SOW Water Management Program 41425 update.pdf

Statement of Work

Southeast Louisiana Veterans Health Care System Potable Water Monitoring and Maintenance Program

Department of Veterans Affairs

04/14/2025

1 | P a g e

Program

Table of Contents 1 General Information 2 General Requirements 3 Specific Mandatory Tasks and Associated Deliverables 4 Changes to Requirement 5 Travel 6 Government Responsibilities 7 Contractor Personnel Requirements 8 Protection of Person and Property 9 Security Requirement 10 Quality Control 11 Quality Assurance 12 Performance Evaluation Meetings 13 Compliance with Applicable Laws/Regulations 14 Hours of Operation 15 Administrative Information

Program

2 | P a g e

1 General Information

1.1 Contract Title

1.1.1 Southeast Louisiana Veterans Health Care System Potable Water Monitoring and Maintenance Program.

1.2 Contract Background

1.2.1 Per VA Directive 1061, VA healthcare facilities are required to implement measures to protect overnight patient population and staff from legionella, also known as legionnaires disease. This biological agent can develop in water lines and plumbing systems through sitting water (dead legs), in adequate temperature, lack of chemical agents. This disease is transported via airborne means through the inhalation of fluid (steam, mist, etc). The goal of this contract is to address all known potential introductions of the contagion via monitoring and water treatment. This shall be achieved through the use of monitoring, chlorination, or other approved methods as established in VA Directive 1061.

1.3 Scope of Work

1.3.1 The contractor shall provide all labor, travel, equipment, shop drawings, systems, and materials necessary to provide: water quality and water temperature monitoring; water treatment services; water management system;

water sampling services; and preventative maintenance on installed systems.

1.3.2 These services shall be provided for the following buildings located at 2400 Canal St., New Orleans, LA:

1.3.2.1 Central Energy Plant (Building N)

1.3.2.2 Inpatient (Buildings B and C)

1.3.2.3 Outpatient (H and J)

1.3.2.4 Diagnostic and Treatment (Buildings D, E, F, G)

1.3.2.5 Pan Am – VA Administration (Building Q)

1.3.2.6 Transitional Living (Building M)

1.3.2.7 Research (Building P)

1.3.3 All services shall follow all tasks and objectives as outlined by the VA Directive 1061 and local VA policies.

1.3.4 All work shall be performed by personnel specifically qualified and trained to administer the necessary chemicals, program controllers, and maintain and monitor of the water systems in the locations noted. Evidence of all required licenses, as well as documentation of qualifications of personnel, shall be provided to the Contracting Officer Representative (COR) prior to award of the contract.

1.3.5 This contract shall consist of one base year, plus four option year extensions, commencing August 1, 2025.

1.4 Performance Objectives

3 | P a g e

1.4.1 The contractor shall perform all monitoring, inspections, testing, repairs and preventive maintenance necessary to keep the New Orleans VA water treatment system in compliance with the most current edition of Federal Regulations pertaining to Water Safety in Medical and Federal facilities, Center for Disease Control (CDC) recommendations, VHA Directive 1061, Environmental Protection Agency (EPA), Code of Federal Regulations (CFR) 40 part 141, and American Water Works Association (AWWA) standards.

1.5 Acronyms

Acronym Meaning

CEP Central Energy Plant CFR Code of Federal Regulations CO Contracting Officer

Contractor General Contractor; Contract Awardee COR Contracting Officer Representative DOT Department Of Transportation DPD Diethyl-p-phenylenediamine D&T Diagnostic and Treatment EPA Environmental Protection Agency FRO Free Residual Oxidant MS Microsoft ORP Oxidation Reduction Potential

PWAS Potable Water Analysis System PSI Pounds per square inch

QASP Quality Assurance Surveillance Plan SMS Short message service TL Transitional Living

TRO Total Residual Oxidant VA Veterans Affairs

WQA Water Quality Analyzer

4 | P a g e

1.6 Deliverables Schedule

Task # Task Name Schedule

001 Contact Information/Key Personnel Five (5) calendar days after contract award

002 Contract Performance Management Minimum of 3 meetings (Contract Award, Semi- Annually, Contract Anniversary)

003 Preventative Maintenance Reports Monthly, electronically submitted by the 5th working day of the following month

004 Water Quality Report Monthly, electronically submitted by the 5th working day of the following month

005 Water Temperature Reports Weekly, electronically submitted by Monday of the following week

006 Water Treatment Log Every treatment occurrence.

007 Service Calls (telephone and electronic mail support) 24 hours a day, 7 days a week

008 Service Calls: 2400 Canal As needed 009 Travel Provision As needed

010 Monthly electronic invoicing Submitted in arrears by the 10th day of the following month

1.7 Period of Performance

1.7.1 Base Year: August 1, 2025, through July 31, 2026

Option Year One (1) August 1, 2026 - July 31, 2027 Option Year Two (2) August 1, 2027- July 31, 2028 Option Year Three (3) August 1, 2028 - July 31, 2029 Option Year Four (4) August 1, 2029 - July 31, 2030

VHASHRCONNET

Inserted Text

5 | P a g e

1.7.2 Should these dates change, the Contracting Officer will issue a modification to the contract reflecting the corrected date. The Contractor is required to proceed as originally scheduled until such modification is issued. The Contracting Officer is the only official authorized to make changes to the contract.

1.8 Key Personnel

1.8.1 The Contractor shall submit a list of the points of contact for VA’s account pertaining to service calls and invoicing. Submission shall include the person’s name, phone number, email and address for correspondence. For all work completed, the Contractor shall submit proof of certification for the technician completing the work. Included in the certification shall be the names and addresses of the proposed supervisor of installation and the proposed performer of contract maintenance as well as provide the name and title of the manufacturer’s representative who makes the certification.

1.9 Type of Contract

1.9.1 This contract shall be a Firm Fixed Price.

1.10 Place of Performance

1.10.1 The work shall be performed at 2400 Canal St., New Orleans, LA.

1.11 Evaluation Rating

1.11.1 Upon completion of this contract, the Contractor will be rated either outstanding, satisfactory, marginal, or unsatisfactory in the following areas:

1.11.1.1 Quality control.

1.11.1.2 Timely performance.

1.11.1.3 Effectiveness of management.

1.11.1.4 Compliance with labor standards.

1.11.1.5 Compliance with safety standards.

1.11.2 The Contractor will be advised of any marginal or unsatisfactory rating, either in an individual element or in the overall rating prior to completion of the contract.

1.12 COR Authority

1.12.1 In no event is the COR empowered to change any of the terms and conditions of the contract. All changes, to any section of this contract, shall be made only by the Contracting Officer pursuant to a properly executed modification. The types of actions within the purview of the COR’s authority are to ensure that the Contractor performs the technical requirements of the contract, and to notify the Contracting Officer of any deficiencies observed. A Letter of Designation shall be issued to the COR and a copy shall be sent to the Contractor at the time of contract kickoff meeting or post-award conference setting forth in full the responsibilities and limitations of the COR.

1.13 Contract Award Meeting

1.13.1 The Contractor shall not commence performance on this contract until the

Government has conducted a contract kickoff meeting, post-award conference or the COR has advised the Contractor that a kickoff meeting is waived. The following item shall be delivered as part of the initial contract kickoff and submitted either at the kickoff meeting (one electronic and one hard copy) or emailed to the CO should the meeting be waived: Quality Assurance Surveillance Plan (QASP).

6 | P a g e

2 General Requirements

2.1 All written deliverables shall be phrased in layperson language. Statistical and other technical terminology shall not be used without providing a glossary of terms.

2.2 All chemical removal and transport will be in strict adherence with the DOT, EPA environmental laws, the State of Louisiana, and Federal laws.

2.3 The Contractor shall provide written certification noting ability to transport and dispose of treatment chemicals to the CO.

2.4 General Expectations

2.4.1 Water Quality Monitoring

2.4.1.1 Potable water entering each building listed shall be continuously monitored for:

2.4.1.1.1 Incoming water pressure.

2.4.1.1.2 Temperature.

2.4.1.1.2.1 Temperature monitoring must be conducted, at a

minimum in the following types of areas:

2.4.1.1.2.1.1 Incoming water supply to the building.

2.4.1.1.2.1.2 Water storage tanks.

2.4.1.1.2.1.3 Hot water discharge at the hot water source

equipment.

2.4.1.1.2.1.4 Hot water returns within proximity to the hot

water source equipment;

2.4.1.1.2.1.5 Water at the return of circulation loops; and

2.4.1.1.2.1.6 Water supplied to representative outlets.

2.4.1.1.3 pH.

2.4.1.1.4 Dissolved solids.

2.4.1.1.5 Oxidant residuals.

2.4.1.1.5.1 It is mandatory that the oxidant residual measurement complies with US EPA regulation 40 CFR 140.74, Standard Method 4500-CL G, and US EPA Method

334.0 “Determination of Residual Chlorine in Drinking Water Using an Online Analyzer”.

2.4.2 Online Residual Chlorine Analyzer/Monitor

2.4.2.1 At set intervals, the system shall perform oxidant residual measurement both free residual oxidant (FRO) and total residual oxidant (TRO) of the potable water supply. The frequency at which these measurements are performed shall be adjustable from two (2) minutes to ten (10) minutes in one (1) minute intervals.

2.4.3 Maintenance

2.4.3.1 Maintain concentrations of oxidant residual necessary for inhibition of legionella growth in the building water systems hot and cold-water outlets.

2.4.3.2 Monitor free chlorine residual levels with guideline of 0.5 ppm.

2.4.3.3 Provide contractor personnel to service all equipment within and part of the water treatment system installed as part of this contract.

7 | P a g e

2.4.3.4 All maintenance shall, at a minimum, adhere to manufacturer’s recommendations and specifications concerning system and part maintenance.

2.4.4 Water Management Program:

2.4.4.1 Improve the safety and maintain compliance with current and future

VA Directives, and the EPA Safe Drinking Water Act

2.4.4.2 Facilitate and Advise in the on-going management of the Water

Management Team to discuss, address, and manage all water systems.

2.4.4.3 Maintain, assist and advise in executing and maintaining the Hazard

Analysis Critical Control Pont (HACCP) process and documents.

2.4.4.4 Provide guidance, analysis, and management of the potable water test results from the continuous water quality monitoring systems and on-site water testing.

2.4.4.5 Maintain, operate and continue to customize the web-based Water Management Program (WMP) Management Information System.

2.4.4.6 Implement, monitor and adjust as necessary the Water Management Program (WMP) in order to achieve the desired performance in compliance with VA Directive 1061.

2.4.4.7 Verify that the Water Management Program is performing as designed on a monthly and quarterly basis thru testing, monitoring and documentation of system performance.

2.5 Existing monitoring devices have been summarized below:

8 | P a g e

Water (CW = Cold Water HW = Hot Water)

Hospital Location Continuous Monitoring Device

CW CEP –City Water Supply Primary Chlorine Monitoring System CW CEP – City Water Supply Secondary Chlorine Monitoring System CW CEP - Water Storage Tank Advanced Secondary Disinfection

System CW Inpatient Building. City Make Up Advanced Monitoring System CW Transitional Living Building. City Make

Up Advanced Monitoring System

CW D&T Building City Make Up Advanced Monitoring System CW Outpatient Building City Make Up Advanced Monitoring System CW Administration (Pan Am) Building City

Make Up Advanced Monitoring System

CW Research Building City Make Up Advanced Monitoring System HW Inpatient Building. City Make Up Base Secondary Disinfection

System HW Transitional Living Bldg. City Make Up Base Secondary Disinfection

System HW D&T Building. City Make Up Base Secondary Disinfection

System HW Outpatient Building City Make Up Base Secondary Disinfection

System HW Administration (Pan Am) Building City

Make Up Base Secondary Disinfection System

HW Research Building City Make Up Base Secondary Disinfection System

HW HW Return Loops & Heat Exchangers Water Temperature Sensors (12)

