STATEMENT OF WORK.docx

STATEMENT OF WORK

Sole Source Multiplex Autoimmune Testing

1) BPA LANGUAGE:

a) OVERVIEW: It is the intent of the Department of Veterans Affairs, VAMC Lexington, KY to initiate a base year (October 1, 2021 through September 30, 2022) with four (4) 1-year options IDIQ, cost-per-reportable. This is a Blanket Purchase Agreement (BPA) for the rental of a Bio-Rad BioPlex 2200 instrument, to include Antinuclear Antibodies (ANA), Extractable Nuclear Antigens (ENA), Cyclic Citrullinated Peptide Antibody (CCP), and other Autoimmune and Infectious Disease reagents, consumables, and supplies.

b) PRODUCTS: All products ordered under this BPA, placed against the Federal Supply Schedule Award Contract(s), are subject to the terms and conditions of the FSS contract. This BPA does not obligate any funds. The Government is obligated only to the extent of authorized orders issued under the BPA by authorized individuals. The tests provided with expected yearly test volumes are outlined in Section C: Prices and Terms.

c) PRICES AND TERMS: Estimated yearly volumes and test list requirements are attached. Please note these are ESTIMATES ONLY, and do not guarantee volumes. Pricing shall be based on the AVERAGE TEST VOLUME PER INSTRUMENT/ANALYZER. Pricing shall be based on the Cost Per Test or Cost Per Reportable. Instrument service and amortization will be built into the costs of reagents and supplies. The Government estimates the volumes but does not guarantee volumes. These estimates are for the base year and four (4) option years.

d) TERMS OF AGREEMENT: The supplier shall furnish supplies or services, described in general terms, if and when requested by the contracting officer (CO) or the contracting officer representative (COR) during a specified period and within a stipulated aggregate amount, if any. The Government is obligated only to the extent of authorized purchases actually made under the BPA. This BPA is not a contract. If the Contractor fails to perform in a manner satisfactory to the CO, this BPA may be canceled with thirty (30) days written notice to the Contractor by the CO. This BPA shall be reviewed annually.

e) IDENTIFICATION: Delivery Orders issued shall be identified by BPA number and FSS or GSA Contract Number if applicable and shall include an itemized listing of part numbers with the quantities shipped of each part number.

f) ORDERING METHOD: The VAMC Lexington may order products via telephone, facsimile, e-mail, or other written communication, identifying the products by number, quantity, purchase price, address for delivery, and any special instructions. We request that the contract shall be an Indefinite Delivery, Indefinite Quantity (IDIQ) contract, and shipments will be made as requested by the COR or designee. Alternately, we also request that this order shall also be a Cost-Per-Reportable contract, with shipments of reagents and consumables at no charge to the customer, charges based on usage, and billing in arrears.

g) DELIVERY: The analyzer and all reagents will be delivered to the Troy Bowling Campus of the Lexington VA Health Care System using the address below:

i) Special Reference Laboratory (113A) Lexington VA Health Care System Troy Bowling Campus 1101 Veterans Drive, Room A139 Lexington, KY 40502-2236

2) DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK:

a) SCOPE OF PROCUREMENT:

i) All validation and correlation studies must be completed in time for the Special Reference Laboratory to go live with testing on October 1, 2021, with no interruption of testing.

ii) The Special Reference Laboratory (SRL) located at the Lexington VA Health Care System provides laboratory testing for the serologic and molecular diagnosis of infectious disease and autoimmune disorders to any VA facility wishing to utilize its services. The tests offered are those that are too complex (e.g. Complement Fixation testing, Immunofluorescence Assay) or are not cost effective (e.g. HCV PCR and Genotyping, ENA, and ANA testing) at the local level.

iii) The Special Reference Laboratory (SRL) is seeking a fully automated, walk away, fully integrated, random access, continuous feed Multiplex platform capable of high throughput. To provide higher throughput and increased sensitivity for low analytic concentrations, the VAMC SRL requires Multiplex technology. The VAMC SRL is seeking a Cost Per Reportable contract with a base plus four option years for instrumentation, reagents, consumables, and support for Autoimmune and Infectious Disease Multiplex testing.

iv) The instrumentation must be capable of running our current ENA (Extractable Nuclear Antigen) menu (SS-A, SS-B, Sm, Sm/RNP, Scl-70, and Jo-1) as well as ANA (Anti-Nuclear Antibody) screens and Anti-CCP (Cyclic Citrullinated Peptide Antibody) and additional Autoimmune and Infectious Disease assays to add to our test menu (including Syphilis RPR and a HIV differential screen). All assays must be capable of running at one time for improved patient result turnaround times.

v) The test analyzer shall have the capability of performing or reporting the clinical parameters as defined in the statement of work. The instrument(s) shall be able to simultaneously perform the testing as described below and meet the performance characteristics for accuracy and precision as defined by the 1988 Clinical Laboratory Improvement Act (CLIA) and the Clinical and Laboratory Standards Institute (CLSI). To meet the testing requirements and perform tests in a timely manner, the instrument must be a fully automated, random access, continuous feed multiplex testing platform.

vi) The Contractor is required to provide a continuously stocked inventory of reagents, standards, controls supplies, disposables and any other materials required to properly perform tests on the equipment such that equipment operations are not interrupted. These items shall be of the highest quality, sensitivity, specificity and tested to assure precision and accuracy. Expiration date must be clearly marked on reagent, standards, and control bottles. Proven record of accuracy and reliability, efficient and simplified use of reagents, calibrators, and controls. Unexpected changes in methodology/technology shall be at the expense of the Contractor. Alert/Notification of any delays in shipment as well as any or all technical advisory/recalls/alerts, prior to or simultaneously with field alerts should be forwarded to the Special Reference Laboratory Supervisor and the Lexington, KY VAMC Lab Manager.

vii) Special handling for emergency orders of supplies: In the event that the supplies are found to be defective and unsuitable for use with the contractor’s equipment, or the contractor has failed to comply with the requirements for routine supply delivery, the contractor is required to deliver the supplies within 24 hours of receipt of a verbal order for emergency delivery. If either circumstance has occurred, the contractor shall deliver to the government site in the most expeditious manner possible without additional cost to the government, a replacement product.

viii) 2.1.4 Business Associate Agreement (BAA)- A business associate is an entity, including an individual, company, or organization that, on behalf of the VHA facility, performs or assists in the performance of functions or activities involving the use or disclosure of PHI, or that provides certain services involving the disclosure of protected health information (PHI). VHA is a covered entity under the HIPAA Privacy Rule (Privacy Rule). HIPAA regulations require VHA to execute HIPAA-compliant BAAs with everyone that receives, uses, or discloses VHA PHI to perform some activity for VHA. These BAAs obligate VHA business associates to provide the same protections and safeguards to PHI that is required of VHA under the Privacy Rule.

b) DEFINITIONS

i) Cost per Reportable Result (CPRR) as defined in the Federal Supply Schedule FSC Group 66, Part III, Cost-Per-Test Clinical Laboratory Analyzers – Contractors are required to provide a price per reportable patient result. The per patient reportable shall include costs covering: (a) equipment use, (b) all reagents, standards, controls, supplies, consumable/disposable items, parts, accessories and any other item required for the proper operation of the contractor’s equipment and necessary for the generation of a patient reportable result. This per patient reportable result price shall also encompass all costs associated with dilution; repeat and confirmatory testing required producing a single patient reportable result. It shall also include the material to perform as well as all other costs associated with quality control, calibration and correlation study testing that is prescribed by the Clinical and Laboratory Standards Institute (CLSI). (c) all necessary maintenance to keep the equipment in good operating condition (This element includes both preventive maintenance and emergency repairs) and (d) training for Government personnel. Contractors are required to provide delivery, installation, and removal of equipment at no additional charge.

ii) Primary analyzer(s) – Base equipment offered that shall fully support the scope of operations (minimal requirements). Depending upon the technical functionality and the capabilities of the individual manufacturer’s instrumentation, one analyzer or multiple analyzers may be required to meet the productivity specifications defined herein. In those instances, the additional analyzer(s) shall, likewise, be considered primary instrumentation and must meet all technical specifications of this solicitation.

c) TEST MENU

i) Refer to section 1.3 for a list of desired tests and their estimated annual volumes. Additional tests may be considered within option years.

d) GENERAL REQUIREMENTS

i) See Section “a” (Scope of the Procurement).

ii) The system shall provide self-contained, continuous feed, random access Multiplex testing for the Autoimmune assays listed in section 1.3 and have the capability of maintaining positive sample identification throughout the assay process, using the VA generated sample barcodes.

(1) Ability to improve TAT (Turn-Around-Time) by eliminating current batch and reflex testing methods.

(2) Ability to utilize Multiplexing Technology while providing quality assurance with integrated QC beads for each test.

(3) Contractor agrees to ship reagents and consumables with a minimum of 90-Day expiration. The contractor agrees to not charge shipping and handling for orders.

(4) The system can complete screen results and reflex testing within an 8-Hour shift leaving enough time for resulting, cleanup, and shutting station down for the day.

(5) The system must have clot detection capabilities with immediate indication.

iii) The system shall have a data management system with varied options for analysis and reporting/review of cumulative patient and quality control data.

iv) Operational Features - The instrumentation offered shall have the following:

(1) Sufficient capacity and throughput to meet the volume and service demands as defined in the Test Menu and the capability of performing 100% of the tests listed in section 1.3.

(2) Sufficient safety features to avoid unnecessary exposure to biohazardous and chemical material. The exposure to and the volume of biohazardous and chemical material generated by the equipment must be minimal and require a minimum amount of handling.

(3) Capability of bidirectional interfacing to a VA computerized hospital information system. The fully operational interface (both hardware and software) shall be immediately available for implementation to the VA computerized hospital information system.

(4) The system must have the ability to run one or more tests from the above menu from one sample tube, without the need to manually input patient data or tests requested.

(5) The system has primary tube and aliquot sample loading capability with automatic barcode reading.

(6) The system will be equipped with a state-of-the-art touch screen interface that allows for “Add-On” reflex testing on previously run patient samples.

(7) The system will provide an extensive Autoimmune and Infectious Disease test menu to reduce send-out testing and associated costs.

(8) The system must be capable of consolidating time and labor compared to other semi-automated and manual methodologies.

(9) The system must have an on-board refrigerated reagent storage.

(10) The system must have a built in QC software that is capable of tracking long-term quality performance and is able to identify data outliers.

v) Technical Features – The instrumentation must be approved by the Food and Drug Administration (FDA) and shall have the following:

(1) The capability of accurately and reliably determining the presence of the antibody or antigen (analytes) tested.

(2) The system shall have a built-in quality control program to regularly monitor system performance.

(3) The system shall be capable of performing all analyses for the required tests with precision as defined by the 1988 Clinical Laboratory Improvement Act (CLIA) and the Clinical and Laboratory Standards Institute (CLSI).

(4) Data Management System shall have the following:

(i) Capability of maintaining all data for up to 30 minutes in the event of normal electrical power interruptions via battery backup.

(ii) A built-in quality control program to regularly monitor performance of vital components.

(iii) Capability to record, store and print the following information:

1. Required quality control and instrument maintenance information.

2. Patient demographic information and specimen results.

vi) Hardware Features - The instrumentation shall have the following:

(1) An on-board or attached touch screen monitor/screen that is easily readable.

(2) A printer that has the capability of printing a patient report with patient demographic information that includes minimally the accession or unique identifier number (UID) along with assay results.

(3) An uninterruptible power supply with line conditioner for each instrument provided under this BPA.

(4) The system shall have battery back-up capable of maintaining data in the event of a facility power failure.

(5) The system shall have Track Line Connectivity capabilities that allows it to be connected to a total laboratory automation system.

vii) Site Preparation: Site preparation specifications shall be furnished in writing by the contractor as a part of the equipment proposal. The vendor shall visit the site and the proposed location of equipment and determine if the equipment footprint meets available space. If not, site prep requirements shall be included in the proposal. Note: There is no direct water line or direct waste line in the area this instrument will occupy. In addition, requirements associated with the items listed below must be detailed.

(1) Power availability

(2) Space availability

(3) Other utility availability

(4) Increase heat load affecting air conditioning

(5) Specialized ventilation if required

(6) Special finishes required

(7) Carts for non-floor-standing instrumentation

viii) Vendor site prep visit to include a representative from logistics, biomedical engineering, and laboratory. Any identified site preparation costs shall be detailed in writing to include full scope of work and detailed cost estimate. All site work shall be performed by tradesman licensed in the respective state(s). Any site prep shall be documented and submitted to the VA for review and approval.

ix) Comparison and Validation of Analyzer: The Contractor shall perform, to the satisfaction of the Government, at no cost to the Government all comparison and validation studies to include any materials and reagents needed for such correlation. The Contractor shall perform all the statistical analysis and report data in an organized, clearly comprehensible format. This process shall be completed within two weeks of installation of the analyzer and shall be consistent with current CLSI and related documents, CAP and The Joint Commission Standards and Federal Regulations.

x) Support Features

(1) Commercial marketing. The equipment models being offered shall be in current production as of the date this offer is submitted. For purposes of this solicitation, “current production” shall mean that the clinical laboratory analyzer model is being offered as new equipment. Discontinued models are not acceptable.

