B.4 PERFOMANCE WORK STATEMENT (PWS)

Traumatic Brain Injury (TBI) Registry and Rehabilitation Database

1. BACKGROUND

The purpose of this acquisition is to establish the terms and conditions under which VA and the Traumatic Brain Injury Model Systems (TBIMS) National Data and Statistical Center (NDSC) support two ongoing collaborative activities: to maintain the Traumatic Brain Injury (TBI) Veterans Health Registry and the Veterans Affairs (VA) Polytrauma Rehabilitation Center/TBMIS (PRC)/TBIMS longitudinal research database. Support of the TBI Veterans Health Registry includes processing of VA Data on OEF/OIF and post-9/11 era Veterans and issuing brief biannual reports, more comprehensive internal administrative documents on a biannual basis, and special reports as needed to support the fulfillment of Public Law 110-181 Section 1704. The PRC/TBIMS database supports longitudinal research that mirrors data elements collected through the National Institute on Disability, Independent Living, and Rehabilitation Research (NIDILRR) funded TBIMS project. The NIDILRR TBIMS NDSC is currently at Craig Hospital, but the next 5-year grant is currently being competed with a projected start date of September 1, 2026.

At the direction of Congress, VA maintains the VA TBI Veterans Health Registry that includes information about Veterans who served in OEF/OIF and post-9/11 operations who exhibit symptoms associated with TBI and seek care or benefits from the VA.

Veterans fitting this definition are considered registry cases, which include cases identified through the VA TBI Screen, disability claims data processed by the Veterans Benefits Administration, or electronic medical record review. Cases designated as TBI within the VA TBI Registry must have at least one of the following: (1a.) a complete VA TBI Screen, in which the Veteran reports a history of TBI diagnosis during post-9/11 deployment or (1b.) a complete VA TBI Screen in which the Veteran responds positively to all four VA TBI Screen questions; (2) a VBA disability claim that includes a claim code for TBI; and/or (3) an electronic medical record that includes an ICD diagnosis code of TBI (as defined by VA TBI Case finding procedures).The construction of the registry was, and its maintenance is, mandated by Congress, under PL 110-181, section 1704 and PUBLIC LAW 110–181— JAN 28, 2008 122 STAT. 491. A report, based on information from the registry, is updated semi-annually.

In addition to the Registry, this contract supports VA’s collaboration with the NIDLIRR funded TBIMS through the development and support of the VA PRC/ TBIMS longitudinal research database. The Department of Health and Human Services (DHHS) funds a Center of Excellence (COE) through a grant to perform research and maintain data on TBI across a system of 16 academic centers across the US specializing in TBI care. VA is required by Public Law 110–181—JAN 28, 2008 122 STAT. 491 to collaborate with facilities that conduct research on rehabilitation for individuals with TBI. VA has collaborated with the TBIMS through an interagency agreement with the Department of Education, from 2008 through 9/30/2015. NIDLIRR was realigned under DHHS, requiring VA to establish a new method of acquisition to meet the public law requirement.

VA is committed to providing the highest quality rehabilitation care at the PRCs. It is incumbent on VA to evaluate the outcomes of these specialized programs. Through VA’s involvement in the TBIMS project; 1) a parallel database of Veterans with TBI at the PRCs has been established, 2) the VA is able to benchmark its clinical outcomes with the nation's leading centers of excellence, and 3) the PRCs are able to collaborate in evidence-based research on TBI rehabilitation interventions. Through June 2025, VA teams at the five PRCs have enrolled 2,710 participants following discharge from a VA PRC. TBIMS is the world's leading longitudinal database of TBI outcomes with more than 20,000 enrollees followed for up to 30 years, which assesses the rehabilitation and functional outcomes of individuals at 16 academic centers across the US specializing in TBI care.

The VA PRC/TBIMS data set is classified as a Limited Data Set for research, defined by the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule as Protected Health Information (PHI) from which the following direct identifiers of the Veteran have been removed: names, addresses (other than town or city, state, or zip code), phone numbers, fax numbers, e-mail addresses, Social Security Numbers, medical record numbers, health plan numbers, account numbers, certificate and/or license numbers, vehicle identifiers or serial numbers, device identifiers or serial numbers, web universal resource locators, internet protocol address numbers, biometric identifiers, and full-face photographic images and any comparable images. The Contractor is provided access to the Limited Data Set for research housed on VA servers via a secure connection to properly authorized personnel.

The Contractor will maintain and update the research database behind the VA firewall, maintaining consistency with protocols across the VA PRC/TBIMS projects.

2.0 RESERVED

3. SCOPE

The Contractor shall provide the following services to meet Congressional requirements:

3.1 Program Management

3.2 Maintain the TBI Veterans Health Registry.

The TBI Veterans Health Registry includes processing of VA Data on OEF/OIF and post- 9/11 era Veterans and issuing brief biannual reports, more comprehensive internal administrative documents on a biannual basis, and special reports to VA leadership as needed.

(1) Registry Management; and,

(2) Reporting.

3.3 Maintain the VA PRC/TBIMS longitudinal research database.

The VA PRC/TBIMS database supports longitudinal research that mirrors data elements collected through the NIDILRR funded TBIMS project.

(1) Develop Standard Operating Procedures for the VA PRCs to maintain research data and retain subjects;

(2) Provide Quality Support Visits;

(3) Provide Training and Technical Support;

(4) Resolve Issues and Answer Questions;

(5) Perform Data Analysis and Variable Modification;

(6) Provide Meeting Support;

(7) Perform Knowledge Translation Activities;

(8) Perform Database Configuration and Administration;

(9) Maintain Data Quality; and,

(10) Provide Statistical and Other Methodological Consultation.

4.0 PERFORMANCE DETAILS

4.1 Period of Performance: The Period of Performance (PoP) shall be five (5) Years from date of award. The base period will be twelve months with four 12-month option periods.

4.2 Place of Performance: The contract services and activities will take place at the Contractors site and periodically at VA sites.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 Contract Management:

The Contractor shall assign a Project Manager (CPM) to provide oversight of all contracted efforts. The CPM shall communicate with the COR on all issues related to project outcomes. The CPM shall attend a virtual kick-off meeting to discuss the project approach, schedule, milestones, and points of contact.

5.1.1 Kick-off Meeting: The Contractor shall attend a kickoff meeting, with all VA partners to establish a baseline of understanding after the contract award or as directed by the Contracting Officer. Participants will include all key Contractor personnel and VA staff. At the kick-off meeting, the Contractor shall present the details of its strategic vision, intended approach, and approximated project schedule for review and approval by VA. The kick-off meeting will serve to resolve strategic questions, refine goals, define success, and explore the biggest challenges and breakthrough opportunities for VA.

Deliverable:

Action item list Meeting minutes

5.1.2 Contractor Project Management Plan: The Contractor shall provide, develop, update and follow a Contractor Project Management Plan (CPMP). The CPMP shall include scope definition, schedule to be reviewed and approved by the COR prior to start of work on any implementation effort. The CPMP shall also include technical approaches;

deliverables; dates for deliverables; tracking tool; risk management mitigation strategies;

communication strategies and materials; implementation strategy; and project closeout activities. The Contractor shall employ a management approach that is in compliance with Project Management professional standards. The project schedule shall be delivered in MS Project 2010.mpp digital format that includes all deliverables and milestones, as well as the activities or tasks required producing the deliverables. The Contractor shall submit a CPMP with Quarterly updates.

Deliverable:

CPMP with Quarterly Updates

5.1.3 Weekly Progress Meetings: The Contractor shall hold weekly virtual meetings with VA during the first quarter to provide updates on progress, identify critical issues, discuss next steps, and plan for ongoing success. The monthly Meeting time will be determined by the COR.

Deliverable:

Weekly Meeting Status Report

5.1.4 Monthly Progress Meetings: The Contractor shall hold monthly virtual meetings with VA to provide updates on progress, identify critical issues, discuss next steps, and plan for ongoing success. The monthly Meeting time will be determined by the COR.

Deliverable:

Monthly Progress Meetings Report

5.1.5 Monthly Status Report: The Contractor shall provide a monthly written report with updates on recent activities, analytics, anticipated issues, performance, and other topics as requested by the COR. The monthly status report is an overarching report providing status of reports and plans representing all aspects of program performance.

Deliverable: (Report) Monthly Status Report

5.2 Registry: The construction of the registry and its maintenance is, mandated by Congress, under public law. The reporting outlined below is required to meet the public law.

5.2.1 Registry Management, Reporting and Programming: On a biannual basis, the Contractor shall identify and access VA files to allow enumeration of likely eligible population denominator; or access similar file from a collaborating VHA program office or data resource as directed by the government. The Contractor shall perform the work entailed in processing the data files to produce files that can be used for TBI Registry management reports including making template programs that could be used for future registry reports. From this preliminary work, the contractor shall update the VA TBI Screening File, the VA Clinical Evaluation File, the VA Benefits File, and the VA Healthcare files and other data resources as directed by the government for the identified cohort of Veterans and incorporate it into the VA TBI Registry. On a biannual basis, the cohort of targeted Veterans taking the VA TBI Screen, but not included in the VA TBI Registry, shall be identified; and their Screen results, roster, and healthcare data shall be included in comparison group files by the Contractor for analysis to help interpret VA TBI Registry findings. Provide email notification to the COR upon completion.

Deliverable:

Email Notification

5.2.2 Registry Report: The Contractor shall brief the program office on the VA TBI Registry Reports on a biannual basis. A brief VA TBI Registry Report consisting of routine tables (not to exceed 10 pages) shall focus on key data available from the VA TBI Registry and shall be issued when new data is available from the VA (typically quarterly). The VA will approve the content and format of this report and may make changes as necessary to meet Program needs. The final content and format of this report will be approved by the

VA.

Deliverable:

Biannual VA TBI Registry Report

5.2.3 Executive Summary: The Contractor shall issue the VA TBI Registry Internal Administrative Documents on a biannual basis. A more comprehensive VA TBI Registry Internal Administrative Document, including comparative healthcare data among comparison groups of OEF/OIF and post-9/11 era Veterans and intended for internal VA TBI program development will be issued when new healthcare utilization data are available from the VA (typically quarterly). The comparison groups shall include those taking the VA TBI Screen but not reporting exposure to traumatic events, those reporting exposure but without loss or alteration of consciousness, those reporting loss or alteration of consciousness but no TBI related symptoms, and those reporting potentially TBI related symptoms at the time of exposure which resolved. The final content and format of this document shall be approved by the VA.

Deliverables:

Biannual Comprehensive Comparative Healthcare Utilization Document (Executive Summary)

5.2.4 Ad Hoc Reports: The Contractor shall prepare special VA TBI Registry Reports.

To meet the needs of the VA which cannot be anticipated or met by either the brief biannual VA TBI Registry Reports or the extended biannual VA TBI Registry Reports, special purpose, ad hoc reports will be prepared on an as-needed basis. These Special VA TBI Reports will only utilize data already available in the VA TBI Registry or comparison group files, and the frequency of these reports is not anticipated to exceed an average of one per quarter. Ad hoc requests result from the latest biannual reports, which require slightly more detailed analysis of previously addressed issues.

Deliverable:

Ad Hoc Reports

5.3 PRC/TBIMS Longitudinal Research and Database

5.3.1: Standard Operating Procedures: Review and update new SOPs for VA PRCs on subject retention and data collection procedures, data entry methods, and appropriate use of study instruments, and by monitoring the quality of data submitted by centers.

Deliverable:

Revised SOPs, updated annually

5.3.2 Quality Support Visits: Provide data quality support visits for training on database and module studies as well as review existing processes followed by the local team.

Quality Support Visits shall rotate sites such that each PRC will be visited at least once during the 5-year contract cycle, one per year not to exceed 3 travelers, for 3-day sessions.

Deliverable:

Summary Document of Visit

5.3.3 Training and Technical Support: Coordinate quarterly training/technical support sessions for data collectors and project investigators virtually or face-to-face. Trainings will address subject retention and data collection procedures, data entry methods, and appropriate use of study instruments. Additional Ad-hoc sessions may also be required not to exceed 8 per year.

Deliverable:

Meeting minutes

5.3.4 RESERVED

5.3.5 Data Analysis and Variable Modification: The Contractor shall perform data analysis that will lead to new findings regarding approaches to group and analyze the limited data set to support future research and programmatic reporting. These groupings and reports may be unique to VA PRC experience or incorporate enhancements agreed upon by the NIDLIRR TBIMS project directors. NIDLIRR funded TBIMS is the world's leading longitudinal database of TBI outcomes with more than 20,000 enrollees followed for up to 30 years, which assesses the rehabilitation and functional outcomes of individuals at 16 academic centers across the US specializing in TBI care. The Contractor shall recommend new data crosswalks and calculated variables and document the new approach. The Contractor shall prepare a decision paper that outlines the new approach, the alternatives considered, and the approach recommended. Update and maintain approved calculated variables.

Deliverable:

Decision Paper, NTE 5 per year Database modification for new approved variables, NTE 4 per year Syllabus update for new approved variables, NTE 4 per year

5.3.6 Meeting Support: Coordinate and provide technical support for meetings between TBIMS and VA PRCs and among VA PRCs. The NDSC coordinates ongoing face to face meetings, project calls and virtual meetings for special project groups with participants from VA and NIDLIRR staff to ensure quality and consistency in approach to the project.

5.3.6.1 TBIMS Project Director Meetings: Coordinate VA PRC participation in the semi-annual TBIMS Project Director Meetings, June, and December. The Contractor shall organize and facilitate the VA breakout session at the project director meeting to include:

developing agenda, inviting attendees, preparing and electronically distributing handouts and preparing meeting minutes. Travel for NDSC staff will be covered by NIDLIRR.

Deliverables:

Handouts Meeting minutes

5.3.6.2 Data Collectors Meeting: In addition, the Contractor shall support the Data Collector’s Meetings held approximately every 18 months, June or December. The Contractor shall organize and facilitate the VA breakout session at the data collector meeting to include: developing agenda, inviting attendees, preparing and electronically distributing handouts and preparing meeting minutes. Travel for NDSC staff will be covered by NIDLIRR.

Deliverables:

Handouts Meeting minutes

5.3.7 Knowledge Translation Activities: The Contractor shall develop and maintain TBIMS/VA PRC Knowledge Translation (KT) activities.

5.3.7.1 PowerPoint Presentation: Develop and maintain the TBIMS/VA PRC Model System PowerPoint presentations for Government approval.

https://www.tbindsc.org/StaticFiles/Documents/2015%20TBIMS%20Slide%20Presentation .pdf

Deliverables:

PowerPoint Presentations

5.3.7.2 Brochure: Develop and maintain, the TBIMS/VA PRC Brochure. Sample provided at:

Brochure: https://www.tbindsc.org/StaticFiles/Documents/2017_TBIMS_InfoSheet_Brochu re.pdf

Deliverables:

Brochure

5.3.7.3 Publications and Presentations Inventory: Develop and maintain a list of TBIMS/VA PRC TBI publications and presentations using the VA PRC database.

Historical files will be provided to the Contractor. Post the index to the VA PRC public website.

Deliverables:

Publications and Presentations Inventory

5.3.7.4 Active Project Inventory: Develop, maintain and post to the VA PRC public website, a list of all internal and external analysis projects using the VA PRC Database.

Deliverables:

Active Project Inventory

5.3.8 Database Configuration and Administration: The Contractor shall maintain the existing TBI model systems database using the approved VA Syllabus and data elements onto a VA platform residing within the VA firewall. The fully functional database is accessible to VA project staff through secure login to complete data entry. The database provides reporting and data export capability, and access to the project syllabus and https://www.tbindsc.org/StaticFiles/Documents/2015%20TBIMS%20Slide%20Presentation.pdf https://www.tbindsc.org/StaticFiles/Documents/2015%20TBIMS%20Slide%20Presentation.pdf https://www.tbindsc.org/StaticFiles/Documents/2017_TBIMS_InfoSheet_Brochure.pdf https://www.tbindsc.org/StaticFiles/Documents/2017_TBIMS_InfoSheet_Brochure.pdf

SOPs. The Contractor shall maintain database functionality through on-site work and virtually through secure VA login. The contractor shall restructure the web system to be comprehensive and user friendly. Update web site to current Information Technology (IT) standards. The Contractor shall administer and provide project oversight for the web site. The Contractor shall provide analysis of system and site performance based on key analytics generated by the system. The Contractor shall provide user administration, testing, optimization and user support; Integrate programmatic testing on the website and assemblies used in website. One trip per year is required for maintenance and updates, not to exceed two travelers per trip, for five-day sessions. All travel must be approved by the COR.

Deliverables:

Fully configured and populated Database, updates NTE 4 annually

5.3.9 Data Quality: The Contractor shall develop data checks and monitor data quality and use these data checks to identify and incorporate new requirements based on research findings and feedback from the VA PRC project leads. Maintain and improve routine data reporting. Develop metrics for data quality and report quarterly on progress. The data entry deadlines for each quarter are variable based on project discussions and clarifications.

Deliverable:

Quarterly Data Quality Reports, NTE 7 reports per quarter:

Quarterly missing data report.

Quarterly missing data analyses Quarterly Completeness Quarterly Report Quarterly Target Analyses Quarterly Error Counts

5.3.10 Consultation: The Contractor shall provide statistical and other methodological consultation to VA PRCs. Provide expert consultation to meet the VA PRCs statistical/methodological needs. Provide analytic/statistical support to PRCs on database studies. Assist with writing of manuscripts for publication of database studies. Lead authorship for studies using VA data is primarily attributable to VA. Provide training on statistical techniques which maximize the utility of the VA PRC Database. The Contractor shall prepare a decision paper that outlines alternatives methods considered and the approach recommended. Report quarterly on status of activities.

Deliverable:

Statistical Decision Paper, NTE 5 in base year and the option years Methodological Decision Paper, NTE 5 in base year and the option years Quarterly Status Report

6.0 DELIVERABLES

The Contractor shall provide all deliverables identified in the table below in formats as agreed to by the COR and CPM. All deliverables, unless otherwise specified shall use Microsoft Office compatible formats.

Base Year Task Deliverable Description Quantity Date

5.1.1 Kick-off Meeting: Action Item list, meeting minutes

Five business days after effective date of award.

5.1.2

CPMP

Due 30 business days after award and updated Quarterly throughout the first contract year.

5.1.3 Weekly Meeting Status

Report

12 Due on the fifth business day of each month throughout PoP.

5.1.4

Monthly Progress Meeting Report

Due on the fifth business day of each

5.1.5 Monthly Status Report

5.2.1

Email Notification

Due on the fifth business day following the end of each quarter.

5.2.2

Biannual VA TBI Registry Report the end of every second quarter

5.2.3 Executive Summary

the end of each every second quarter.

5.2.4 Ad Hoc Reports

Due within 7 business days of request

5.3.1

Revised SOP, updated annually

Draft due 60 days prior to end of PoP. Final due 10 business days following VA comment.

5.3.2

Summary Document of Visit

Due 30 days following completion of travel.

5.3.3

Due 30 days following completion of meeting.

5.3.4 RESERVED - -

5.3.5

Decision Paper

NTE 5

Due 30 days following project director approval.

5.3.5 Database Modification

NTE 4

Due 30 days following change in variables.

5.3.5 Syllabus Update NTE 4 Due 30 days following change in

5.3.6.1

Handouts and

Meeting Minutes

Handouts due 2 business days prior the meeting. Meeting minutes due 2 business days following the meeting.

5.3.6.2

Handouts and the meeting. Meeting minutes due 2 business days following the meeting.

5.3.7.1

PowerPoint

Presentations

5.3.7.2

5.3.7.3

Publications and

Inventory

5.3.7.4

Active Project Inventory

5.3.8

Fully configured and populated Database

Due 180 days from effective date data access is provided.

5.3.9 Quarterly Data Quality

Reports, the data entry deadline for each quarter.

5.3.10

Statistical Decision Paper

Methodological Decision

Paper

5.3.10 Quarterly Status Report

6.2 Option Year(s)

Task Deliverable

Quantity Date

5.1.2

CPMP

Updates Due 5 business days after award and Quarterly throughout the first contract year.

5.1.4

Monthly Progress

5.1.5

Monthly Status Report

5.2.1

Email Notification

5.2.2

Biannual VA TBI Registry Report the end of every second quarter

5.2.3 Executive Summary

the end of every second quarter.

5.2.4 Ad Hoc Reports

Due within 7 business day of request.

5.3.1

Revised SOP, updated annually

Period of Performance. Final due 10 business days following VA comment.

5.3.2 Summary Document

of Visit

Due 30 days following completion of travel.

5.3.3

Due 30 days following completion of meeting.

5.3.4 RESERVED - -

5.3.5

Decision Paper

Due 30 days following project director approval.

5.3.5 Database Modification

Due 30 days following change in

5.3.5 Syllabus Update NTE 4 Due 30 days following change in

5.3.6.1

Handouts &

Handouts due 2 business days prior to the meeting. Meeting minutes due 2 days following the meeting.

5.3.6.2

Handouts &

Minutes

OP1 and

OP3

(See

PWS)

to the meeting. Meeting minutes due 2 days following the meeting.

5.3.7.1

PowerPoint

5.3.7.2

5.3.7.3

Publications and

Inventory

5.3.7.4

Active Project Inventory

Draft due 60 days prior to end of

5.3.8 Updated and

maintained fully configured and

Updates completed by the fifth business day prior to the data entry deadline for each quarter.

5.3.9

Data Quality Report the data entry deadline for each quarter.

Statistical Decision Paper

Methodological Decision Paper

5.3.10 Quarterly Status Report

4 Due on the fifth business day following the end of each quarter.

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include:

MS Word 2000/2003/2007/2010, MS Excel 2000/2003/2007/2010, MS PowerPoint 2000/2003/2007/2010, MS Project 2000/2003/2007/2010, MS Access 2000/2003/2007/2010, MS Visio 2000/2002/2003/2007/2010, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

6.4 TRAVEL AND OTHER DIRECT COSTS

Contractor travel is required under this contract. Travel must be approved in advance by the Contracting Officer’s Representative (COR) and will be reimbursed in accordance with the Federal Travel Regulations (FTR). Each Contractor invoice must include copies of all receipts that support the travel costs claimed in the invoice.

Travel within a 50-mile radius of the place of performance or the Contractor’s facility will not be reimbursed. The Government will not be responsible for any relocation expenses associated with moving Contractor personnel to the job sites as may be identified in this task order either initially, or if necessary, with replacement of personnel, even if replacement of personnel is required.

Other Direct Costs (ODCs): The Government anticipates that ODCs will be required to address the requirement. ODCs are miscellaneous items such as meeting fees, etc. ODCs will be reimbursed at contractor cost. Each contractor invoice must include copies of all receipts that support the ODCs claimed in the invoice and written substantiation for the incurred cost. Projected ODCs shall be reviewed by COR and authorized in advance by CO.

7.0 SECURITY

7.1SECURITY AND PRIVACY REQUIREMENTS

7.1.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

Position Sensitivity

Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Suitability and Security Program,” Appendix A)

Low / Tier

Tier 1 / National Agency Check with Written Inquiries (NACI) A Tier 1/NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), FBI name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

Moderate / Tier 2

Tier 2 / Moderate Background Investigation (MBI) A Tier 2/MBI is conducted by OPM and covers a 5-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, law enforcement check; and a verification of the educational degree.

High / Tier

Tier 4 / Background Investigation (BI) A Tier 4/BI is conducted by OPM and covers a 10-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and a verification of the educational degree.

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements by Task Task Number Tier1 / Low / NACI Tier 2 / Moderate /

MBI

Tier 4 / High / BI

5.1 5.2 5.3

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

7.1.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation,

b. And are able to read, write, speak and understand the English language.

c. The Contractor shall bear the expense of obtaining background investigations.

d. Within 3 business days after award, the Contractor shall provide a roster of

Contractor and SubContractor employees to the COR to begin their background investigations in accordance with the ProPath template. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

e. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

f. The Contractor shall ensure the following required forms are submitted to the

COR within 5 days after contract award:

1) For a Tier 1/Low Risk designation:

a) OF-306

b) DVA Memorandum – Electronic Fingerprints

2) For Tier 2/Moderate or Tier 4/High Risk designation:

a) OF-306

b) VA Form 0710

c) DVA Memorandum – Electronic Fingerprints

g. The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

h. The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note:

OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via eQIP).

i. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

j. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) finger print results, training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and, the signed “Contractor Rules of Behavior.” However, the Contractor shall be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management

(OPM).

k. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

l. Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and SubContractor employees and/or termination of the contract for default.

m. Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with

VA.

7.1.3 Security/Privacy: Therefore, SORN shall be covered under and/or published by VA in the Federal Register pursuant to section 552a(e)(4) of the Privacy Act. The records contained in the system of records used in this project are operated by or on behalf of VA by a government Contractor to accomplish a VA function. Consequently, any such Contractor and any employee of such Contractor is considered to be an employee of VA and subject to the criminal penalties contained in 5 U.S.C. 552a(i).

7.2 GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security. The C&A requirements do not apply and a Security Accreditation Package is not required.

7.3 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

7.4 VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/ subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/ subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/ subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. Custom software development and outsourced operations must be located in the U.S.

to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

7.5 INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

VA prohibits the installation and use of personally owned or contractor/subcontractor owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW or contract. All of the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned OE.

7.6 SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/ subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

7.7 LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

7.8 TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness…