Document Shredding Services Boston VAMC
(i) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued.
(ii) The solicitation number is 36C24119Q0163 and the solicitation is issued as a request for quotation (RFQ).
(iii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2019-01.
(iv) This requirement is being issued as a Veteran Owned Small Business set aside. The associated NAICS code is 561990 with a size standard of $11Million.
(v) The Government intends to award a firm-fixed priced award for 12 months (07/01/2019-06/30/2020) with four (4) twelve-month options. The Contractor shall provide all labor, supervision, material, equipment, and travel to provide document destruction services for Government- provided documents, containing sensitive confidential and medical records at the VAMC Boston and other clinics throughout MA as listed in the Performance Work Statement. Please see the Performance Work Statement, Price Schedule, and Evaluation below for full requirement details and pricing submission.
(vi) The Contractor shall provide document destruction services for Government documents containing sensitive, confidential and medical records. Destruction of patient privacy information shall be accomplished at the Boston VA Medical Center using a vehicle equipped for mobile shredding. Please see the attached Performance Work Statement for a full description of the requirement.
(vii) The Place of Performance is the Boston VA Medical Center (addresses below) and several VA Clinics through MA (see Performance Work Statement). The period of performance shall be 12 months with four (4) twelve-month options.
Brockton VAMC 940 Belmont Street, Brockton, MA 02301
West Roxbury VAMC 1400 VFW Parkway, West Roxbury, MA 02132
Jamaica Plain VAMC 150 South Huntington Avenue, Jamaica Plain, MA 02130
(viii) Provision at 52.212-1, Instructions to Offerors Commercial Items (OCT 2018), applies to this acquisition in addition to the following addenda s to the provision:
52.252-1 Solicitation Provisions Incorporated by Reference (FEB 1998);
52.204-7 System for Award Management (OCT 2018)
52.204-16 Commercial and Government Entity Code Reporting (JUL 2016)
52.209-7 Information responsibility Matters (Oct 2018)
52.216-1 Type of Contract (APR 1984);
52.217-5 Evaluation of Options (JUL 1990);
52.232-2 Service of Protest (Sept 2006)
852.233-70 Protest Content/Alternative Dispute Resolution (OCT 2018)
852.233-71 Alternate Protest Procedure (OCT 2018)
852.252-70 Solicitation Provisions or Clauses Incorporated by Reference (JAN 2008)
852.270-1 Representative of Contracting Officers (JAN 2008)
(ix) Provision at 52.212-2, Evaluation -- Commercial Items (OCT 2014), applies to this requirement.
Submission of Quotes:
(1) Quotes shall be received on or before the date and time specified in Section (xv) of this solicitation. We will not consider any quote that we receive after the deadline unless we receive it before we issue a purchase order; it is in the best interest of the Government and it will not delay our purchase.
(2) Quotes shall be submitted electronically via email to Tammy.Davis6@va.gov.
(3) Quote Format: The submission should be clearly indexed and logically assembled in order of the evaluation criteria below. The Contractor shall include its company name, address, DUNS and Cage Code.
(4) Questions shall be submitted to the Contract Specialist in writing via e-mail. Oral questions will not be accepted due to the possibility of misunderstanding or misinterpretation. The cut-off date and time for receipt of questions is 3/20/2019 at 12:00 PM EST. Questions received after this date and time may not be answered. Questions will be answered in a formal amendment to the solicitation so all interested parties can see the answers.
(5) Evaluation Process:
Award will be made to the best value, as determined to be the most beneficial to the Government. Please read each section below carefully for the submittals and information required as part of the evaluation. Failure to provide the requested information below shall be considered non-compliant and your quote could be removed from the evaluation process.
Quotes shall be evaluated under FAR Part 13.106-2(b) -- Evaluation of Quotations or Offers. Therefore, the Government will not determine a competitive range, conduct discussions with all contractors, solicit final revised quotes, or use other techniques associated with FAR Part 15. The Contracting Officer will conduct a comparative evaluation of quotes in accordance with FAR 13.106-2 (b).
The Government will award a contract resulting from this solicitation to the responsible quoter whose quote conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate quotes:B
Price: The Vendor shall complete the Price Schedule (attached) with proposed contract line item prices inserted in appropriate spaces.
Past Performance: Provide (3) references of work, similar in scope and size with the requirement detailed in the Performance Work Statement. References must include contact information; brief description of the work completed, and contract # (if relevant).B Please utilize Attachment Past Performance Worksheet for your references and please submit as part of your quote submission (attached worksheet maybe used but is not required). References may be checked by the Contracting Officer to ensure your company is capable of performing the Statement of Work.B The Government also reserves the right to obtain information for use in the evaluation of past performance from any and all sources to include PPIRS.
Technical: The vendor s quote shall be evaluated to determine if the organization has the experience and capabilities to provide the requested services in accordance with the Performance Work Statement in a timely efficient manner.B
Contractor shall demonstrate its experience to meet all requirements stated in the PWS.