(2) Start-Up Reagents. The Contractor shall provide all reagents, calibrators, controls, consumable/disposable items, parts, accessories and any other item included on the list of supplies defined in the Federal Supply Schedule contract and required to establish instruments for operation for performance of acceptance testing. The Contractor shall perform, to the satisfaction of the Government, all validation studies including: precision, method comparison with current analyzer, accuracy (recovery), linearity (reportable range), calibration verification, verification of reference interval, and determination of sensitivity and specificity at no cost to the Government. The Contractor shall perform all the statistical analysis as stated in Paragraph 2.4.7 and report data in an organized, clearly comprehensible format.

(3) Training. The Contractor shall provide an instrument training program that is coordinated with and timely to the equipment installation, sufficient to the size and scope of the facility’s services and minimally equivalent to the terms and conditions for training defined in the Contractor’s Cost Per Reportable Result Federal Supply Schedule FSC Group 66, Part III, Cost-Per-Test Clinical Laboratory Analyzers contract. This shall include training on the operation of the system, data manipulation, and basic trouble shooting and repair. Utilization of the training slots shall be mutually agreed upon between the VA and the Contractor. Training may be done on site or off site, as mutually agreed upon between the VA and the Contractor. A training program that involves off-site travel shall include the cost of airfare, ground travel and room and board for each participant.

(4) Equipment Preventative Maintenance/Repair Service. The Contractor shall be able to provide emergency equipment repair and preventative maintenance on all primary and back-up instrumentation and any incremental support equipment offered according to the following terms:

(a) A technical assistance center must be available by telephone 24 hours per day, 7 days per week with a maximum call back response time of one hour.

(b) Equipment response time shall be no more than 24 hours.

(c) A minimum of two scheduled preventative maintenance calls per year.

(d) A malfunction incident report shall be furnished to the Laboratory upon completion of each repair call. The report shall include, as a minimum, the following:

(i) Date and time notified

(ii) Date and time of arrival

(iii) Serial number, type, and model number of equipment

(iv) Time spent for repair, and

(v) Proof of repair that includes documentation of a sample run of quality control verifying acceptable performance.

(e) During the term of the BPA, should the repair record of any individual piece of laboratory equipment reflect a downtime of 10% or greater in one calendar month, a determination shall be made by the designated representative of the Government to replace the malfunctioning equipment with new equipment. The responsibility for maintaining the equipment furnished in good condition in accordance with manufacturer’s instructions, shall be solely that of the contractor. Each instrument provided by the contractor shall maintain an uptime of 90% in each month of the term of the agreement. Each notification for an emergency repair service call shall be treated as a separate and new service call.

(5) Upgrades - The Contractor shall provide upgrades to both the equipment hardware and software to maintain the integrity of the system and the state-of-the art technology, at no additional charge to the Government. These must be provided as they become commercially available and at the same time as they are being provided to commercial customers. This requirement only applies to “system upgrades” that enhance the model of equipment being offered, i.e. new version of software, correction of hardware defect, upgrade offered to commercial customers at no additional charge, upgrade to replace model of equipment no longer Contractor supported, etc. This does not refer to replacing the original piece of equipment provided under the BPA; however, it does refer to significant changes in the hardware operational capability.

(6) Ancillary support equipment - The Contractor shall provide, install and maintain , as indicated, any and all ancillary support equipment to fully operate the analyzer as defined in these specifications, e.g. cabinetry to support/house the analyzer (if necessary), and universal interface equipment, etc. In addition, the vendor shall include all ancillary components that are customarily sold or provided with the model of equipment proposed, e.g. starter kits, tables/stands, etc.

(7) The Contractor shall be responsible for providing all hardware required for the connection, implementation and operation of the interface to the universal interface, including the license for Data Innovations connection, the connectivity hardware for Data Innovations, and the yearly maintenance and support for the Data Innovations license for the first (base) year of the contract.

(8) The Contractor shall provide all necessary software support for ensuring that successful interfacing has been established. Specific requirements for the communication of the data streams shall be unique to the instrument system involved and dictated by the manufacturer itself.

(9) Commercial offerings - The Contractor shall provide any additional support material that is routinely provided to equivalent commercial customers and shall assist in regulatory compliance, e.g. PC computer diskette of their procedure manual or an on-line procedure manual in the instrument software, and editable NCCLS formatted procedures for each procedure listed in Section 1.3.

(10) Characterization of hazardous waste – The Contractor shall provide a description of the characteristics of the hazardous waste produced as a byproduct of the instrument operations and address the criteria listed in the Code of Federal Regulations Title 40 “Protection of the Environment” Part 261 et al. The description shall address the following:

(a) Waste toxicity (Reference 40CFR261.11 and 40CFR261.24)

(b) Waste ignitability (Reference 40CFR261.21)

(c) Waste corrosivity (Reference 40CFR261.22)

(d) Waste reactivity (Reference 40CFR261.23)

(e) Hazardous waste from non-specific sources (F-listed) (Reference 40CFR261.31)

(f) Discarded commercial products (acutely toxic or P-listed and toxic or U-listed) (Reference 40CFR261.33)

(11) Implementation and transition timeframe - The implementation of the services/requirements described in this solicitation shall be completed no later than thirty (30) days after the award of the contract. This timeline is based on a reasonable attempt of the Contractor to complete all the necessary implementation requirements within the stated timeframe. Contractors shall not be penalized for implementation timelines that extend beyond the thirty (30) day timeframes if the extension is through no fault of the Contractor and is a result of delays due to the Government.

(a) Upon award of a BPA, the transition period for the awarded contract to have all equipment and peripherals installed and operational shall be from date of award through thirty (30) days. During this same period, all initial training of VA personnel in the operation and maintenance of said equipment shall also be completed.

(b) Offerors shall provide with its quotation an implementation plan for installation of new equipment. Contractor’s submitted plan shall not exceed thirty (30) days for the transition of all services under the awarded BPA including installation and training of personnel, transition of all testing materials, reagents, and supplies, etc., performance of all correlations and validations. Failure of the contractor to conform to the transition period shall be considered as sufficient cause to terminate contract for cause under the Termination for Cause clause of the contract.

(c) At the end of thirty (30) days from award of the contract, the awarded contractor shall have full and sole responsibility for services under the awarded BPA.

xi) Standard and Quality of Performance - This paragraph establishes a standard of quality performance that shall be met before any equipment listed on the delivery order [or BPA] is accepted by the government. This also includes replacement, substitute machines and machines that are added or field modified after a system has demonstrated successful performance. The acceptance period shall begin on the installation date. It shall end when the equipment has met the standard of performance for a period of 30 consecutive calendar days by operating in conformance with the contractor’s technical specification or as quoted in any contract at an effectiveness level of 90% or more.

(1) If equipment does not meet the standard of performance during the initial 30 consecutive calendar days, the standard of performance tests shall continue a day-by-day basis until the standard of performance is met for a total of 30 consecutive days.

(2) If the equipment fails to meet the standard of performance after 90 calendar days from the installation date, the user may, at his/her option, request a replacement or terminate the order in accordance with the provisions of FAR.52.212-4 entitled “Termination for cause.” (The contractor shall receive revenue for tests reported during the 90-day acceptance period.)

(3) Operational use time for performance testing for a system is defined as the accumulated time during which the machine is in actual use. System failure downtime is that period when any machine in the system is inoperable due to equipment failure. Downtime for each incident shall start from the time the government makes a bona fide attempt to contact the contractor’s designated representative at the prearranged contact point until the system or machine(s) is returned to the government in proper operating condition.

(4) During the performance period for a system, a minimum of 100 hours of operational use time with productive or simulated work shall be required as a basis for computation of the effectiveness level. However, in computing the effectiveness level, the actual number of operational use hours shall be used when more than the minimum of 100 hours.

(5) The government will maintain daily records to satisfy the requirements of this paragraph and shall notify the contractor in writing of the date of the first day of the successful period of operation. Operations use time and downtime shall be measured in hours and whole minutes.

xii) Government’s Responsibility: The user will perform routine maintenance and cleaning as required in the manufacturer’s operation and maintenance instructions. The user shall maintain appropriate records to satisfy the requirements of this paragraph.

xiii) Ownership of Equipment: Title to the equipment shall remain with the contractor. All accessories (unused consumables, etc.) furnished by the contractor shall accompany the equipment when returned to the contractor. The contractor, upon expiration of order(s), at termination and/or replacement of equipment, shall remove the equipment. The contractor shall disconnect the analyzer (gas, water, air, etc.) and shall be responsible for all packing and shipping required to remove the analyzer.

Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule: Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The HIPAA Privacy Rule promulgates rules governing the security, use and disclosure of Protected Health Information (PHI) by covered entities, including Federal agencies such as the Department of Veterans Affairs (VA). A covered agency must obtain satisfactory written assurances from its business associates that they will appropriately safeguard PHI that is received from or created on behalf of the agency. If the VA contracting officer determines that HIPAA is applicable to an offer that is submitted under this schedule, the offeror will be required to enter into a Business Associate Agreement (BAA) with the agency prior to the effective date of the contract. The BAA will describe the permitted and required uses of PHI by the offeror; provide that the offeror will not use or further disclose the PHI other than as permitted or required by the contract or by law; and require the offeror to use appropriate safeguards to prevent unauthorized disclosure of the PHI.

Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule: Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The HIPAA Privacy Rule promulgates rules governing the security, use and disclosure of Protected Health Information (PHI) by covered entities, including Federal agencies such as the Department of Veterans Affairs (VA). A covered agency must obtain satisfactory written assurances from its business associates that they will appropriately safeguard PHI that is received from or created on behalf of the agency. If the VA contracting officer determines that HIPAA is applicable to an offer that is submitted under this schedule, the offeror will be required to enter into a Business Associate Agreement (BAA) with the agency prior to the effective date of the contract. The BAA will describe the permitted and required uses of PHI by the offeror; provide that the offeror will not use or further disclose the PHI other than as permitted or required by the contract or by law; and require the offeror to use appropriate safeguards to prevent unauthorized disclosure of the PHI.

VA Information and Information System Security and Privacy: All contractor employees working on VA property must wear badges that are issued by the Police and Security Department. Contractor employees are required to wear the badges at all times while on VA property and must turn them into the Police and Security Department prior to leaving VA property. When contractor employees are working in an area where there is highly sensitive information, there must be a VA employee present at all times during this period.

The Contractor must have remote monitoring of analyzers. The Contractor must have a fully functional VPN (Virtual Private Network) based bi-directional interface account established with the federal government. Contractor shall provide VISTA/LEDI (Laboratory Electronic Data Exchange) laboratory interface system as approved by the VA National Security Operation Center. A copy of the VPN must be included in your response.

GENERAL: Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS:

A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE:

Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor’s rights to use data as described in Rights in Data – General, FAR 52.227-14(d) (1).

VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor while performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclosure protected health information, there is no business associate relationship.

The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (a) in response to a qualifying order of a court of competent jurisdiction, or (b) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contacting officer for response.

Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE:

For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPPA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent, to those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA’s network involving VA information must be reviewed and approved by VA prior to implementation.

Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the contractor’s systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA OCS Certification Program Office. Government-owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

The contractor/subcontractor’s system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the ISO for entry into VA’s POA&M management process. The contractor/subcontractor must use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with contractor/subcontractor activities must also be subject to such assessments. If major changes to the system occur that may affect the privacy or security of the data or the system, the C&A of the system may need to be reviewed, retested and re-authorized per VA Handbook 6500.3. This may require reviewing and updating all the documentation (PIA, System Security Plan, Contingency Plan). The Certification Program Office can provide guidance on whether a new C&A would be necessary.

The contractor/subcontractor must conduct an annual self-assessment on all systems and outsourced services as required. Both hard copy and electronic copies of the assessment must be provided to the COR. The government reserves the right to conduct such an assessment using government personnel or another contractor/subcontractor. The contactor/subcontractor must take appropriate and timely action (this can be specified in the contract) to correct or mitigate any weaknesses discovered during such testing, generally at no additional cost.

VA prohibits the installation and use of personally owned or contractor/subcontractor-owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW or contract. All the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA-approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned OE.

All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: completion or termination of the contract or disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per 6500.1 requirements. This must be completed within 30 days of termination of the contract.

Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are: Vendor must accept the system without the drive; VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then; the equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact; and any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be pre-approved and described in the purchase order or contract.

A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (1) and (2) controls above are in place and completed. The ISO needs to maintain the documentation.

SECURITY INCIDENT INVESTIGATION:

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH:

Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General as independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term ‘data breach’ means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis.