Amendment 3 published 10/31/24 to update pickup amouns and CBOC locations on attached B.2 Price/Cost Schedule and D.1 Statment of Work (SOW). These changes are reflected in the green hightlighted areas.
Amendment 2 published 10/30/24 to extend offer due date & clarify information in B.2 Price/Cost Schedule. See 36C25524Q0040_3 for more details.
Amendment 1 published 10/25/24 in regards to Questions & Answers. See 36C25524Q0040_2 for more details.
D.1 STATEMENT OF WORK (SOW) STATEMENT OF WORK Regulated Medical Waste Disposal | VISN Wide 1. REQUIREMENT: Contractor shall furnish all personnel, materials, tools, and equipment necessary to provide removal, transportation and disposal of all regulated medical waste and comply with all current local, state, and federal regulations and in accordance with the statement of work and schedule of services and price. 2. BACKGROUND: VISN 15 Heartland requires removal, disposal, and transportation of all Regulated Medical Waste at all their Medical Centers and Community Based Outpatient Clinics. 3. PERIOD OF PERFORMANCE: This procurement is for a five (5) year Indefinite Quantity Indefinite Delivery (IDIQ) with ordering periods. Ordering Period 1 DECEMBER 1, 2024 through NOVEMBER 30, 2025 Ordering Period 2 DECEMBER 1, 2025 through NOVEMBER 30, 2026 Ordering Period 3 DECEMBER 1, 2026 through NOVEMBER 30, 2027 Ordering Period 4 DECEMBER 1, 2027 through NOVEMBER 30, 2028 Ordering Period 5 DECEMBER 1, 2028 through NOVEMBER 30, 2029 During normal working hours of 8:00 a.m. through 4:30 p.m. from Monday through Friday. Excluding all Federal Holidays. No overtime is authorized at this time. Off-duty hours: Friday through Monday, 4:30 pm 8:00am; Monday through Thursday, 4:30 pm 8:00am. FEDERAL HOLIDAYS New Year s Day Martin Luther King Holiday Presidents day Memorial Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day Juneteenth 4. PLACE OF PERFORMANCE: Contractor shall provide hazardous medical waste disposal for the Department of Veterans Affairs at the following locations: KANSAS CITY Kansas City VA Medical Center 4801 Linwood Blvd. Kansas City, MO. 64128 Pick up frequency for Kansas City, MO shall be monthly (Pick up every weekday). Belton, MO Outpatient Clinic 209 Cunningham Industrial Parkway Belton, MO 64012 Pick up frequency for Belton, MO shall be 4X/monthly. Est. disposal wt. is 30 pounds/monthly. Cameron, MO Outpatient Clinic 1111 Euclid Drive Cameron, MO 64429 Pick up frequency for Cameron, MO shall be 4X/monthly. Est. disposal wt. is 30 pounds/monthly. Excelsior Springs, MO Outpatient Clinic 197 South McCleary Road Excelsior Springs, MO 64024 Pick up frequency for Excelsior Springs, MO shall be 4X/monthly. Est. disposal wt. is 30 pounds/monthly. Louisburg-Paola, KS Outpatient Clinic 501 South Hospital Drive Paola, KS 66071 Pick up frequency for Paola, KS shall be 4X/monthly. Est. disposal wt. is 30 pounds/monthly. Nevada, MO Outpatient Clinic 322 South Prewitt Nevada, MO 64772 Pick up frequency for Nevada, MO shall be 4X/monthly. Est. disposal wt. is 30 pounds/monthly. Warrensburg, MO Outpatient Clinic 702 East Young Street Warrensburg, MO 64093 Pick up frequency for Warrensburg, MO shall be 4X/monthly. Est. disposal wt. is 30 pounds/monthly. Shawnee VA Clinic 6830 Anderson St. Shawnee, KS 66226 Pick up frequency for Shawnee, KS shall be 4X/monthly. Est. disposal wt. is 30 pounds/monthly. Honor Annex 4251 Northern Ave. Kansas City, MO. 64130 Pick up frequency for Honor Annex for Kansas City, MO shall be 4X/monthly. Est. disposal wt. is 30 pounds/monthly. Radiation Therapy Clinic 10500 Mastin Street Overland Park, KS 66212 Pick up frequency for Overland Park, KS shall be 4X/monthly. Est. disposal wt. is 30 pounds/monthly. Columbia Facility Location Quantity Pickup Frequency Unit Removal, disposal and transportation of all Regulated Medical Waste - Harry S. Truman Memorial Veterans Hospital 800 Hospital Drive Columbia, MO 65201 85,000 3X/Weekly Pounds Removal, disposal and transportation of all Regulated Medical Waste 227 lbs 1X/Monthly 10 ea Removal, disposal and transportation of all Regulated Medical Waste 330 lbs 1X/Monthly 16 ea Removal, disposal and transportation of all Regulated Medical Waste- 10 lbs 1X/Monthly 11 ea Removal, disposal and transportation of all Regulated Medical waste 290 lbs 1X/Monthly 19 ea Removal, disposal and transportation of all Regulated Medical Waste 198 lbs 1X/Monthly 13 ea Removal, disposal and transportation of all Regulated Medical Waste- 328 lbs 1X/Monthly 25 ea Removal, disposal and transportation of all Regulated Medical Waste- 328 lbs 1X/Monthly 25 ea POPLAR BLUFF Department of Veterans Affairs John J. Pershing VA Medical Center 1500 N Westwood Blvd Poplar Bluff, MO 63901 Pick up location: Bldg 7 Pick up frequency: Weekly Department of Veterans Affairs Cape Girardeau Healthcare Center (HCC) 711 South Mount Auburn Road Cape Girardeau, MO 63703 Pick up location: Rear entrance of facility Pick up frequency: Bi-Weekly Department of Veterans Affairs Farmington Community Based Outpatient Clinic 1580 W. Columbia Street Farmington, MO 63640 Pick up location: Rear entrance of facility Pick up frequency: Bi-Weekly Department of Veterans Affairs Sikeston CBOC 903 South Kings highway Sikeston, MO 63801 Pick up location: Rear entrance of facility Pick up frequency: Bi-Weekly Department of Veterans Affairs Paragould Community Based Outpatient Clinic 2420 Linwood Drive-Suite 3 Paragould, AR 72450 Pick up location: Rear entrance of facility Pick up frequency: Bi-Weekly Department of Veterans Affairs Pocahontas Community Based Outpatient Clinic 300 Camp Road Pocahontas, AR 72455 Pick up location: Rear entrance of facility Pick up frequency: Bi-Weekly Department of Veterans Affairs West Plains Community Based Outpatient Clinic 1801 E. State Route K West Plains, MO 65775 Pick up location: Rear entrance of facility Pick up frequency: Bi-Weekly ST. LOUIS VA Medical Center Jefferson Barracks # 1 Jefferson Barracks Dr. St. Louis, MO 63125 Pickup at JB, Bldg 93, 1x/weekly VA Medical Center John Cochran 915 N. Grand Blvd. St. Louis, MO 63106 Pickup at JC, Dock of Bldg. l Mon through Fri, 5x/weekly North County CBOC 6854 Parker Rd. Florissant, MO 63033 Pick up frequently: 1x/monthly St. Charles CBOC 2845 Veterans Memorial Pkwy St. Charles, MO 63303 Pick up frequently: 1x/monthly Washington CBOC 1627A Roy Avenue St. Louis, MO 63114 Pick up frequently: 1x/monthly St. Clair CBOC 1190 Fortune Blvd. St. Louis, MO 63122 Pick up frequently: 1x/monthly Manchester Annex 4974 Manchester St. Louis, MO 63110 Pick up frequently: 1x/monthly Washington Annex 2727 Washington St. Louis, MO 63103 Pick up frequently: 1x/monthly Hope Recovery Center 515 N Jefferson Ave. St. Louis, MO 63103 Pick up frequently: 1x/monthly MARION Marion VA Medical Center 2401 West Main Street Marion IL 62959 Pick up frequency 2X/weekly Estimated quantity: 60,000 lbs Community Outpatient Clinics: Owensboro KY Outpatient Clinic 2060 East Parrish Avenue Owensboro, KY. 42303 Pick up frequency for Owensboro shall be 1x/month. Est. disposal wt. is 110pds/monthly. Mayfield KY Outpatient Clinic 1253 Paris Road, Suite A Mayfield KY, 42066 Pick up frequency for Mayfield shall be 1x/month. Est. disposal wt. is 110pds/monthly. Paducah KY CBOC 2620 Perkins Creek Dr Paducah, KY, 42001 Pick up frequency for Paducah shall be 1x/month. Est. disposal wt. is 110pds/monthly. Effingham IL CBOC 1011 Ford Ave. Effingham, IL 62401 Pick up frequency for Effingham shall be 1x/month. Est. disposal wt. is 110pds/monthly. Mt Vernon IL CBOC 4000 South Water Tower Mt. Vernon, IL 62864 Pick up frequency for Mt Vernon shall be 2x/month. Est. disposal wt. is 110pds/monthly. Primary Care Annex Marion IL 3403 Heartland St Marion IL 62959 Pick up frequency for Primary Annex shall be 1x/month. Est. disposal wt. is 110pds/monthly. Evansville Health Care Center 6211 E. Waterford Blvd. Evansville, IN 47715 Pick up frequency for Evansville shall be 4x/month. Est. disposal wt. is 110pds/monthly. Vincennes OPC 1813 Willow St., Suite 6A Vincennes, IN 47591 Pick up frequency for Vincennes shall be 1x/month. Est. disposal wt. is 110pds/monthly. Harrisburg CBOC 608 Rollie Moore Drive Harrisburg, IL 62946 Pick up frequency for Harrisburg shall be 1x/month. Est. disposal wt. is 110pds/monthly. Carbondale V.A. Community Based Outpatient Clinic 1130 East Walnut St. Carbondale, Il. 62901 Pick up frequency for Carbondale shall be 1x/month. Est. disposal wt. is 110pds/monthly. Madisonville KY VA Community Based Outpatient Clinic 99 Stagecoach Road Madisonville, KY 42431 Pick up frequency for Madisonville shall be 1x/month. Est. disposal wt. is 110pds/monthly. COR Kenneth Johnson (618) 997-5311 x158640 EASTERN KANSAS VA Medical Center Topeka Colmery-O Neil Medical Center 2200 Gage Blvd Topeka, KS 66622 1 X Week VA Medical Center Leavenworth Dwight D. Eisenhower Medical Center 4101 South 4th St Trafficway Leavenworth, KS 66048 1 X Week Fort Scott CBOC 902 Horton Street Fort Scott, KS 66701 1 X per month Lawrence CBOC 4821 Quail Crest Place Lawrence, KS 66049 1 X per month Junction City CBOC 1169 South Wind Drive Junction City, KS 66441 1 X per month Saint Joseph CBOC 3302 South Bell Highway, Suite P St. Joseph, MO 64503 1 X per month Kansas City, KS CBOC 9201 Parallel Parkway Kansas City, Kansas 66102 1 X per month Platte City CBOC 2303 Higgins Suite F Platte City, MO 64079 1 X per month WICHITA Robert J Dole VA Medical Center 5500 E. Kellogg Wichita, KS 67218 5XWeekly, estimate 3100lbs per month Hays CBOC 4107 Vine Street Hays, KS 67601 1XMonthly, estimated 46lbs per month Salina CBOC 1410 E Iron Avenue Ste 1 Salina, KS 67401 1XMonthly, estimated 65lbs per month Dodge City CBOC 2201 Summerlon Circle Dodge City, KS 67801 1XMonthly, estimated 10lbs per month Hutchinson CBOC 1625 E. 30th Street Hutchinson, KS 67502 1XMonthly, estimated 44lbs per month Parsons CBOC 1907 Harding Drive Parsons, KS 67357 1XMonthly, estimated 45lbs per month 5. ACRONYMS AND DEFINITIONS: CDR: Contract Discrepancy Report. Report issued by the Government to the contractor to document a supply or service found to be unacceptable during contract performance. CLIN: Contract Line-Item Number. Unit of work (or service) to be performed (or delivered) by the contractor as a pay item. CO: Contracting Officer. A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings. COR: Contracting Officer s Representative. An individual, including a Contracting Officer s Representative (COR), designated and authorized in writing by the contracting officer to perform specific technical or administrative functions. QA: Quality Assurance. Actions taken by the government to assure contracted services meet SOW requirements. QASP: Quality Assurance Surveillance Plan. A written document specifying the method used for surveillance of contractor performance. 6. PERFORMANCE REQUIREMENTS: A Contracting Officer Representative (COR) and/or Alternate Contracting Officer Representative (ACOR) shall be assigned to this procurement and written notification will be provided to the Contractor after award. Scheduling of work performance shall be arranged through the designated COR/ACOR assigned. The Contractor shall provide regulated medical waste removal for the VISN 15 VA Medical Center s and the CBOC s. There will be no additional surcharge for gas, administrative and environmental fees added beyond the contracted monthly rate. Contractor is to provide a copy of medical waste liability insurance. Provide annual employee training program in accordance with the contract statement of work. The Contractor and the Contracting Officer s Representative (COR) for the Medical Center will arrange for a routine (non-emergency) service for each facility based upon volume. The Contractor shall furnish all personnel, materials, tools, and equipment necessary to provide removal, transportation, and disposal of all regulated medical waste and to comply with all current local, state, and federal regulations. Regulated medical waste will consist of isolation waste, cultures and stocks of infectious agents and associated biological human blood and blood products, pathological waste, contaminated sharps, miscellaneous laboratory waste, discarded dressings, and contaminated linen or disposable linen substitutes. VA Medical Center employees at all VISN 15 Heartland Health Care Medical Systems and Community Based Outpatient Clinics: Warrant that the regulated waste presented for disposal will not contain any hazardous or radioactive wastes as defined by an applicable law or regulation. VA employees will ensure all patient information is removed before placing the item in the disposal bag. Containerize and seal the regulated medical waste by placing the waste in approved plastic waste receptacle liners and/or disposable sharps containers that are marked with the international biohazard symbol and the wording, "Infectious Waste," or "Biohazard Waste." Seal the Contractor provided box filled with medical waste and transport the container to the designated storage area for pickup at the times and places agreed upon by the parties. Contractor shall: Provide all VISN 15 Heartland VA Health Care Medical System and Community Based Outpatient Clinics with sufficient amounts of tape, labels and collection containers of approved size and including red waste bags that are sturdy, rigid, leak proof, impervious and have the capability of being sealed. Remove regulated medical waste using only properly permitted and licensed trucks and drivers. Transport the containers by methods and procedures that fully comply with all local, state, and federal rules and regulations. The Contractor shall furnish the Contracting Officer s Representative (COR) with a fully detailed description of the methodology that shall be used to transport, treat, and dispose of the waste. Within five (5) working days from the time the waste reached its destination, Contractor shall provide the Department of Veterans Affairs with a matching completed manifest that includes appropriate destruction information. The manifest will also indicate the poundage of each box picked up. Document numbers and information on the two documents shall match. There shall be final certification by the destination-authorized agent by signature and date that the waste was accepted, and all the information was correct. Contractor shall maintain licenses and/or permits required by Federal, State, City and County laws and regulations. The contractor shall assume full responsibility for compliance with all Federal, State, City and County laws, rules and regulations governing regulated medical waste. Contractor shall provide training, face-to-face or electronic, to Department of Veteran s Affairs staff to ensure that all packaging and containerization are conducted in a manner that is consistent with Department of Transportation (DOT), Department of Veteran s Affairs and Contractor s requirements and expectations. This training must occur no less than every two years in order to maintain training certificates for Department of Veteran s Affairs staff that package the regulated medical waste. TRAINING REQUIREMENTS: Within 30 days of contract award, contractor shall provide a documented In-Service Training Program to participating facility employees that shall include applicable: State and Local Regulations a. Environmental Protection Agency (EPA); Center for Disease Control (CDC); Occupational Safety and Health Administration (OSHA) regulations and standards b. Medical Waste Stream- policies and procedures to include: (1) Identification, segregation, and labeling (2) Collection, handling, and transport (3) Storage, treatment, and disposal/recovery (4) Record keeping/tracking and risk management The contractor shall obtain signatures and issue certificates of completion to all trainees who have successfully completed the training. Signatures and copies of each certificate shall be provided to the Contracting Officer s Representative. Stream Analysis: Within 60 days after completion of training identified above, contractor shall conduct a waste-stream analysis of the participating facilities Regulated Medical Waste. The analysis shall be based on the policies and procedures of the Missouri, Kansas and Illinois Department of Public Health (DPH) regulations, Environment Protection Agency (EPA) recommendations, Occupational Safety and Health Administration (OSHA) standards, Center for Disease Control (CDC) guidelines, and Joint Commission recommendations. The waste stream analysis shall include any suggestions for waste reduction with the Medical Centers. SPECIAL REQUIREMENTS: (APPLIES TO ALL STATIONS and CBOC S) INSPECTION OF PREMISES: Contractors are encouraged to visit the participating facilities to fully inform themselves of the character and conditions under which the service is to be performed. Failure to do so shall in no way relieve the successful offeror from the necessity of furnishing the services as specified in this solicitation without additional cost to the Government. This inspection may be made daily between the hours of 9:00A.M. to 3:00P.M. except Saturdays, Sundays and holidays. INSPECTION OF OFFERORS FACILITIES: The right is reserved to thoroughly inspect and investigate the establishment, facilities, business reputation and other qualifications of any offeror and reject any proposal, irrespective of price, if it shall be administratively determined lacking in any of the essentials necessary to assure acceptable standards of performance. RESPONSIBILITY FOR THE CONTAINERS: The contractor agrees that the participating Government facilities assume no liability for damage that may be done to the waste containers used in the performance of this contract unless it is caused by any act of negligence on the part of a Government employee. LICENSE: The contractor shall be licensed by the state or local authority in those localities where such licenses are required. Where no license is required, the offeror shall furnish with his proposal evidence of satisfactory work performance of work supervision for a period on not less than one year previous to the date of the proposal. LIABILITY AND INSURANCE COVERAGE: Satisfactory insurance coverage is a condition precedent to award of a contract. In general, a successful offeror shall present satisfactory evidence of full compliance with State and local requirements. State approved sources of insurance coverage ordinarily shall be deemed acceptable to the Department of Veterans Affairs installation, subject to timely certification by such sources of the types and limits of the coverage afforded by the sources. EVIDENCE OF COVERAGE: Before commencing work under the contract, the contractor shall furnish to the Contracting Officer a certificate of insurance indicating the coverage outlines in the SUPPLEMENTAL INSURANCE REQUIREMENTS section and containing an endorsement to the effect that cancellation of or any material change in the policies which adversely affect the interest of the Government in such insurance shall not be effective unless a thirty (30) day advance written notice of cancellation or change is furnished to the Contracting Officer AUTHORITY OF OPERATORS: The contractor s operators shall bear at all times the contractor s signed authority designating them as authorized to perform work at the participating facilities under this contract. Only designated operators shall do work under this contract. All drivers of vehicles used in the performance of this contract shall be authorized drivers of such type vehicles and shall carry upon his/her person the necessary operator s and/or chauffeur s license as may be required by the States of Missouri, Kansas, Arkansas. While driving on Government facility grounds, the drivers of vehicles shall fully comply with such speed and safety regulations pertaining to the operation of motor vehicles as medical authorities may issue from time to time. Throughout the contract there may be additional locations added and increase to Regulated Medical Waste pick-ups. Contract Administration Data: All contract administration functions will be retained by the Department of Veterans Affairs. The Contracting Officer will be the only person authorized to approve changes or modify any of the requirements under this contract. The Contractor shall communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer will be authorized to make commitments or issue changes that affect price, quantity, or quality of performance of this contract. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change shall be considered unauthorized, and no adjustment will be made in the contract price to cover any increase in costs incurred because of the change. Personnel a. Non-Personal Services. This is a non-personal services contract. Personnel rendering services under this contract are not subject either by the contract s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the government and its employees. The Government shall not exercise any supervision or control over the contract service providers performing services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government. b. Contractor Compliance with the Immigration and Nationality Act of 1952. The Contractor shall comply with all legal provisions contained in the Immigration and Nationality Act of 1952, As Amended; its related laws and regulations that are enforced by Homeland Security, Immigration and Customs Enforcement and the U.S Department of Labor as these may relate to non-immigrant foreign nationals working under contract or subcontract for the Contractor while providing services to Department of Veterans Affairs patient referrals. Contract Security The C&A requirements do not apply, and a Security Accreditation Package is not required. Also, BAA required. EMERGENCY CALL IN REQUIREMENT: The Contractor shall provide a telephonic method for the facility to call in emergency work orders for the system during any failures. Upon notification of failures the Contractor shall have a qualified technician at the facility within two (2) hours. Contractor shall submit the following plans with their quote: a. A written safety plan that details actions to be taken to protect the staff of the medical centers, contractor, and surrounding communities in the event of any accident spills or leaks that occur while the contractor is performing work under this contract for the Government. b. A written emergency plan that outlines a formalized response to any accident spills or leaks that occur while the contractor is performing work under this contract for the Government. Throughout the contract there may be additional locations added and increase to Regulated Medical Waste pick-ups. REPORT REQUIREMENT: The Contactor shall provide the COR with a copy of the manifest, which includes the generator and transporter information for each load of waste. The manifest shall be provided to the Department of Veterans Affairs each time the waste is removed from the Medical Center and Community Based Outpatient Clinics. Each manifest shall include, but not be limited to, the following information: The report shall contain a minimum of the following items. GENERATOR INFORMATION: NAME, ADDRESS, TELEPHONE NUMBER, DESCRIPTION OF WASTE, DATE OF PICKUP, POUNDAGE OF EACH PICKUP. TRANSPORTER INFORMATION: TRUCK NUMBER, TRANSPORTER NAME, ADDRESS, TELEPHONE NUMBER, DRIVER NAME. DESTINATION INFORMATION: SITE NAME, ADDRESS and TELEPHONE NUMBER. The manifest shall indicate that the waste was picked up at the generator and delivered to the approved destination without incident. The contractor shall provide a report either monthly or quarterly that indicates the total of all waste transported, by type with weights. In addition to the monthly/quarterly report, the contractor shall provide an annual summary report of all waste transported by type with cumulative weights for each month. SAFETY REQUIREMENTS: Contractor shall submit the following plans with their quote: A written safety plan that details actions to be taken to protect the staff of the medical centers, contractor, and surrounding communities in the event of any accident spills or leaks that occur while the contractor is performing work under this contract for the Government. A written emergency plan that outlines a formalized response to any accident spills or leaks that occur while the contractor is performing work under this contract for the Government. Contractor shall ensure all tools and equipment are always secured. Tools and equipment must be removed from open areas or stored in secured location during breaks, lunch, and/or at the end of each workday. All debris must be removed from the facility upon completion of service each day. All personnel are required to wear approved masks when entering or working in any of the facilities buildings. They are to be non-surgical type masks, no cloth or homemade masks (this is for staff and Contractors). This mask is to be worn at all times. Any personnel caught without wearing an approved mask will be escorted out of the facility. Masks are to be worn properly and should fully cover the nose and mouth at all times Masks need to be worn whenever you are within six (6) feet of another person, whether you are outside or inside. This includes riding in carts. Contractor shall ensure proper signage, barriers, and/or blockage of service area is provided where applicable, especially at hoist way doors and clearly visible to ensure patient/employee safety is adhered to. 7. INVOICES: a. Payment will be made upon receipt of a properly prepared detailed invoice, prepared by the Contractor and submitted through Tungsten Network (formerly known as OB10) http://www.tungsten-network.com/us/en/. A properly prepared invoice shall contain: Invoice Number and Date Contractor s Name and Address Accurate Purchase Order Number Supply or Service provided Period Supply or Service Provided Total Amount Due b. Please begin submitting your electronic invoices through the Tungsten Network for payment processing, free of charge. c. If you have questions about the e-invoicing program or Tungsten Network, contact information is as follows:        Tungsten e-Invoice Setup Information: 1-877-489-6135 Tungsten e-Invoice email: VA.Registration@Tungsten-Network.com FSC e-Invoice Contact Information: 1-877-353-9791 FSC e-invoice email: vafsccshd@va.gov Web Address: HTTP://WWW.FSC.VA.GOV/EINVOICE.ASP 8. TERMINATION FOR CONVENIENCE: In accordance with FAR 52.212-4 (l) The Government reserves the right to terminate this contract, or any part hereof, for its sole convenience. 9. RECORDS MANAGEMENT LANGUAGE FOR CONTRACTS: The following standard items relate to records generated in executing the contract and should be included in a typical Electronic Information Systems (EIS) procurement contract: Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract. The Government Agency owns the rights to all data/records produced as part of this contract. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.]. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its Contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules. VHA Supplemental Contract Requirements for Ensuring Adequate COVID-19 Safety Protocols for Federal Contractors (Amended October 25, 2021) Contractor employees who work in or travel to VHA locations must comply with the following: a. Documentation requirements: 1) If fully vaccinated, shall show proof of vaccination. i. NOTE: Acceptable proof of vaccination includes a signed record of immunization from a health care provider or pharmacy, a copy of the COVID-19 Vaccination Record Card (CDC Form MLS-319813_r, published on September 3, 2020), or a copy of medical records documenting the vaccination. 2) If unvaccinated and granted a medical or religious exception, shall show negative COVID-19 test results dated within three calendar days prior to desired entry date. Test must be approved by the Food and Drug Administration (FDA) for emergency use or full approval. This includes tests available by a doctor s order or an FDA approved over-the-counter test. 3) Documentation cited in this section shall be digitally or physically maintained on each contractor employee while in a VA facility and is subject to inspection prior to entry to VA facilities and after entry for spot inspections by Contracting Officer Representatives (CORs) or other hospital personnel. 4) Documentation will not be collected by the VA; contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information. Contractor employees are subject to daily screening for COVID-19 and may be denied entry to VA facilities if they fail to pass screening protocols. As part of the screening process contractors may be asked screening questions found on the COVID-19 Screening Tool. Check regularly for updates. b. Contractor employees who work away from VA locations, but who will have direct contact with VA patients shall self-screen utilizing the COVID-19 Screening Tool, in advance, each day that they will have direct patient contact and in accordance with their person or persons who coordinate COVID-19 workplace safety efforts at covered contractor workplaces. Contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable inform Contractor must immediately notify their COR or Contracting Officer if contract performance is jeopardized due to contractor employees being denied entry into VA Facilities. VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY language FOR Inclusion into CONTRACTS GENERAL Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security. ACCESS to VA INFORMATION AND VA INFORMATION SYSTEMS A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination. VA INFORMATION CUSTODIAL Language Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). If VA determines that the contractor has violated any of the information confidentiality, privacy, security, and other provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. SECURITY INCIDENT INVESTIGATION The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident. LIQUIDATED DAMAGES FOR DATA BREACH Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. Each risk analysis shall address all relevant information concerning the data breach, including the following: Nature of the event (loss, theft, unauthorized access); Description of the event, including: (a) date of occurrence; (b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code; (3) Number of individuals affected or potentially affected; (4) Names of individuals or groups affected or potentially affected; (5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; (6) Amount of time the data has been out of VA control; (7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons) (8) Known misuses of data containing sensitive personal information, if any; (9) Assessment of the potential harm to the affected individuals; (10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and (11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $__37.50__ per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: (1) Notification; (2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; (3) Data breach analysis; (4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; (5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and (6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs. TRAINING All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems: Successfully complete the appropriate VA privacy training and annually complete required privacy training (See below training); and Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required. Failure to complete the mandatory annual training, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete. 7. ADDITIONAL Requirements a. The COR is responsible for coordinating with the Police prior to contractor arrival to identify the names of contractor personnel so that Police can ensure sufficient number of contractor badges are available for issuance prior to beginning work. COR is also responsible for signing out and signing in temporary contractor badges. b. The COR is also responsible for maintaining copies of signed Privacy training for all contractors according to RCS 10-1. c. Any work performed outside of official VA business hours after hours will require escorts. d. Escort duties for un-cleared contractors are strictly limited to government officials, specifically VA employees. At no time are contractors allowed to escort other contractors. VA PRIVACY TRAINING FOR PERSONNEL WITHOUT ACCESS TO VA COMPUTER SYSTEMS OR VA SENSITIVE INFORMATION The Department of Veterans Affairs, VA must comply with all applicable privacy and confidentiality statutes and regulations. One of the requirements in VA is to have all personnel trained annually on privacy requirements. Privacy represents what must be protected by VA in the collection, use, and disclosure of personal information whether the medium is electronic, paper or verbal. This document satisfies the basic privacy training requirement for a contractor, volunteer, or other personnel only if the individual does not use VA sensitive information or protected health information (PHI) in any form such as electronic or paper or have access to any VA computer system such as VA Time and Attendance System (VATAS), Computerized Patient Record System (CPRS), Joint Legacy Viewer (JLV), Veterans Health Information Exchange (VHIE), Compensation and Pension Record Interchange (CAPRI). You will find this training outlines your role and responsibility for protecting VA sensitive information (medical, financial, or educational) that you may incidentally or accidentally see or overhear. If you have direct access to VA sensitive information or access to a VA computer system where there is protected health information such as VaTAS, CPRS, JLV, VHIE or CAPRI you must take Privacy and HIPAA Focused Training (TMS 10203). VA Privacy and Information Security Awareness and Rules of Behavior (TMS 10176) is always required to use or gain access to a VA computer system or VA sensitive information, whether or not protected health information is included. Both trainings are located within the VA Talent Management System (TMS): https://www.tms.va.gov. What is VA Sensitive Information/Data? All Department information and/or data on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes not only information that identifies an individual but also other information whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary information, and records about individuals requiring protection under applicable confidentiality provisions. What is Protected Health Information? The HIPAA Privacy Rule defines protected health information as Individually Identifiable Health Information transmitted or maintained in any form or medium by a covered entity, such as VHA. What is an Incidental Disclosure? An incidental disclosure is one where an individual s information may be disclosed incidentally even though appropriate safeguards are in place. Due to the nature of VA communications and practices, as well as the various environments in which Veterans receive healthcare or other services from VA, the potential exists for a Veteran s protected health information or VA sensitive information to be disclosed incidentally. For example: You overhear a healthcare provider s conversation with another provider or patient even when the conversation is taking place appropriately. You may see limited Veteran information on sign-in sheets or white boards within a treating area of the facility. You may hear a Veteran s name being called out for an appointment or when the Veteran is being transported/escorted to and from an appointment Safeguards You Must Follow To Secure VA Sensitive Information: Secure any VA sensitive information found in unsecured public areas (parking lot, trash can, or vacated area) until information can be given to your supervisor or Privacy Officer. You must report such incidents to your Privacy Officer timely. Don t take VA sensitive information off facilities grounds without VA permission unless the VA information is general public information, i.e., brochures/pamphlets. Don t take pictures using a personal camera without the permission from the Medical Center Director. Any protected health information overheard or seen in VA should not be discussed or shared with anyone who does not have a need to know the information in the performance of their official job duties, this includes spouses, employers or colleagues. Do not share VA access cards, keys, or codes to enter the facility. Immediately report lost or stolen Personal Identity Verification (PIV) or Veteran Health Identification Cards (VHIC), VA keys or keypad lock codes to your supervisor or VA police. Do not use a VA computer using another VA employee s access and password. Do not ask another VA employee to access your own protected health information. You must request this information in writing from the Release of Information section at your facility What are the Six Privacy Laws and Statutes Governing VA? Freedom of Information Act (FOIA) compels disclosure of reasonably described VA records or a reasonably segregated portion of the records to any person upon written request unless one or more of the nine exemptions apply. Privacy Act of 1974 provides for the confidentiality of personal information about a living individual who is a United States citizen, or an alien lawfully admitted to U.S. and whose information is retrieved by the individual s name or other unique identifier, e.g. Social Security Number. Health Insurance Portability and Accountability Act (HIPAA) provides for the improvement of the efficiency and effectiveness of health care systems by encouraging the development of health information systems through the establishment of standards and requirements for the electronic transmission, privacy, and security of certain health information. 38 U.S.C. 5701 provides for the confidentiality of all VA patient and claimant information, with special protection for their names and home addresses. 38 U.S.C. 7332 provides for the confidentiality of drug abuse, alcoholism and alcohol abuse, infection with the human immunodeficiency virus (HIV) and sickle cell anemia medical records and health information. 38 U.S.C. 5705 provides for the confidentiality of designated medical-quality assurance documents. What are the Privacy Rules Concerning Use and Disclosure? You are not authorized to use or disclose protected health information. In general, VHA personnel may only use information for purposes of treatment, payment, or healthcare operations when they have a need-to-know in the course of their official job duties. VHA may only disclose protected health information upon written request by the individual who is the subject of the information or as authorized by law. How is Privacy Enforced? There are both civil and criminal penalties, including monetary penalties that may be imposed if a privacy violation has taken place. Any willful negligent or intentional violation of an individual s privacy by VA personnel, contract staff, volunteers, or others may result in such corrective action as deemed appropriate by VA including the potential loss of employment, contract, or volunteer status. Know your VA/VHA Privacy Officer and Information Systems Security Officer. These are the individuals to whom you can report any potential violation of protected health information or VA sensitive information, or any other concerns regarding privacy of VA sensitive information. YOU ARE RESPONSIBLE FOR PROTECTING THE CONFIDENTIAL INFORMATION OF OUR VETERANS __________________________________________ ________________ Employee (Print Name) Date __________________________________________ Employee Signature __________________________________________ Print Name of Contract Agency, if contractor __________________________________________ Print Name of VHA Department/Supervisor/Contracting Officer PROVIDE A COPY OF THIS FORM TO YOUR SUPERVISOR/CONTRACTING OFFICER