If the contractor is not in the local area and intends to self-perform, it shall describe how it will accomplish the document shredding in MA.
If you are planning to sub-contract some or all this work, please provide the name and address(s) of all subcontractor(s), a description of the planned subcontracting effort, and the subcontractor s experience to meet the requirements of the PWS.
Options: Except when it is determined in accordance with FAR 17.206(b) not to be in the Government s best interests, the Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. Evaluation of options will not obligate the Government to exercise the option(s). The Government will evaluate prices for the option under FAR 52.217-8B by using the last year s option prices to calculate the price for six months of effort, and adding that amount to the base and other option years to arrive at the total.
(x) Please include a completed copy of the provision at 52.212-3, Offeror Representations and Certifications (OCT 2018) -- Commercial Items, with your offer via the SAM.gov website or a written copy. Unless exempted by the Contracting Officer, you must register in SAM before we will issue a purchase order to you. If you do not register by the date set by the Contracting Officer, the Contracting Officer might issue the order to a different quoter. Once registered, you must remain registered throughout performance until final payment. Go to https://www.acquisition.gov for information on SAM registration and annual confirmation.
(xi) Clause 52.212-4, Contract Terms and Conditions Commercial Items (OCT 2018), applies to this acquisition in addition to the following addenda s to the clause:
52.252-2 Clauses Incorporated by Reference (FEB 1998)
52.203-17 Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights (APR 2014)
52.204-9 Personal Identity Verification of Contractor Personnel (JAN 2011)
52.204-13 System for Award Management Maintenance (OCT 2018)
52.204-18 Commercial and Government Entity Code Maintenance
52.224-1 Privacy Act Notification (APR 1984)
52.224-2 Privacy Act (APR 1984)
52.228-5 Insurance-Work on a Government Installation (JAN 1997)
52.232-40 Providing Accelerated Payments to Small Business Subcontractors (DEC 2013)
52.237-3 Continuity of Services (JAN 1991)
852.203-70 Commercial Advertising (MAY 2008)
852.219-11 VA Notice of Total Veteran-Owned Small Business Set-Aside
852.219-74 Limitations on Subcontracting (JUL 2018)
852.232-72 Electronic Submission of Payment Requests (NOV 2018)
852.237-70 Contractor Responsibilities (APR 1984)
VAAR 852.219-74 LIMITATIONS ON SUBCONTRACTING MONITORING AND COMPLIANCE (JUL 2018)
(a) This solicitation includes VAAR 852.219-11, VA Notice of Total Veteran-Owned Small Business Set-Aside.
(b) Accordingly, any contract resulting from this solicitation is subject to the limitation on subcontracting requirements in 13 CFR 125.6, or the limitations on subcontracting requirements in the FAR clause, as applicable. The Contractor is advised that in performing contract administration functions, the Contracting Officer may use the services of a support contractor(s) retained by VA to assist in assessing the Contractor's compliance with the limitations on subcontracting or percentage of work performance requirements specified in the clause. To that end, the support contractor(s) may require access to Contractor's offices where the Contractor's business records or other proprietary data are retained and to review such business records regarding the Contractor's compliance with this requirement.
(c) All support contractors conducting this review on behalf of VA will be required to sign an Information Protection and Non-Disclosure and Disclosure of Conflicts of Interest Agreement to ensure the Contractor's business records or other proprietary data reviewed or obtained in the course of assisting the Contracting Officer in assessing the Contractor for compliance are protected to ensure information or data is not improperly disclosed or other impropriety occurs.
(d) Furthermore, if VA determines any services the support contractor(s) will perform in assessing compliance are advisory and assistance services as defined in FAR 2.101, Definitions, the support contractor(s) must also enter into an agreement with the Contractor to protect proprietary information as required by FAR 9.505-4, Obtaining access to proprietary information, paragraph (b). The Contractor is required to cooperate fully and make available any records as may be required to enable the Contracting Officer to assess the Contractor's compliance with the limitations on subcontracting or percentage of work performance requirement.
(END-OF-CLAUSE)
VAAR 852.228-71 INDEMNIFICATION AND INSURANCE (MAR 2018)
(a) Indemnification. The contractor expressly agrees to indemnify and save the Government, its officers, agents, servants, and employees harmless from and against any and all claims, loss, damage, injury, and liability, however caused, resulting from, arising out of, or in any way connected with the performance of work under this agreement. Further, it is agreed that any negligence or alleged negligence of the Government, its officers, agents, servants, and employees, shall not be a bar to a claim for indemnification unless the act or omission of the Government, its officers, agents, servants, and employees is the sole, competent, and producing cause of such claims, loss, damage, injury, and liability. At the option of the contractor, and subject to the approval by the contracting officer of the sources, insurance coverage may be employed as guaranty of indemnification.
(b) Insurance. Satisfactory insurance coverage is a condition precedent to award of a contract. In general, a successful bidder must present satisfactory evidence of full compliance with State and local requirements, or those below stipulated, whichever are the greater. More specifically, workers' compensation and employer's liability coverage will conform to applicable State law requirements for the service contemplated, whereas general liability and aircraft liability of comprehensive type shall, in the absence of higher statutory minimums, be required in the amounts per aircraft used of not less than $200,000 per person and $500,000 per occurrence for bodily injury and $200,000 per occurrence for property damage. Coverage for passenger liability bodily injury shall be at least $200,000 multiplied by the number of seats or passengers, whichever is greater. State-approved sources of insurance coverage ordinarily will be deemed acceptable to the Department of Veterans Affairs installation, subject to timely certifications by such sources of the types and limits of the coverages afforded by the sources to the bidder.
52.217-8 -- Option to Extend Services (Nov 1999) The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days of contract expiration. (End of Clause)
52.217-9 --Option to Extend the Term of the Contract (Mar 2000)
(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 45 days before the contract expires. The preliminary notice does not commit the Government to an extension.
(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.
(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5 Years and 6 Months.
(xii) Clause at 52.212-5, Contract Terms and Conditions Required To Implement Statutes Or Executive Orders -- Commercial Items, applies to this acquisition and in addition to the following FAR clauses cited, which are also applicable to the acquisition:
52.203-6, Restrictions on Subcontractor Sales to the Government (SEPT 2006)
52.204-10, Reporting Executive Compensation & First-Tier Subcontract Awards (OCT 2018);
52.204-14, Service Contract Reporting Requirements (OCT 2016)
52.209-6, Protecting the Government s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (OCT 2015);
52.219-8, Utilization of Small Business Concerns (OCT 2018) (15 U.S.C. 637(d)(2) and (3))
52.219-28 Post Award Small Business Program Representation (JUL 2013);
52.222-3, Convict Labor (JUNE 2003);
52.222-21, Prohibition of Segregated Facilities (APR 2015);
52.222-26, Equal Opportunity (SEPT 2016); 52.222-35, Equal Opportunity for Veterans (OCT 2015);
52.222-35, Equal Opportunity for Veterans (OCT 2015) (38 U.S.C. 4212)
52.222-36, Equal Opportunity for Workers with Disabilities (JUL 2014);
52.222-37, Employment Reports on Veterans (FEB 2016);
52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496)
52.222-50, Combating Trafficking in Persons (MAR 2015);
52.222-54, Employment Eligibility Verification (OCT 2015)
52.222-59, Compliance with Labor Laws (Executive Order 13673) (OCT 2016);
52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (AUG 2011);
52.224-3, Privacy Training (JAN 2017
52.225-13, Restrictions on Certain Foreign Purchases (JUNE 2008);
52.232-33, Payment by Electronic Funds Transfer System for Award Management (OCT 2018);
52.222-17, Nondisplacement of Qualified Workers (MAY 2014)
52.222-41, Service Contract Labor Standards (AUG 2018);
52.222-42, Statement of Equivalent Rates for Federal Hires (MAY 2014);
52.222-43, Fair Labor Standards Act and Service Contract Labor Standards--Price Adjustment (Multiple Year and Option Contracts) (AUG 2018);
52.222-55, Minimum Wages Under Executive Order 13658 (DEC 2015);
52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2017); (xiii) All contract requirement(s) and/or terms and conditions are stated above.
(xiv) The Defense Priorities and Allocations System (DPAS) and assigned rating are not applicable to this requirement.
(xv) RFQ responses are due 3/28/2019 at 12:00 PM E.S.T. RFQ responses must be submitted via email to: Tammy.Davis6@va.gov. Hand deliveries will not be accepted. Submissions after the deadline may not be considered.
(xvi) The POC of this solicitation is Tammy Davis (Tammy.Davis6@va.gov).
PERFORMANCE WORK STATEMENT
VA BOSTON CONFIDENTIAL DOCUMENT DESTRUCTION
SUMMARY
The contractor shall provide on-site shredding and disposal of paper materials at the VAMC Boston Campuses, CBOCs and Vet Center.
SCOPE OF WORK
The US Department of Veterans Affairs, VA Boston Healthcare System (VABHS) intends to use the services of a contractor to shred VABHS records and other materials throughout the year. Note: records may contain carbon, binders, folders and other non-paper materials. No media destruction is included under this contract.
Note: If media destruction is required throughout the life of the contract, it will be added through a bilateral modification to the contract. The contractor shall follow NIST 800-88 guidelines for media sanitation. The media shall not be not readable or reconstructable to any degree.
The contractor shall provide all labor and equipment and shall be responsible for disposing of shredded materials. Shredding may be witnessed by a VABHS employee authorized to witness destruction of sensitive materials.
Contractor shall maintain liability insurance for the duration of the contract and for following all pertinent federal and state regulations with regards to destruction of medical documentation.
While on VABHS premises, contractor employees shall wear a company uniform and a visible identification badge which contains a photograph of the employee. VABHS will provide a contractor photo ID badge. All contractor vehicles and collection containers will be clearly identified with the company's name. Collection containers should not include contractor contact information.
The contractor shall provide the services identified in this contract between the hours of 8:00 AM and 4:30 PM, Monday through Friday.
The contractor shall provide a schedule for paper shredding for three (3) main campuses, five (5) Community Based Outpatient Clinics (CBOC's), and two (2) Vet s centers. Once the schedule has been established, all shredding will occur on the same day of the week. All locations do not have to be serviced on the same day of the week. If the regularly scheduled shredding day falls on a national holiday, the contractor can perform the service either the day prior to or the day after the holiday, and shall inform the medical center of the revised shredding day.
The contractor shall provide and maintain approximately 439 locked collection containers/bags for the VA Boston Healthcare System and its Community Based Outpatient Clinics (CBOC s) and Vet s centers. Containers shall have a slotted lid or front panel allowing for the discarding of documents. The size and design of the slot shall be designed to prevent unauthorized access to the contents of the container. Size of containers shall be approximately 36" height, 20" wide and 19.5" deep. The containers must be compatible with the facility's interior design scheme. For high volume areas, the contractor may use larger containers in accordance with NFPA regulations and with the approval of the Contracting Officer Representative (COR). The containers shall be located throughout each campus and in specific areas at the CBOC s and Vet s centers.
All containers shall utilize a keyed lock to limit access. All containers in the VABHS shall use the same key (keyed alike). The contractor shall provide four (4) master keys for each campus and two (2) master keys for each CBOC and Vet Center.
The contractor shall provide five (5) additional wheeled locking collection containers (approximately 90-gallon capacity) at each campus and one (1) additional wheeled locking collection container (approximately 90 gallon capacity) at each CBOC for VABHS personnel to use when emptying containers between contractor pick-ups and for storage of materials. The contractor shall also provide ten (10) additional bags (same as in the collection bins) for each campus and two (2) additional bags (same as in the collection bins) for each CBOC.
Service locations will be:
Brockton Campus (940 Belmont Street, Brockton, MA)
Jamaica Plain Campus (150 South Huntington Ave, Jamaica Plain, MA)
West Roxbury Campus (1400 VFW Parkway, West Roxbury, MA)
Causeway CBOC (251 Causeway Street, Boston, MA)
Framingham CBOC (61 Lincoln Street, Suite 112, Framingham, MA)
Lowell CBOC (130 Marshall Road, Lowell, MA)
Quincy CBOC (114 Whitwell Street, 2nd Floor, Quincy, MA)
Plymouth CBOC (116 Long Pond Road, Suite 4, Plymouth, MA)
Brockton Vet's Center (104L Pearl Street, Brockton, MA)
The contractor shall ensure that contractor employees providing work on this contract are fully trained and completely competent to perform the required work.
The contractor shall recycle all shredded materials. This may be through traditional recycling methods or used for fuel in electrical co-generation.
Several times throughout the year, VABHS may have need for bulk records disposal and could encompass anywhere from 100-300 boxes of paper. The contractor will be contacted for these additional services and will be required to be on site within 72 hours of being contacted to shred and dispose of these records.
EQUIPMENT
The contractor shall provide mobile equipment to do all shredding on-site. Equipment shall be capable of strip cutting the material at the maximum in B< pieces. Contractors can propose equipment that will crosscut the materials and provide smaller cuts. During operation of the vehicle, it will not be parked near any air supply vents that provide air to buildings on VABHS property. Contractor shall provide locking containers to collect and transport shredding materials for destruction to mobile unit.
DELIVERABLE
Contractor shall shred materials weekly at the main campuses (Brockton, Jamaica
Plain and West Roxbury); every two weeks at the CBOC's; and monthly at the Vet's
Centers. Additionally, the contractor shall deliver to the COR, through electronic means, a monthly report identifying the following from the prior month: (1) the amount of funds paid to the contractor by VA Boston Healthcare System, (2) weight of waste removed from containers throughout VA Boston Healthcare System, and (3) percentage of the waste collected that was diverted to recycling. This report is due by the 7th of the following month and shall be broken down by site and shall include all sites in VABHS.
QUANTITIES
The quantities provided on the tables are estimated. The figures were derived from previous years for similar services. The VABHS reserves the right to increase/ decrease the quantities as needed throughout the life of the contract; this will be completed through a bilateral modification to the contract.
ADDITIONAL REQUIREMENTS
Certificate of Destruction A Certificate of Destruction" shall be completed after each service and submitted to the VABHS representative.
Records Management Procedure - Shall be applicable to all record/ microfiche destruction. The procedure reads "The authorized destruction of records that are classified or otherwise restricted from disclosure by statute, such as PA or Title 38 USC, must be witnessed by a Federal employee or a contractor employee. If a contract is used to dispose of restricted VA records, the facility Records Officer must authorize the use of a contractor or subcontractor employee to witness the destruction.
The contract should state that the contractor employee is authorized to witness destruction of the record. Any contract or sale of VA records must prohibit their resale for use as records or documents." The VABHS shall notify the contractor when these procedures are applicable.
Confidentiality of Material Destruction Contractor personnel shall comply with confidentiality in the destruction of all VABHS records. Any contractor personnel found to be reading any VABHS materials shall be promptly removed from the government premises. The person(s) involved shall not be allowed to return to the VABHS for any further service requests.
The procedures in VA Directive 6371 Destruction of Temporary Paper Records must be followed.
The VABHS will provide a room at each location to be used by the contractor as a collection area for the paper/ shredding materials. Pick up locations (buildings, rooms and floors) are listed in the tables below.
National Holidays The ten holidays observed by the Federal Government are:
New Year s Day
Martin Luther King's Birthday
Washington s Birthday (President's Day)
Memorial Day
Independence Day
Labor Day
Columbus Day
Veteran's Day
Thanksgiving Day
Christmas Day
And any other holiday specifically declared by the President of the United States to be a national holiday.
HIPPA The contractor will have to complete a standard Business Associate Agreement (BAA) in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPPA) after award.
Restrictions The VABHS is a government facility. Loading dock hours are limited so contact any of the authorized personnel below for availability. VA personnel authorized to place calls for services are listed below: TBD
Estimated shredding services for the VABHS will require:
B
B
B
Description
Quantity
Frequency
Brockton - Console
125
WK
Brockton - 90 Gallon
8
WK
Brockton Console bags
10
WK
Jamaica Plain - Console
100
WK
Jamaica Plain - 90 Gallon
15
WK
Jamaica Plain - Console Bag
10
WK
West Roxbury - Console
106
WK
West Roxbury - 90 Gallon
10
WK
West Roxbury - Console Bag
12
WK
CBOC - Boston - Console
6
2 WK
CBOC - Boston - 90 Gallon
1
2 WK
CBOC - Boston - Console Bag
4
2 WK
CBOC - Framingham - Console
3
2 WK
Additional Console Bags
2
2 WK
CBOC - Lowell - Console
5
2 WK
Additional Console Bags
2
2 WK
CBOC - Lowell - 90 Gallon
1
2 WK
Additional Console Bags
2
2 WK
CBOC - Quincy - Console
3
2 WK
Additional Console Bags
2
2 WK
Brockton Vet Center - Console
2
4 WK
Additional Console Bags
2
4 WK
CBOC - Plymouth - Console
2
2 WK
Additional Console Bags
2
2 WK
Bulk Pick UP 100-300 boxes
4
EA
BROCKTON CAMPUS
940 BELMONT STREET
BROCKTON, MA
BUILDING
FLOOR
DESCRIPTION
QTY
1
B
Engineering Safety
1
1
B
Engineering Safety
1
1
1
Outside 150B
1
1
1
126 - Personnel
2
1
1
171R Directors Office
1
1
1
102 P&R
1
1
1
107/108
1
1
1
108 In front
1
1
1
135 Payroll
1
1
2
213 ENGINEERING
1
2
B
Hallway
2
2
B
A014
1
2
B
A004 Inside A4 Library
1
2
B
C008
2
2
B
C010C Care Cost Recovery
1
2
B
C010C Care Cost Recovery
1
2
1
Women's Health
1
2
1
A102 - Medical Transcription
1
2
1
A111 - Alcohol Outpatient
1
2
1
2.1.B Nurse's Station
1
2
1
2.1.C Nurse's Station
1
2
2
2-2-C Nurses Station
1
2
2
2-2-B Nurses Station
1
2
2
A201 - Brain Imaging
1
2
3
A313/314 (2)
1
2
3
A302
1
2
3
2-3-B Nurses Station
1
2
3
2-3-C Nurses Station
1
2
4
2.4.C Nurse's Station
1
3
B
LOADING DOCK
2
3
B
C014 - Medical Records
2
3
B
A-012C
1
3
1
A101D
1
3
1
A101C/A139
1
3
1
A103
1
3
1
A130A-THROUGH BLOOD LAB DOORS AND RIGHT.
1
3
1
Blood Lab Area
1
3
1
B121
1
3
1
Outpatient Pharmacy (2)
3
3
1
C102 - Specialty
1
3
1
C119 - Exam
1
3
1
C137
1
3
2
A213
1
3
2
B224 Dentistry (2)
2
3
2
C217A - Physical Therapy Clinic
1
3
2
C201
1
3
2
C209
1
3
3
Primary Care Check-In
1
3
3
A340
1
3
3
A342 Pharmacy
1
3
3
1
3
3
C-305 Clinical Control
1
3
3
C-Side Clinic
1
3
3
B333
1
3
3
B-Side Clinic
1
3
4
B414 Nurses Station
1
3
4
Chief of Police
1
3
4
C403 Nurses Station
1
3
4
B-426
1
3
4
B-428a
1
3
4
A417
1
3
4
A401 & 402
1
3
5
A503
1
3
5
B512
1
3
5
C503
1
3
5
C510
1
3
6
2
4
B
A020
1
4
B
KT Dept
1
4
B
c031
1
4
B
B013
1
4
1
Inside office w/ blue door
1
4
1
4-1-B Nurses Station
1
4
1
4-1-C Nurses Station
1
4
2
A Section - A202
1
4
2
4-2-B
1
4
2
4-2-C Nurses Station
1
5
1
C Side - Hall near C114
1
5
1
C Side - C125
1
5
1
A120
1
5
1
B Side-small waiting rm
1
5
2
C205 Hallway
1
5
2
B Side outside rm. 224 (in corner)
2
7
B
B003
1
7
B
A007
1
7
1
B109
1
8
1
B132
1
8
1
C169
1
20
1
102K Reproduction
1
20
2
202H
1
20
2
202B
1
20
2
211
1
22
1
Rm 113B
1
22
2
2nd Fl near rm 207
1
23
1
Recreation
1
24
1
Chapel/Office area
1
61
1
2
62
1
Rise Program-unit located in corridor.
ADDITIONAL
1
34
B
B
Totals - BROCKTON
143
JAMAICA PLAIN CAMPUS
150 SOUTH HUNTINGTON AVENUE
JAMAICA PLAIN, MA
BUILDING
FLOOR
DESCRIPTION
QTY
1
B
Elevator Lobby
2
1
B
CB-8 - Copier Room
1
1
B
DB-112 - Correspondence
1
1
B
RT-22 - Radiation Therapy
1
1
1
Elevator Lobby
2
1
1
Next to Rm B147B Womens Clinic Hallway
1
1
1
Di Hallway by Rm D1-130
1
1
1
E1-104
1
1
1
C1 Police Office
1
1
1
C1 Womens Clinic
1
1
1
Pharmacy
5
1
2
Elevator Lobby
2
1
2
2D-151 - Outside door
2
1
3
Elevator Lobby
2
1
3
C3-14
1
1
4
Elevator Lobby
2
1
5
Elevator Lobby
2
1
6
Elevator Lobby
2
1
6
C Wing Corridor by Rm #32
1
1
6
B Wing Corridor
1
1
6
D&E Wing Corridor
1
1
7
Elevator Lobby
2
1
8
Elevator Lobby
4
1
9
Elevator Lobby
2
1
9
9C-35 Fee Basis
2
1
9
9D - Corridor
1
1
10
Elevator Lobby
3
1
10
10C-35
3
1
10
Pharmacy
3
1
11
Elevator Lobby
2
1
12
Elevator Lobby
2
1
13
Elevator Lobby
2
1
14
Elevator Lobby
2
1A
1
Next to Bathroom R1-125
1
1A
1
Next to Lab Rm R1-103
1
ACA
B
Elevator Lobby by rm FB-8
1
ACA
F2
F1-66
1
ACA
F2
Urgent Care
1
ACA
F3
Primary Care
1
ACA
F3
F2-62 outside door
1
ACA
F4
Inside reception area - Rm 12
1
4
1
Inside Front Door
1
9
1
By Room 134
1
9
2
Elevator Lobby
2
9
3
Elevator Lobby
2
9
3
By room 332
1
9
4
by room 422 / Elevator Lobby
ADDITIONAL
2
47
B
B
Totals JAMAICA PLAIN
125
WEST ROXBURY CAMPUS
1400 VFW PARKWAY
WEST ROXBURY, MA
BUILDING
FLOOR
DESCRIPTION
QTY
1
G
Biomedical Engineering, Outside GB115
1
1
G
CAT Scan, Outside GB103
1
1
G
Credit Union, Outside GB111
1
1
G
Elevator Lobby (by EMS)
2
1
G
Mental Health, Outside GD103
1
1
G
MRI, GB152
1
1
G
Prosthetics Area, GD101
1
1
1
1 North, Outside 1D123
1
1
1
1 South, Across from Medical Service Wing
1
1
1
Cardiology Reception, 1D107
1
1
1
Elevator Lobby
2
1
1
Medical Service, Outside 1B119
1
1
1
Radiology Reading/ Viewing Room, 1B143
1
1
1
Radiology Reception, 1B116
1
1
1
Surgical Service, Room 1C119
1
1
2
2 North Nurse Station
1
1
2
2 South Nurse Station, Across from station
1
1
2
Elevator Lobby
2
1
2
Nutrition & Food Service, Outside 2C101
1
1
3
3 North Nurse Station
1
1
3
Elevator Lobby
1
