DC10--Intent to Sole source notification

NOTICE OF INTENT TO SOLE SOURCE: The Department of Veterans Affairs, Network Contracting Office 1 intends to award a Limited Source, firm-fixed price contract to Healthinfonet to provide Health information Exchange Network for use by the VA Maine Healthcare System. This system allows authorized users for patient treatment to connected with other Health care Maine providers in realtime. The period of performance will be one year, with four option years. This contract action is for services for which the Government intends to solicit from only one Source under the authority of FAR 13.106-1, Single Source Awards. The NAICS code for this procurement is 518210- Computing infrastructure providers, data processing, web hosting, and related services size standard $40.0 Mil.

THIS NOTICE OF INTENT IS NOT A REQUEST FOR COMPETITIVE QUOTES. However, interested parties may identify their interest and capability in response to this requirement by November 20, 2024 at 4:30 PM Eastern Standard Time (EST). The Department of Veterans Affairs will NOT be responsible for any costs incurred by interested parties in responding to this notice of intent. Only written responses from responsible sources will be considered. Any prospective contractor must be registered in the System for Award Management (SAM) to be eligible for award. Interested parties are encouraged to furnish information by email only with RESPONSE TO INTENT TO SOLE SOURCE Healthinfonet in the subject line. All documents submitted, will not be returned. All interested parties shall submit clear and convincing documentation demonstrating their capabilities to satisfy the requirements listed above to Contract Specialist, James Moore at James.Moore14@va.gov. The capability documentation should include general information and technical background describing in detail the prospective contractor's capabilities and experience that will demonstrate the ability to support these requirements.

Statement of Work

A.3 Statement of Work

1.0 INTRODUCTION With the enactment of the American Recovery and Reinvestment Act of 2009 (ARRA) the healthcare community was required to standardize health records information among all healthcare providers. State of Maine has partnered with HealthInfoNet to provide their connectivity between hospitals and healthcare providers to maintain continuity of care.

2.0 BACKGROUND - With the enactment of the American Recovery and Reinvestment Act of 2009 (ARRA) and within it the Health Information Technology for Economic and Clinical Health Act (HITECH), the Maine healthcare community was required to standardize health records information among all healthcare providers.

3.0 SCOPE Vendor shall provide Health Information Exchange Network for use by VA Maine Healthcare System (VMHCS) authorized users for patient treatment that will connect with other healthcare providers in Maine. This includes both Togus VA and CBOC locations.

4.0 APPLICABLE DIRECTIVES The network must be compliant with the Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009.

5.0 PERFORMANCE REQUIREMENTS In addition to requirements listed in section 3.0, the vendor will supply the following:

Provision of the Network. Vendor shall provide and maintain the Health Information Exchange Network and will provide VMHCS with train the trainer training as reasonably necessary with respect to use of the Network.

License Grant. VMHCS shall have a limited, non-exclusive, non-transferable right and license to allow its Authorized Users to access and use the Information stored on the Network on a view only basis in accordance with the terms and conditions hereof.

VMHCS Access for Treatment. VMHCS and its Authorized Users shall have access to all Information pertaining to an Individual which is reasonably necessary for Treatment of such Individual by VMHCS

VAMC VMHCS for Research and Other Purposes. VMHCS will not access, use or disclose Information stored on the Network for a research purpose, as research is defined at 42 C.F.R. §46.102(d).

Access to Information By Authorized Users. VMHCS will designate Authorized Users who may access the Network to retrieve Information for the Treatment of patients. VMHCS will provide lists of such Authorized Users through e-mail, hard copy, or facsimile to Vendor upon request.

Information. Any information obtained from the Network will be kept confidential and secure in compliance with the Privacy and Security Rules and all other applicable federal, state, and local laws, statutes and regulations. VMHCS will report promptly to Vendor any breach of the confidentiality or security of the Information of which [he/she/it] becomes aware.

Disclosure of VMHCS Business and Proprietary Data. No information which, by its nature, should be reasonably considered proprietary to, VMHCS ( Confidential Information ) will be disclosed in an identifiable form without the prior written permission of the VMHCS. Any disclosure of such Confidential Information or use of such Confidential Information for purposes outside the scope of this Agreement shall be cause for immediate termination of this Agreement.

6.0 DELIVERY SCHEDULE Network shall be available for use at all times by authorized users.

6.1 PROGRESS AND COMPLIANCE - VMHCS will ensure that all Authorized Users receive appropriate training, comply with Network Access Policy, access and use information solely for purposes of patient treatment, hold all passwords confidential, participate in mutually agreed upon efficacy / usefulness studies of the network.

7.0 REFERENCES

American Recovery and Reinvestment Act of 2009 (ARRA)

VHA Handbook 6500.6.

VA ACQUISITION REGULATION SOLICITATION PROVISION AND CONTRACT CLAUSE (Handbook 6500.6, Appendix B)

NOTE: This clause will undergo official rule making by the Office of Acquisitions and Logistics. The below language will be submitted for public review through the Federal Register. The final wording of the clause may be changed from what is outlined below based on public review and comment. Once approved, the final language in the clause can be obtained from the Office of Acquisitions and Logistics Programs and Policy.

1. SUBPART 839.2 INFORMATION AND INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

839.201 Contract clause for Information and Information Technology Security:

Due to the threat of data breach, compromise or loss of information that resides on either VA-owned or contractor-owned systems, and to comply with Federal laws and regulations, VA has developed an Information and Information Technology Security clause to be used when VA sensitive information is accessed, used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media).

In solicitations and contracts where VA Sensitive Information or Information Technology will be accessed or utilized, the CO shall insert the clause found at 852.273-75, Security Requirements for Unclassified Information Technology Resources.

2. 852.273-75 - SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES (INTERIM- OCTOBER 2008)

As prescribed in 839.201, insert the following clause:

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

(END OF CLAUSE)

Records Management items:

Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

The Government Agency owns the rights to all data/records produced as part of this contract.

The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE FOR

INCLUSION INTO CONTRACTS, AS APPROPRIATE (Handbook 6500.6, Appendix C)

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be

subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks

as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontrator shall request logical (technical) or physical access to VA

information and VA information systems for their employees, subcontractors, and affiliates only

to the extent necessary to perform the services specified in the contract, agreement, or task

order.

b. All contractors, subcontractors, and third-party servicers and associates working with

VA information are subject to the same investigative requirements as those of VA appointees

or employees who have access to the same types of information. The level and process of

background security investigations for contractors must be in accordance with VA Directive

and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations,

Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid

security clearance. National Industrial Security Program (NISP) was established by Executive

Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the

classified information in their possession while performing work on contracts, programs, bids,

or research and development efforts. The Department of Veterans Affairs does not have a

Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security

Clearance must be processed through the Special Security Officer located in the Planning and

National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S.

to the maximum extent practical. If such services are proposed to be performed abroad and

are not disallowed by other VA policy or mandates, the contractor/subcontractor must state

where all non-U.S. services are provided and detail a security plan, deemed to be acceptable

by VA, specifically to address mitigation of the resulting problems of communication, control,

data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when

an employee working on a VA system or with access to VA information is reassigned or leaves

the contractor or subcontractor s employ. The Contracting Officer must also be notified

immediately by the contractor or subcontractor prior to an unfriendly termination.

VA HANDBOOK 6500.6 MARCH 12, 2010

APPENDIX C

C-2

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance

or administration of this contract or information developed by the contractor/subcontractor in

performance or administration of the contract shall be used only for those purposes and shall

not be used in any other way without the prior written agreement of the VA. This clause

expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data

- General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the

contractors/subcontractor s information systems or media storage systems in order to ensure

VA requirements related to data protection and media sanitization can be met. If co-mingling

must be allowed to meet the requirements of the business need, the contractor must ensure

that VA s information is returned to the VA or destroyed in accordance with VA s sanitization

requirements. VA reserves the right to conduct on site inspections of contractor and

subcontractor IT resources to ensure data security controls, separation of data and job duties,

and destruction/media sanitization procedures are in compliance with VA directive

requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not

destroy information received from VA, or gathered/created by the contractor in the course of

performing this contract without prior written approval by the VA. Any data destruction done on

behalf of VA by a contractor/subcontractor must be done in accordance with National Archives

and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records

and Information Management and its Handbook 6300.1 Records Management Procedures,

applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media

Sanitization. Self-certification by the contractor that the data destruction requirements above

have been met must be sent to the VA Contracting Officer within 30 days of termination of the

contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use,

disclose and dispose of VA information only in compliance with the terms of the contract and

applicable Federal and VA information confidentiality and security laws, regulations and

policies. If Federal or VA information confidentiality and security laws, regulations and policies

become applicable to the VA information or information systems after execution of the

contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after

execution of this contract, the parties agree to negotiate in good faith to implement the

information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as

authorized and necessary to perform the terms of the agreement or to preserve electronic

information stored on contractor/subcontractor electronic storage media for restoration in case

any electronic equipment or data used by the contractor/subcontractor needs to be restored to

an operating state. If copies are made for restoration purposes, after the restoration is

complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality,

privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold