Loren Data's SAM Daily™

FBO DAILY - FEDBIZOPPS ISSUE OF MARCH 30, 2014 FBO #4509
DOCUMENT

Q -- 459-14-1-2828-0015/ VHA_285371/ EMERGENCY CONTRACT HOUSING - Attachment

Notice Date

3/28/2014
 

Notice Type

Attachment
 

NAICS

623220 — Residential Mental Health and Substance Abuse Facilities
 

Contracting Office

Department of Veterans Affairs;VA Sierra Pacific Network (VISN 21);VA Northern California HealthCare System;5342 Dudley Blvd. Bldg 98 (NCO 21);McClellan CA 95652-1012
 

ZIP Code

95652-1012
 

Solicitation Number

VA26114R0422
 

Response Due

3/31/2014
 

Archive Date

5/30/2014
 

Point of Contact

Michael Dean Dupalo
 

E-Mail Address

MICHAEL.DUPALO@VA.GOV
(michael.dupalo@va.gov)
 

Small Business Set-Aside

N/A
 

Description

B.2 Price/Cost Schedule Item Information ITEM NUMBERDESCRIPTION OF SUPPLIES/SERVICESQUANTITYUNITUNIT PRICEAMOUNT ____________________________________ GRAND TOTAL__________________ PRICE SCHEDULE AND SERVICES BASE YEAR - April 1, 2014 ~ September 30, 2014 The following rates are for provision of Temporary Emergency Shelter for Homeless Veterans, in Oahu near the Honolulu area: CLIN No.Services UnitEstimated QuantityPrice Per UnitTotal Estimated Cost 0001Temporary Emergency Beds EA1830 Total for Base Year $________________________ OPTION YEAR 1 - October 1, 2014 ~ September 30, 2015 CLIN No.SUB CLIN No.Services UnitEstimated QuantityPrice Per UnitTotal Estimated Cost 1001NoneTemporary Emergency Beds EA3600 Total for Option Year 1 $________________________ OPTION YEAR 2 - October 1, 2015 ~ September 30, 2016 CLIN No.SUB CLIN No.Services UnitEstimated QuantityPrice Per UnitTotal Estimated Cost 2001NoneTemporary Emergency Beds 3600 Total for Option Year 2 $________________________ SUM TOTAL FOR BASE AND ALL OPTION YEARS$___________________________ Estimated Quantities - All quantities listed herein are estimated annual quantities. The Government is not obligated to purchase any specified amount of services under this contract, but will be obligated to make payment for all services requested and received in the quantities and of the quality requested. The Government does not guarantee or imply that any fixed number of orders/referrals for services will be placed under the resultant contract. B.3 Delivery Schedule ITEM NUMBERQUANTITYDELIVERY DATE 00011830.00 ITEM NUMBERQUANTITYDELIVERY DATE 10013600.00 ITEM NUMBERQUANTITYDELIVERY DATE 20013600.00 VA Pacific Health Care System Health Care for Homeless Veterans EMERGENCY CONTRACTED HOUSING STATEMENT OF WORK Housing First/Dry House* 1. Emergency Contracted Housing/Housing First/Dry House The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract. This Veteran Health Administration (VHA) program provides emergency short term housing to eligible Veterans through contracted agencies (contractor). The purpose of this housing is to provide needed stability while additional short and long term supports are identified and accessed in conjunction with the Veteran's identified goals and wishes. Substance/Alcohol abstinence is expected. 2. Eligibility and Duration A. Homeless: To be eligible for placement in a resident, all Veterans must be homeless or at imminent risk of becoming homeless and must be eligible and registered for VA services. More specifically, before contractors can bill for services provided to a Veteran, they must verify thru the submission of a completed VA homelessness assessment, called a "HOMES assessment" within the previous 30 days. This serves as verification of homelessness. B. Denial: If denied eligibility/admission to the program the Veteran must be explained in writing with copies to VA. C. Open Beds: The contractor shall make every effort to keep the contracted number of beds available for Veterans. D. Length of Stay: The contractor shall furnish services to the beneficiaries for whom such care is specifically authorized by VHA for the period not to exceed 75 days. An extension will be considered after 75 days which will require justification and approval from the Emergency Housing Coordinator, subject to the availability of funds. It is understood that the type of Veterans to be cared for under this contract will require care and treatment services over and above the level of room and board. E. Informed Consent: The contractor shall utilize the VA material regarding Releases of Information, Emergency Housing Admissions form, Veteran Rights and Responsibility, the Housing Support Plan and other information as needed. The contractor may also utilize admission and other forms that are specific to their agency. 3. Services to be provided The contractor shall furnish each Veteran authorized for care under this contract with the following basic services: A.Residential Room and Board 1.Residential Rooms - The environment shall be clean, in good repair and free of rodent and insects. Bedroom and bathroom space be appropriate and shall be of sufficient size as determined by VHA. Each resident shall be provided with a bed and frame, bed linens, and towels. Single bedrooms shall accommodate no more than 2 beneficiaries, unless specifically authorized by VHA. Bathrooms (toilets, basins and showers) will be located within the living space or located within a reasonable distance on the same floor of the living space. Showers and toilets must be kept clean. A secure space for belongings off the floor, example includes dresser or cabinets for personal clothing and effects shall be provided. In addition privacy shall be provided to the resident. Common area space shall be equipped with seating and accessible to all residents. 2.Meals - The contractor shall provide nutritious meals. Food shall be prepared, served and stored under sanitary conditions. Unless deemed inappropriate for the facility by VHA the facility shall provide storage space in an onsite refrigerator for Veterans to store personal food. The facility shall establish and maintain sanitary procedures for washing dishes, cleaning equipment and work areas, and disposing of waste. At least three nutritious meals or their equivalent shall be served daily at regular times with not more than a 14 hour span between evening meal and breakfast of the following day. Snacks of nourishing quality, i.e. fruits, shall be offered between meals or bedtime. 3.Laundry - Laundry facilities shall be available on site for residents to do their own laundry. B. Support Services 1. Transportation - The contractor shall assist the Veteran to scheduled meetings and appointments through the provision of transportation or secure public transportation for the beneficiary thru the provision of bus passes. 2. On site rules and regulations - The contractor shall provide residents at the time of admission the rule and regulations for program participants who shall include at minimum the admissions process, rights and responsibilities, response to rule infractions, discharge criteria, process for complaints and other program expectations. VHA shall be provided with a copy of these rules and regulations. 3. Staffing- The contractor shall employ sufficient staff and other personnel to carry out the policies and procedures of the program. There will be, at a minimum, an employee on duty on the premises, or residing at the program and available for emergencies, 24 hours a day, 7 days a week. All contractor staff providing services to Veterans under this contract must undergo an appropriate background investigation. D. Program Service 1. Case Management - The contractor shall assign a case worker as the primary contact for the Veteran as well as the VHA representative. This case worker will, in conjunction with the program participant and the VHA representative, develop a Housing Support Plan (HSP) which outlines the planned services and supports which will assist the participant in their efforts to secure permanent housing. The extent of service provision in the HSP will depend greatly on the Veteran's desires, wishes and their perceived motivation. The case worker provided may include but not be limited to the following: a.Provide direct assistance supporting the Veteran's access to affordable, supported, senior, or other housing options using the Veteran's, program's, community or VA resources. b.Provide direct assistance supporting the Veteran's accessing eligible financial and supportive programs i.e. SS, SSDI, General Assistance, Food Stamps, VA service connected benefits, etc. and as needed secure and assist in application preparation and/or transportation to benefit site. c.Provide where identified direct support for the Veteran's coordination, referral and attendance at PTSD and substance programs either at VA or at other programs. d.Facilitate the Veteran's attendance at medical and mental health programs at VA by assuring awareness of program scheduling and transportation as needed. e. Where appropriate support the Veteran to connect with peers and their family. f. Provide direct discharge planning support by assisting the Veteran's transition to next environment. g. Communicate with the VHA representative through the regular submission of a summary and/or meetings which address the Veteran's progress of the Housing Support Plan or on issues that may arise. E. Onsite Support Services - The contractor shall provide supportive services to individuals who are receiving mental health and/or substance use therapies. This support will be determined by the individual resident in the HSP. These services may include individual and group support to reinforce or process existing therapeutic services provided by VA or other service providers. 4. Administrative A. Billing - Unless specifically excluded in the contract, the per diem rate established will include the services listed in this document and will also include all services or supplies normally provided other residents by the facility without extra charge. Payments made by the VA under this contract shall constitute the TOTAL cost of care and housing of the homeless Veterans. If a beneficiary is admitted to and discharged from the program on the same calendar day, payment will not be authorized. Extended absences of the patient from the facility will not be reimbursed unless authorized by the Emergency Housing Coordinator. B. Records - The contractor shall make available to the VA, documentary information deemed necessary by the VA to conduct utilization review audits for the mandated national evaluation study as required by Section 2 of Public Law 100-6; to verify quality of patient care for Veterans, to assure confidentiality of patient care for Veterans, to assure confidentiality of patient record information and to determine the completeness and accuracy of financial records. The facility shall maintain an individual client record on each Veteran admitted under this contract. The facility shall comply with the requirements of the "Confidentiality of Alcohol and Drug Abuse Patient" (38 CFR, Part II) and the "Confidentiality of Certain Medical Records" (38 USC 4132). In addition contractor shall comply with standards of practice for record storage and confidentiality set forth in the Commission on Accreditation of Rehabilitation Facilities (CARF). All case records shall be secured and confidential. Records will be made available on a need-to-know basis to appropriate VA staff members involved with the treatment program of the Veteran concerned. The files shall include: 1. Reasons for referral. 2. All essential identifying data relevant to the resident including a weekly progress reports or notes, and documentation of any case management interventions or patient care conferences. 3. Where appropriate copies of any medical prescriptions issued by physicians, including orders, if any, for medications to be taken. 4. Final summaries on each resident who leaves the program, to include reasons for leaving, the resident's future plans, and follow-up locator information. 5. Incident Reports: The contractor shall notify the authorizing VHA representative immediately of any incident involving Veterans residing in the residential program. The contractor shall provide the VHA representative with a copy of the incident report within 24 hours. C. Reporting- The contractor shall comply with the reporting requirements as identified by the VHA representative. This will include a monthly submission on the progress of the Veteran on their HSP and the case management activity provided. D. Fire, Safety, and Sanitation Practices - Facilities shall conform to the standards of the Life Safety Code, National Fire Protection Association #101, Chapters 10 and 11. For additional information, or to obtain copies, contact NFPA: http://www.nfpa.org, NFPA Headquarters address: National Fire Protection Association, 1 Batterymarch Park, Quincy, MA. 02269, Phone: 617-770-0700. The facility shall meet the requirements of Public Law 100-336, 42 USC 12101-12213, and Americans with Disabilities Act pertaining to handicapped accessibility in effect on the date of contract award. Facility shall also conform to the fire and safety code imposed by the State which adequately protects residents. In addition the contractor facility must also meet fire safety requirements as follows: a.All residents in the facility must be mentally and physically capable of leaving the building unaided in the event of an emergency. b.Fire exits drill must be held at least quarterly. Residents must be instructed in evacuation procedures when the primary and /or secondary exits are blocked. A written fire plan for evacuation in the event of fire shall be developed and reviewed annually. The plan shall outline the duties, responsibilities and actions to be taken by staff and residents in the event of a fire emergency. This plan shall be implemented during fire exit drills. c.A written policy regarding tobacco smoking in the facility shall be established and enforced. d.Portable fire extinguishers shall be installed at the facility. Use NFPA 10, Portable Fire Extinguishers, as guidance in selection and location requirements of extinguishers. e.Requirements for fire protection equipment and systems shall be in accordance with NFPA 101 as it pertains to the type and size of the facility. All fire protection systems and equipment, such as the fire alarm system (if required), smoke detectors, and potable extinguishers, shall be inspected, tested and maintained in accordance with the applicable NFPA fire codes and the results documents. f.The annual inspection by a VA team shall include a fire and safety inspection conducted at the facility unless a review of past Department of Veteran Affairs inspections or inspections made by the local authorities indicates that a fire and safety inspection would not be necessary, in which case the fire and safety inspection may be waived by the VA. 5. Commission on Accreditation of Rehabilitation Facilities (CARF): While not required facilities are encouraged to be accredited by CARF. Nevertheless, CARF standards do apply and the facility will be required to authorize their compliance by sign off. 6. VA Patient's Bill of Rights - The contractor shall comply with the VA Patient's Bill of Rights as set forth in Section 17.34a, Title 38, Code of Federal Regulations. 7. Facility Requirements - It is the responsibility of the contractor to properly maintain its facility and the VA shall have no responsibility for paying or reimbursing the contractor for such expenses. The contract facility must: a. Have a current occupancy permit issued by the local and state government in the jurisdiction where the facility is located. b. Be in compliance with existing standards of State safety codes and local, and/or State health and sanitation codes. c. Be licensed under State or local authority. d. Where applicable, be accredited by the State. e. Be kept clean, free of bed bugs, dirt, grime, mold, or other hazardous substances that detract from a healthy environment. f. Be equipped with first aid equipment and an evacuation plan in case of emergency. g. Have windows and doors that can be opened and closed in accordance with manufacturer standard. 8. Inspection of Facility and Program A. Pre-inspection - Prior to the award of a contract and annually during the contract term the VHA representatives including a Facilities Management Safety Officer plus other subject matter experts as determined necessary by the Homeless Program Manager, shall conduct a survey of the contractor's facilities to be used to provide Veterans' food, shelter, and services. This is to assure the facility provides quality care in a safe environment. Inspections may also be carried out at such other times as deemed necessary by the Department of Veteran Affairs. The contractor will be advised of the findings of the inspection team. If deficiencies are noted during any inspection, the contractor will be given a reasonable time to take corrective action and to notify the VHA representative that the corrections have been made. A contract will not be awarded until noted deficiencies have been made and eliminated. Failure by the contractor to take corrective action within a reasonable time will be reported to the VA contracting officer. If corrections are not made to the satisfaction of the VA, the contracting officer will consult with the appropriate officials so that suitable arrangements can be made to discontinue plans to award a contract, or in the case of an existing contract, to discharge or transfer Veterans and to terminate the existing contract, as appropriate. B. Inspection Conformity- The inspection of the contractor facilities will include inspection for conformity to the current Life Safety Code and will also include the following: a. General observation of residents to determine if they maintain an acceptable level of personal hygiene and grooming. b. Assessment of whether the facility meets applicable fire, safety and sanitation standards. c. Determine whether the facility's surroundings are suitable and conductive to social interaction and to the fullest development of the resident's rehabilitative potential. d. Observation of facility operations to see if appropriate organized activity programs are available during waking hours (including evenings) and degree to which a high level of activity is observed in the facility, such as personal support, physical activities, assistance with health and personal hygiene. e. Seeking evidence of facility-community interaction, demonstrated by the nature of scheduled activities or by information about resident contacts from community providers and supports. f. Observation of staff behavior and interaction with residents to determine if the convey an attitude of genuine concern and caring. g. Inspecting the type of meals and other nutrition provided to residents to see if it is appetizing, nutritionally adequate and are provided in a setting which encourages social interaction, and if nutritious snacks between meals and bedtime are available for those requiring or desiring additional food, when it is not medically contraindicated. h. Making a spot check of Veteran records to ensure accuracy with respect to Veteran's length of stay and services provided to the Veteran consistent with their HSP. All Department of Veteran Affairs reports of inspections of residential facilities providing contracted emergency housing services will be made available to all government agencies charged with the responsibility of licensing or otherwise regulating or inspecting such facilities 9. Contract Changes/Technical Directions The VHA Contracting Officer is the only person authorized to approve changes or modify any of the requirements of a contract. The contractor shall communicate with the VHA Contracting on all matters pertaining to contract administration. Only the contracting officer in concert with the VHA representative shall consult on any changes or issues that shall affect price, quantity or quality of performance of this contract. *Dry House - (Abstinence-Expected) - Appropriate for individuals, with co-morbid substance disorder who choose abstinence, and who want to live in a sober group setting to support their achievement of abstinence. Such homes may range from typical staffed group homes to supported independent group sober living. In all of these settings, any substance use is a program violation, but consequences are usually focused and temporary, rather than "one strike and you're out". VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE FOR INCLUSION INTO CONTRACTS, AS APPROPRIATE 1. GENERAL Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security. 2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness. d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor. e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination. 3. VA INFORMATION CUSTODIAL LANGUAGE a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements. c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract. e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated. i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request. j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response. k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response. l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR. 4. SECURITY INCIDENT INVESTIGATION a. The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. b. To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident. 5. LIQUIDATED DAMAGES FOR DATA BREACH a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. b. The contractor/subcontractor shall provide notice to VA of a "security incident" as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. c. Each risk analysis shall address all relevant information concerning the data breach, including the following: (1) Nature of the event (loss, theft, unauthorized access); (2) Description of the event, including: (a) date of occurrence; (b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code; (3) Number of individuals affected or potentially affected; (4) Names of individuals or groups affected or potentially affected; (5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; (6) Amount of time the data has been out of VA control; (7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); (8) Known misuses of data containing sensitive personal information, if any; (9) Assessment of the potential harm to the affected individuals; (10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and (11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised. d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: (1) Notification; (2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; (3) Data breach analysis; (4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; (5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and (6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs. 6. SECURITY CONTROLS COMPLIANCE TESTING On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day's notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time. 7. TRAINING a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems: (1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems; (2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training; (3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and (4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document - e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.] b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required. c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete
 

Web Link

FBO.gov Permalink
(https://www.fbo.gov/spg/VA/VANCHCS/VANCHCS/VA26114R0422/listing.html)
 

Document(s)

Attachment
 

File Name: VA261-14-R-0422 VA261-14-R-0422.docx (https://www.vendorportal.ecms.va.gov/FBODocumentServer/DocumentServer.aspx?DocumentId=1280755&FileName=VA261-14-R-0422-000.docx)

Link: https://www.vendorportal.ecms.va.gov/FBODocumentServer/DocumentServer.aspx?DocumentId=1280755&FileName=VA261-14-R-0422-000.docx

 

File Name: VA261-14-R-0422 P07 WD 05-2153 6-25-2013.txt (https://www.vendorportal.ecms.va.gov/FBODocumentServer/DocumentServer.aspx?DocumentId=1280756&FileName=VA261-14-R-0422-001.txt)

Link: https://www.vendorportal.ecms.va.gov/FBODocumentServer/DocumentServer.aspx?DocumentId=1280756&FileName=VA261-14-R-0422-001.txt

 

Note: If links are broken, refer to Point of Contact above or contact the FBO Help Desk at 877-472-3779.
 

Place of Performance

Address: Island of Oahu;County of Honolulu, Hawaii

Zip Code: 96707
 

Record

SN03322904-W 20140330/140328234059-3215d22c14877bf1efae19184b98b2e4 (fbodaily.com)
 

Source

FedBizOpps Link to This Notice
(may not be valid after Archive Date)

---

| FSG Index  |  This Issue's Index  |  Today's FBO Daily Index Page |