2.6 Maintenance Services

2.6.1 The system must be properly calibrated and maintained to ensure accurate and reliable performance on an ongoing basis. The cost for maintenance of each system must include:

2.6.1.1 Training

2.6.1.2 Monthly calibration and supply of all calibration solutions for probes

2.6.1.3 Monthly refreshment of test reagents for the chlorine analyzer

2.6.1.4 All consumable parts for system components

2.6.1.4.1 Chlorine Analyzer – reagents, tubing/cuvette kits, replacement cuvettes, check valve sets and check valve flushing kits

2.6.1.4.2 Replacement probes for pH and conductivity

2.6.1.5 Labor, travel and expenses

2.6.2 Monthly Maintenance Program

9 | P a g e

2.6.2.1 A monthly maintenance program for each system (reagents, calibration solutions, parts, labor, travel and expenses) shall be included in this contract and shall be provided by the Contractor. The following systems to be covered under a pre-established maintenance system shall include, but are not limited to:

2.6.2.1.1 Base Secondary Disinfection System Service

2.6.2.1.1.1 This system shall control and monitor the feed of liquid bleach as a secondary disinfectant to the building Hot Water system.

2.6.2.1.2 Advanced Secondary Disinfection System Service

2.6.2.1.2.1 The Secondary disinfection system shall monitor pH, conductivity, temperature, and pressure. It shall also monitor and control the feed of liquid bleach (sodium hypochlorite) as a secondary disinfectant to the campus cold water supply to campus from the Main Storage tank at the vault.

2.6.2.1.3 Advanced Monitoring System Service

2.6.2.1.3.1 This system shall monitor cold water quality entering the building.

2.6.2.1.4 Chlorine Analyzer Service

2.6.2.1.4.1 These analyzes shall provide automatic monitoring of FRO using the EPA accepted DPD (N,N-diethyl-p-phenylenediamine) colorimetric test method for measuring chlorine (these units will also utilize the data logger with the Primary Advanced Secondary Disinfection System at the Main Storage Tank).

2.7 Invoicing

2.7.1 All invoices shall be submitted electronically, arrears by the 10th day of the following month.

2.7.2 Payment will not be rendered unless the VA is in receipt of all maintenance reporting, trainings, and documentation required or requested during that particular billing period.

3 Specific Mandatory Tasks and Associated Deliverables

3.1 Description of Tasks and Associated Deliverables:

Clin Description of supplies/services Unit Quantity

0001 Web-Based Data Management Service Mo 12

10 | P a g e

0002 Water Management Program (All Buildings)

Mo 12

0003 Advanced Secondary Disinfection System Service - CEP

Mo 12

0004 Maintenance Services for Chlorine Analyzers - CEP

Mo 12

0005 Base Secondary Disinfection System Service - Inpatient

Mo 12

0006 Advanced Monitoring System Service - Inpatient

Mo 12

0007 Base Secondary Disinfection System Service – D&T

Mo 12

0008 Advance Monitoring System Service – D&T

Mo 12

0009 Base Secondary Disinfection System Service – Transitional Living

Mo 12

0010 Advance Monitoring System Service – Transitional Living

Mo 12

11 | P a g e

4 Changes to Requirement

4.1 In the event that VA modifies the water maintenance and monitoring system during the maintenance contract period, Contractor shall be required to verify that the system, as newly modified or added, is consistent with the manufacturer’s requirements; any verification performed will be equitably adjusted under the Changes clause. The post contract modification or addition to the water maintenance and monitoring system shall not void the continuing requirements under this contract. The contract will be equitably adjusted under the Changes clause for such additional performance.

4.2 Any changes to this SOW shall be authorized and approved only through written correspondence from the CO. A copy of each change will be kept in a project folder along with all other products of the project. Costs incurred by the contractor through the actions of parties other than the CO shall be borne by the contractor.

5 Travel

5.1 The contractor is responsible for providing transportation/travel for all staff and all waste and refuse, debris, containers applicable to this contract unless stated otherwise elsewhere.

6 Government Responsibilities

6.1 The Government shall provide access to the sites as necessary for service calls and responses to commence. This includes but is not limited to: the opening of any necessary gates or fencing in order to access containers, relocation of government vehicles that may hinder access to the containers in question.

6.2 Removing Employees for Misconduct or Security Reasons. The Government may, at its sole discretion, direct the contractor to remove any contractor employee from U.S. VA/VHA facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under any Contract awarded. The Contracting Officer will provide the contractor with a written explanation to support any request to remove an employee.

7 Contractor Personnel Requirements

7.1 All qualified, experience, and license personnel for the service will be provided by the contractor.

7.2 No portion of the work shall be subcontracted without prior written consent of the

Contracting Officer. In the event that the contractor desires to subcontract some part of the work specified herein, the contractor shall furnish the Contracting Officer with the names, qualifications and experience of their proposed subcontractor(s).

The contractor shall, however, remain fully liable and responsible for the work to be done by his subcontractor(s) and shall assure compliance with all requirements of the contract.

7.3 Contractor employees shall present a professional appearance at all times and their conduct shall not reflect discredit upon the United States and or the VA/VHA.

7.4 Conflict of Interest. The contractor shall not employ any person who is an employee of the United States Government if that employment would appear to cause a conflict of interest.

12 | P a g e

7.5 Uniforms. The contractor shall require all employees, including supervisors, to wear distinctive uniforms or clothing for easy identification, and assure that every employee is in uniform, or clothing no later than the time specified by the COR, or otherwise no later than ten (10) working days from the date an employee first enters on duty. The uniform or clothing shall have the contractor's name, easily identifiable, affixed thereon in a permanent or semi-permanent manner, such as a badge or monogram.

7.6 Smoking: Employees are strictly prohibited from smoking anywhere in medical center buildings or on VA grounds unless otherwise noted.

7.7 Supervision of Employees: The contractor shall be responsible for all means, methods, techniques, sequences and procedures, and for coordinating all portions of the work under the contract except where otherwise specified in the contract documents. The contractor shall, at all times, enforce strict discipline and good order among the workers, and shall not employ on the work any unfit person or anyone not skilled in the work assigned to him/her.

8 Protection of Person and Property

8.1 The contractor expressly undertakes’, both directly and through its subcontractor(s), to take every precaution at all times for the protection of persons and property, including Medical Center employees and property and its own.

8.2 The contractor shall be responsible for initiating, maintaining and supervising all safety precautions and programs in connection with the work.

8.3 The contractor shall continuously maintain adequate protection of all work from damage and shall protect the Medical Center property from injury of loss arising in connection with this contract. The contractor shall make good any such damage, injury or loss, except as may be by agents or employees of the Medical Center.

8.4 In an emergency affecting the safety or life of individuals, or of the work, or of adjoining property, the contractor, without special instruction or authorization from the Medical Center, is hereby permitted to act, at the contractor's discretion, to prevent such threatened loss or injury. Also, should the contractor, in order to prevent threatened loss or injury, be instructed or authorized to act by the Medical Center, he shall so act, without appeal. Any additional compensation or extension of time claimed by the contractor on account of any emergency work shall be determined by mutual agreement.

9 Security Requirement

9.1 Security Clause.

9.1.1 A&A requirements do not apply--Security Accreditation Package is not required.

9.2 Access to VA Information and VA Information Systems

9.2.1 A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

13 | P a g e

9.2.2 All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

9.2.3 Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

9.2.4 Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

9.2.5 The Contractor or Subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ.

The Contracting Officer must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

9.3 VA Information Custodial Language

9.3.1 Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

14 | P a g e

9.3.2 VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

9.3.3 Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

9.3.4 The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

9.3.5 The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

9.3.6 If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

15 | P a g e

9.3.7 If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

9.3.8 The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

9.3.9 The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

9.3.10 Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

9.3.11 Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

9.3.12 Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

9.3.12.1 Vendor must accept the system without the drive.

9.3.12.2 VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

9.3.12.3 VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase occur that may.

9.3.12.4 Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then.

9.3.12.4.1 The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact.

16 | P a g e

9.3.12.4.2 Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be preapproved and described in the purchase order or contract.

9.3.12.4.3 A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that

9.3.12.4.1 and 9.3.12.4.2 controls above are in place and completed.

9.3.13 The ISO needs to maintain the documentation.

9.4 Security Incident Investigation

9.4.1 The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

9.4.2 To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

9.4.3 With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

9.4.4 In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover.

9.5 Liquidated Damages For Data Breach

9.5.1 Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

17 | P a g e

9.5.2 The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

9.5.3 Each risk analysis shall address all relevant information concerning the data breach, including the following:

9.5.3.1 Nature of the event (loss, theft, unauthorized access)

9.5.3.2 Description of the event, including:

9.5.3.2.1 Date of occurrence.

9.5.3.2.2 Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code.

9.5.3.2.3 Number of individuals affected or potentially affected.

9.5.3.2.4 Names of individuals or groups affected or potentially affected.

9.5.3.2.5 Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text.

9.5.3.2.6 Amount of time the data has been out of VA control.

9.5.3.2.7 The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); VA information, obtain monetary or other known misuses of data containing sensitive personal information, if any.

9.5.3.2.8 Assessment of the potential harm to the affected individuals.

9.5.3.2.9 Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

9.5.3.2.10 Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

9.5.3.3 Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

9.5.3.3.1 Notification.

18 | P a g e

9.5.3.3.2 One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports.

9.5.3.3.3 Data breach analysis.

9.5.3.3.4 Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution.

9.5.3.3.5 One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

9.5.3.3.6 Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

9.6 Confidentiality and Nondisclosure

9.6.1 It is agreed that:

9.6.1.1 The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by the VA which have been generated by the contractor in the performance of this task order are the exclusive property of the U.S.

Government and shall be submitted to the CO at the conclusion of the task order.

9.6.1.2 The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to this task order presented to the contractor shall be submitted to the CO for response.

9.6.1.3 Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the CO.

9.7 Reference(s):

9.7.1 VA Affairs Handbook 6500, Risk Management Framework for VA Information

Systems – Tier 3: VA Information Security Program, 10 Mar 2015.

9.7.2 Veterans’ Health Administration Procurement Manual (VHA PM) – 11/3/2014.

9.7.3 VA Handbook 1901.01, Health Information Management and Health Records –

19 Mar 15.

9.7.4 VHA Handbook 1605.5, Business Associate Agreements – 22 July 2014

9.7.5 Memo: VA Maintenance/Installation (Warranty) Contracts (VAIQ 7058822), 24

Mar 2011.

9.7.6 VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, dated February 17, 2011.

9.7.7 Veterans Affairs Handbook 6500.6 Contract Security, 12 Mar 2010.

9.7.8 Health Insurance Portability & Accountability Act (HIPAA) Privacy Rule (See

45 CRF 164, 502(a)(1).

9.7.9 VA Directive 0710, Personnel Security and Suitability Program, dated June 4, 2010.

9.7.10 VA Directive 6066, Protected Health Information.

9.7.11 Privacy Act of 1974 (5 U.S.C. 552a).

19 | P a g e

9.7.12 Homeland Security Presidential Directive (HSPD-12), Federal Information Processing Standards Publication (FIPS) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, dated Feb 25, 2005, amended by FIPS 201-1, March 2006.

9.7.13 Social Security Act (42 U.S.C. § 1395x(u)): Health care and other related services, as mentioned in HIPAA regulations, are defined in detail under Section 1861(s) http://www.ssa.gov/OP_Home/ssact/title18/1861.htm.

9.7.14 VA Directive 6512, Secure Wireless Technology, dated 4 Nov 2009 10 Quality Control

10.1 The contractor shall provide and maintain an inspection system acceptable to the

COR covering all services under this contract. Complete records of all inspection work performed by the contractor shall be maintained and made available to the COR (through formal report submissions and at Government request) during contract performance and for as long afterward as the contract requires.

11 Quality Assurance

11.1 As stated in the Quality Control Plan or QASP, the Government shall evaluate the

Contractor's performance under this agreement. For those tasks listed in the Quality Control Plan or QASP, the COR or evaluators shall follow the methods of surveillance specified in this agreement. The Government shall record all surveillance observations. When an observation indicates defective performance, the COR shall forward the observation to the Contractor manager or alternate(s), who shall initial the observation. The initialing of the observation does not necessarily constitute concurrence with the observation, only acknowledgment that he or she has been made aware of the defective performance. Government surveillance of tasks not listed in the Quality Control Plan/QASP or by methods other than those listed in the Quality Control Plan/QASP may occur during the performance period of this agreement. Such surveillance shall be done according to standard inspection procedures or other agreement provisions. Any action taken by the Contracting Officer as a result of surveillance shall be in accordance with the terms of this agreement.

11.2 The COR has the right to inspect all services called for by the contract, to the extent practicable at all times and places during the term of the contract. The COR shall perform inspections in a manner that will not unduly delay the work.

11.3 If any of the services do not conform to contract requirements, the COR may require the contractor to perform the services again in conformity with contract requirements at no increase in contract amount. When defects in service cannot be corrected by re-performance, the COR may:

11.3.1 Report deficiencies to the procurement office for further action.

11.3.2 Reject any invoices that contain work not found acceptable IAW the requirements as described in the award document.

11.3.3 If the contractor fails to promptly perform the services again or to take the necessary action to ensure future performance in conformity with contract requirements, the Contracting Officer may:

11.3.4 Have the service performed by a separate vendor and charge the additional costs to this contract.

http://www.ssa.gov/OP_Home/ssact/title18/1861.htm

20 | P a g e

11.3.5 Terminate the contract for default.

12 Performance Evaluation Meetings

12.1 The Contractor, Contracting Officer and COR will be required to meet at the following intervals: Contract Award, 6-month or and the Semi-Annual point of the contract (+/- 10 calendar days), and at the end of the contract (+/- 10 calendar days). A review will be conducted of any deficiencies noted throughout the contract period and address any outstanding items.

13 Compliance with Applicable Laws/Regulations

13.1 The Contractor shall ensure that services provided to the Government under this agreement comply with all applicable laws, statutes, regulations, and guidelines that govern the operation of systems by the Government. The Contractor shall also ensure that all services provided to the Government under this agreement comply with all Government mandated procedures, standards, and requirements.

13.2 As the Government develops and implements new or modified policies and procedures either to comply with internal agency rules and procedures or to comply with applicable rules, regulations, statutes, or other binding obligations ("Additional Compliance Terms"), the Government reserves the right to incorporate such Additional Compliance Terms into this Agreement. The Contractor hereby acknowledges and agrees that such Additional Compliance Terms shall become part of this agreement. The Government shall provide the Contractor with prior written notice regarding the date by which the Contractor shall comply with each set of Additional Compliance Terms ("Compliance Date"). Failure to comply with the Additional Compliance Terms prior to the Compliance Date shall be cause for the Government to immediately terminate this agreement. In the event that the Government terminates this agreement because of the Contractor's failure to comply with Additional Compliance Terms by the Compliance Date, the Contractor shall be liable for such reasonable costs as may be associated with the Government’s efforts to procure a replacement Contractor and associated systems and services.

14 Hours of Operation

14.1 Normal business hours are between the hours of 7:30 a.m. to 4:00 p.m., Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closing. The Contractor may for his/her convenience request authorization in advance from the COR to work outside of regular working hours of regular workdays at no additional cost to the facility. Authorization shall be at the discretion of the COR.

14.2 Recognized Federal Holidays: New Year’s Day, Martin Luther King Jr. Day, Washington’s Birthday (President’s Day), Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving, Christmas.

15 Administrative Information

15.1 The Department of Veterans Affairs Facilities Management (VA Engineering) Point of Contact is:

21 | P a g e mailto:jean.perrault@va.gov

1.11.2 The Contractor will be advised of any marginal or unsatisfactory rating, either in an individual element or in the overall rating prior to completion of the contract.