set forth in the BPA.

PRODUCT REQUIREMENTS

The Authorized Supplier shall provide an uninterrupted supply and delivery of Connected Care Products to the CCIN Vendor participating at an enterprise/nationwide level. SOW Attachment 3, CCPC Product List, includes the current products for which BPAs will be established under this effort. Each grouping of products in Attachment 3 will be awarded as separate, standalone BPAs.

The Authorized Supplier shall maintain its Authorized Distributor status of all manufacturers and distributors of supplies throughout the life of this agreement as set-forth in the Authorized Distributor Letter referenced above. Failure to do so will result in cancellation of the BPA. The Government reserves the right to request information from Authorized Suppliers related to supply descriptions, pricing, or other topics at any time and the Authorized Supplier is required to provide such information.

The supplies offered by the respective Authorized Supplier will be released on an updated CCPC Product List. An updated CCPC Product List will be released every 30-calendar days.

The Government reserves the right to remove any supply from the CCPC Product List upon 30-calendar days’ notice, resulting in modification of the BPA.

DELIVERY

The Authorized Supplier shall deliver supplies to VA facilities and the CCIN Vendor in accordance with delivery methods outlined in commercial agreements between the CCIN Vendor and the Authorized Supplier. The Authorized Supplier shall deliver supplies to the CCIN Vendor in line with established commercial agreements. All BPA holder deliveries shall be FOB Destination. The Authorized Supplier shall be required to ship products throughout the Continental United States (CONUS) as well as Hawaii, Alaska, and all US territories.

As determined by Government requirements in each order, the Authorized Supplier may provide supplies directly to facilities through drop shipments or shipment to the CCIN Vendor for distribution. Requirements for drop shipment supplies will be outlined in commercial agreements, including delivery time, order accuracy, fill rate, shelf life, and others.

OCC and VA facilities will place the order through the CCIN Vendor. The CCIN Vendor will then place the order with the Authorized Supplier within three days and provide an Order Confirmation to the Government within one day of order placement with the Authorized Supplier.

The CCIN Vendor is responsible for invoicing VA for all supply shipments after items have been delivered; it is not the responsibility of the Authorized Supplier.

Once shipped, the Authorized Supplier shall provide tracking information to the CCIN Vendor.

BPA MODIFICATION

BPAs can be modified for Supply Recall, Policy Changes, Price Changes, Supply Additions and/or Removals. All modifications will be based on Government needs.

a) Supply Recall and Policy Changes: A BPA modification may be executed for any supply recall or policy change that applies to a supply on a BPA under this solicitation. Such instances may include, but are not limited to, a supply that is removed or recalled by the Authorized Supplier or manufacturer due to defects in the supply or potential dangers to patients, or if any required modification, removal or recall is suggested or mandated by a regulatory or official agency (e.g., FDA).

BPA modifications for recall or policy change will happen on an infrequent, as needed basis.

b) Price Changes: The BPA holder or the Government can additionally initiate a price increase or reduction on supplies under this BPA to result in a modification. BPA modifications for price will be made on a quarterly basis. The BPA holder may request changes to BPA pricing by contacting the CO and COR for this BPA.

c) Supply Addition or Removal: BPAs may also be modified to add or remove supplies from the CCPC Product List.

New supplies may be proposed to the Government at the discretion of Authorized Suppliers. Any new supplies proposed must be vetted and reviewed by OCC based on Government availability. Any new supplies proposed must fit within the scope of CCPC. The Government will make the final determination as to whether a supply is within scope.

Supply additions may be initiated by sending an email to the COR and the Contracting Officer.

If a supply is no longer available, the contractor shall be required to notify the CO and COR and it shall be immediately removed from the CCPC Product List and a modification to the BPA will be executed. However, outside of urgent changes, it is anticipated that BPA modifications reflecting supply additions and removals will occur on a quarterly basis.

d) Product End of Life/End of Support and Product Refresh: BPAs may be modified to refresh products due to Original Equipment Manufacturer (OEM) end-of-life/end-of-support dates.

The CCPC Product List will be updated to reflect changes after BPA modifications are complete.

If any supply awarded under this solicitation requires modification, is removed or recalled by the Authorized Supplier or manufacturer due to defects in the supply or potential dangers to patients, is designated end-of-life/end-of-support by the OEM, or if any required modification, removal or recall is suggested or mandated by a regulatory or official agency, the Authorized Supplier will notify the CO, the COR, and the CCIN vendor, in writing, by the most expeditious manner possible. The notification shall include, but not be limited to the following:

a) Complete supply description and/or identification and the BPA line item number assigned.

b) Reasons for modification(s), removal or recall, including a justification.

ADDITIONAL TERMS AND CONDITIONS

The agreement, including supplies, prices, and other terms and conditions, is public information and is releasable under the Freedom of Information Act (FOIA). Procurement related information shall be treated as confidential and shall not be disclosed except as required by applicable laws and regulations.

The Authorized Supplier shall provide written notice to the CO and COR of any changes related to the company or the supplies offered under its BPA. Changes include, but are not limited to, change in company information, including contract administrator, company name, address and phone number.

All regulatory requirements applicable to the original BPA will apply to any change/modification.

If any of the BPA holder's responses to the required representations/certifications change at any time after the BPA has been approved, the BPA holder shall immediately submit an email outlining these changes to the CO and COR for this BPA.

Authorized suppliers shall provide a full warranty, above and beyond the OEM warranty, for all products to account for direct damages, damages during shipping, or otherwise defective equipment for 10 business days after receipt by the CCIN Vendor or VA facility.

GENERAL REQUIREMENTS

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality products Satisfactory or higher

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems Satisfactory or higher

2. Personnel possess necessary knowledge, skills and abilities to perform tasks Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract and at the DO level to ensure that the Contractor is performing the services required by this SOW in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

FACILITY/RESOURCE PROVISIONS

The Government will provide system access when authorized contract staff work at a Government location as required in order to accomplish the Tasks associated with this SOW. All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

For detailed Security and Privacy Requirements (additional requirements of the contract consolidated into an addendum for easy reference) refer to ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED and ADDENDUM B - VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE.

SHIPMENT OF HARDWARE OR EQUIPMENT

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary

Alternate

Name:

Name:

Address:

Address:

Voice:

Voice:

Email:

Email:

Special Shipping Instructions:

Prior to shipping, Contractor shall notify Site POCs by email of all incoming deliveries including line-by-line details for review of requirements. Contractor shall not make any changes to the delivery schedule or location at the request of Site POC.

Contractors shall coordinate deliveries with Site POCs before shipment of hardware to ensure sites have adequate storage space.

All shipments, either single or multiple container deliveries, shall bear the VA IFCAP Purchase Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA IFCAP PO number shall indicate total number of containers for the complete shipment (e.g. “Package 1 of 2”), clearly readable on manifests and external shipping labels.

Packing Slips/Labels and Lists shall also include the following:

IFCAP PO #: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier I Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard SOW language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, unless the connection uses FIPS 140-2 (or its successor) validated encryption, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS) 2.0, and will be tracked therein. The TMS 2.0 may be accessed at https://www.tms.va.gov/SecureAuth35/ . If you do not have a TMS 2.0 profile, go to https://www.tms.va.gov/SecureAuth35/ and click on the “Create New User” link on the TMS 2.0 to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

VA Internet and Intranet Standards The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to: creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

Notice of the Federal Accessibility Law Affecting All Information and Communication Technology (ICT) Procurements (Section 508) On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

Section 508 – Information and Communication Technology (ICT) Standards The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

Compatibility with Assistive Technology The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

Acceptance and Acceptance Testing Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

Confidentiality and Non-Disclosure The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA CO.

5. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

b. Controlled access to system and security software and documentation.

c. Recording, monitoring, and control of passwords and privileges.

d. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

e. VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

f. Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

g. Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

h. Contractor does not require access to classified data.

8. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

9. VA Form 0752 shall be completed by all Contractor employees working on this contract, and shall be provided to the CO before any work is performed. In the case that Contractor personnel are replaced in the future, their replacements shall complete VA Form 0752 prior to beginning work.

INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

The Contractor shall ensure that information technology products are procured and/or services are performed with products that meet and/or exceed ENERGY STAR, FEMP designated, low standby power, and EPEAT guidelines. The Contractor shall provide/use products that earn the ENERGY STAR label and meet the ENERGY STAR specifications for energy efficiency. Specifically, the Contractor shall:

1. Provide/use ENERGY STAR products, as specified at www.energystar.gov/products (contains complete product specifications and updated lists of qualifying products).

2. Provide/use the purchasing specifications listed for FEMP designated products at https://www4.eere.energy.gov/femp/requirements/laws_and_requirements/energy_star_and_femp_designated_products_procurement_requirements . The Contractor shall use the low standby power products specified at http://energy.gov/eere/femp/low-standby-power-products.

3. Provide/use EPEAT registered products as specified at www.epeat.net. At a minimum, the Contractor shall acquire EPEAT® Bronze registered products. EPEAT registered products are required to meet the technical specifications of ENERGY STAR, but are not automatically on the ENERGY STAR qualified product lists. The Contractor shall ensure that applicable products are on both the EPEAT Registry and ENERGY STAR Qualified Product Lists.

4. The Contractor shall use these products to the maximum extent possible without jeopardizing the intended end use or detracting from the overall quality delivered to the end user.

The following is a list of information technology products for which ENERGY STAR, FEMP designated, low standby power, and EPEAT registered products are available:

1. Computer Desktops, Laptops, Notebooks, Displays, Monitors, Integrated Desktop Computers, Workstation Desktops, Thin Clients, Disk Drives

2. Imaging Equipment (Printers, Copiers, Multi-Function Devices, Scanners, Fax Machines, Digital Duplicators, Mailing Machines)

3. Televisions, Multimedia Projectors

This list is continually evolving, and as a result is not all-inclusive.

OEM HARDWARE REQUIREMENTS

The Contractor shall ensure that information technology products are procured and/or services are performed with products that are new equipment and new parts for the required services described herein; no used, refurbished, or remanufactured equipment or parts shall be provided under any circumstances. Absolutely no “Gray Market Goods” or “Counterfeit Electronic Parts” shall be provided. Gray market goods are defined as genuine branded goods intentionally or unintentionally sold outside of an authorized sales-territory or by non-authorized dealers in an authorized territory. All equipment shall be accompanied by the original equipment manufacturer’s (OEM’s) warranty. Counterfeit electronic parts are defined as unlawful or unauthorized reproduction, substitution, or alteration that has been knowingly mismarked, misidentified, or otherwise misrepresented to be an authentic, unmodified electronic part from the original manufacturer, or a source with the express written authority of the original manufacturer or current design activity, including an authorized aftermarket manufacturer. Unlawful or unauthorized substitution includes used electronic parts represented as new, or the false identification of grade, serial number, lot number, date code, or performance characteristics.

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

APPLICABLE PARAGRAPHS TAILORED FROM: THE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6, APPENDIX C, MARCH 12, 2010

GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates (e.g. Business Associate Agreement, Section 3G), the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The Contractor or Subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ. The CO must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2. VA information should not be co-mingled, if possible, with any other data on the Contractors/Subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA information is returned to VA or destroyed in accordance with VA’s sanitization requirements.