1
3
PACU Nurse Station
1
1
3
PCU Nurse Station
1
1
4
EKG Lab, Outside 4C102C
1
1
4
Elevator Lobby
2
1
4
MICU Nurse Station
1
1
5
CCU Nurse Station
1
1
5
Echocardio Lab, 5B112
1
1
5
Elevator Lobby
1
1
5
Cath/EP Lab, Outside 5D108
1
2
B
Elevator Lobby
2
2
G
AG Nurse Station
1
2
G
Elevator Lobby
2
2
1
A1 Nurse Station
1
2
1
Elevator Lobby
2
2
2
A2 Nurse Station
1
2
2
Elevator Lobby
2
2
2
SCI Offices, Outside A212
1
2
3
Elevator Lobby
1
2
3
Inside Anesthesia Office A317 - Jump Suit Required
1
2
3
OR Back Corridor by Offices
1
2
3
Interns Office, Outside A332
2
2
3
SICU Nurse Station
1
3
G
ER - Secured Area
1
3
G
ER Reception (unsecured)
1
3
G
Police Service, GB138
1
3
G
Eye Clinic Wing, Outside Resident's Room GD106
1
3
G
HIMS, Veterans Benefits, and HIMS Check-in office
1
3
G
Back Entrance to HIMS, Outside GB110
1
3
G
Main Reception, Inside
1
3
G
My Healthy Vet Station
1
3
G
Coumadin Clinic, Room GA104
1
3
G
Pharmacy - Inpatient
2
3
G
Pharmacy - Outpatient
1
3
G
Pharmacy IV Sterile Room
1
3
G
Primary Care Day Clinics, GB134
1
3
G
Primary Care Day Clinics, Outside GA127
1
3
G
Surgical Clinics, Inside
1
3
G
Travel Office Corridor, Across from GC121
2
3
1
Elevator Lobby
2
3
1
Lab Offices
2
3
1
Main Laboratory, Inside
3
3
1
Main Laboratory, Inside - Chemistry
1
3
1
Lab Corridor by 1A112
1
3
2
Director's Suite, Between 2D125 & 2D126
1
3
2
Elevator Lobby
1
3
2
Outside Bignami Conference Room, Outside 2B100
1
3
2
Nuclear Medicine, Outside 2C121
1
3
2
Nursing Wing Corridor, Outside 2B122
1
3
2
Research - Outside Suite in Corridor C2-24A
1
5
G
Main Office
1
7
1
Main Warehouse
1
88
G
Breakroom - Room 3
1
88
G
Credentialing - Outside Room 41
1
-
G
Fisher House (Manager's Office)
ADDITIONAL
1
38
B
B
Totals - WEST ROXBURY
128
CAUSEWAY CBOC
251 CAUSEWAY STREET
BOSTON, MA
BUILDING
FLOOR
DESCRIPTION
QTY
Causeway
1
Causeway Outpatient Clinic
1
Causeway
2
Causeway Outpatient Clinic
1
Causeway
3
Causeway Outpatient Clinic
1
Causeway
-
Causeway Outpatient Clinic
ADDITIONAL
2
6
B
B
Totals - Causeway CBOC*
11511
* Must be done after 2:30 PM
FRAMINGHAM CBOC
61 LINCOLN STREET
FRAMINGHAM, MA
BUILDING
FLOOR
DESCRIPTION
QTY
Framing
-
Framingham Outpatient Clinic
ADDDITIONAL bags
3
2
B
B
Totals - Framingham CBOC
5
LOWELL CBOC
130 MARSHALL ROAD
LOWELL, MA
TOTAL BINS
BUILDING
FLOOR
DESCRIPTION
QTY
Lowell
-
Lowell Outpatient Clinic
ADDITIONAL
5
5
B
B
Totals - Lowell CBOC*
10
* Must be done after 2:30 PM
QUINCY CBOC
114 WHITWELL STREET, 2ND FLOOR
QUINCY, MA
BUILDING
FLOOR
DESCRIPTION
QTY
Quincy
-
Quincy Outpatient Clinic
ADDITIONAL
3
2
B
B
Totals - Quincy CBOC
5
PLYMOUTH CBOC
116 LONG POND ROAD
PLYMOUTH, MA
BUILDING
FLOOR
DESCRIPTION
QTY
Plymouth
-
Plymouth Outpatient Clinic
ADDITIONAL bags
2
2
B
B
Totals - Plymouth CBOC
4
BROCKTON VET S CENTER
1041 L PEARL STREET
BROCKTON, MA
BUILDING
FLOOR
DESCRIPTION
QTY
Brock Vet
-
Brockton Vet Center
ADDITIONAL
2
2
B
B
Totals - Brockton Vet Center
4
PERFORMANCE REQUIREMENTS SUMMARY
Task
Standard
Acceptable Quality Level
Method of Surveillance
Certificate of Destruction submitted weekly
Completed on time
98%
Periodic Inspections
Document Destruction Reports
Submitted to Government with accurate information and within 48 Hours of Pick up.
98%
Periodic Inspection
Documents shredded on-site
Shredding is in accordance with VA Directive 6371
100%
Periodic Inspection
IT CONTRACT SECURITY (MARCH 12, 2010)
VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY
GENERAL
Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.
VA INFORMATION CUSTODIAL LANGUAGE
Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data
- General, FAR 52.227-14(d) (1).
VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA s information is returned to the VA or destroyed in accordance with VA s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.
Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.
The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.
The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.
If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.
If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.
The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.
The contractor/subcontractor s firewall and Web services security controls, if applicable, shall meet or exceed VA s minimum requirements. VA Configuration Guidelines are available upon request.
Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.
Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.
For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.
SECURITY INCIDENT INVESTIGATION
The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.
To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.
With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.
In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.
LIQUIDATED DAMAGES FOR DATA BREACH
Consistent with the requirements of 38 U.S.C. B'5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.
The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.
Each risk analysis shall address all relevant information concerning the data breach, including the following:
Nature of the event (loss, theft, unauthorized access);
Description of the event, including:
date of occurrence;
data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;
Number of individuals affected or potentially affected;
Names of individuals or groups affected or potentially affected;
Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;
Amount of time the data has been out of VA control;
The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);
Known misuses of data containing sensitive personal information, if any;
Assessment of the potential harm to the affected individuals;
Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and
Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.
Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:
Notification;
One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;
Data breach analysis;
Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;
One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and
Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.
TRAINING
All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:
Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;
Successfully complete the VA Cyber Security Awareness and Rules of Behavior
training and annually complete required security training;
Successfully complete the appropriate VA privacy training and annually complete required privacy training; and
Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access.
The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.
Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.
BUSINESS ASSOCIATE AGREEMENT BETWEEN THE DEPARTMENT OF VETERANS AFFAIRS VETERANS HEALTH ADMINISTRATION AND _
Purpose. The purpose of this Business Associate Agreement (Agreement) is to establish requirements for the Department of Veterans Affairs (VA) Veterans Health Administration (VHA)
and in accordance with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH) Act, and the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules ( HIPAA Rules ), 45 C.F.R. Parts 160 and 164, for the Use and Disclosure of Protected Health Information (PHI) under the terms and conditions specified below.
Scope. Under this Agreement and other applicable contracts or agreements,
will provide services to, for, or on behalf of .
In order for to provide such services,
will disclose Protected Health Information
to and will use or disclose Protected Health Information in accordance with this Agreement.
Definitions. Unless otherwise provided, the following terms used in this Agreement have the same meaning as defined by the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (PHI), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.
Business Associate shall have the same meaning as described at 45 C.F.R. B' 160.103. For the purposes of this Agreement, Business Associate shall refer to , including its employees, officers, or any other agents that create, receive, maintain, or transmit PHI as described below.
Covered Entity shall have the same meaning as the term is defined at 45 C.F.R. B' 160.103. For the purposes of this Agreement, Covered Entity shall refer to .
Protected Health Information or PHI shall have the same meaning as described at 45 C.F.R. B'
160.103. Protected Health Information and PHI as used in this Agreement include Electronic Protected Health Information and EPHI. For the purposes of this Agreement and unless otherwise provided, the term shall also refer to PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity or receives from Covered Entity or another Business Associate.
Subcontractor shall have the same meaning as the term is defined at 45 C.F.R. B' 160.103. For the purposes of this Agreement, Subcontractor shall refer to a contractor of any person or entity, other than Covered Entity, that creates, receives, maintains, or transmits PHI under the terms of this Agreement.
Terms and Conditions. Covered Entity and Business Associate agree as follows:
Ownership of PHI. PHI is and remains the property of Covered Entity as long as Business Associate creates, receives, maintains, or transmits PHI, regardless of whether a compliant Business Associate agreement is in place.
Use and Disclosure of PHI by Business Associate. Unless otherwise provided, Business Associate:
May not use or disclose PHI other than as permitted or required by this Agreement, or in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity, except that it may use or disclose PHI:
(1) As required by law or to carry out its legal responsibilities;
(2) For the proper management and administration of Business Associate; or
To provide Data Aggregation services relating to the health care operations of Covered Entity.
Must use or disclose PHI in a manner that complies with Covered Entity s minimum necessary policies and procedures.
May de-identify PHI created or received by Business Associate under this Agreement at the request of the Covered Entity, provided that the de-identification conforms to the requirements of the HIPAA Privacy Rule.
Obligations of Business Associate. In connection with any Use or Disclosure of PHI, Business Associate must:
Consult with Covered Entity before using or disclosing PHI whenever Business Associate is uncertain whether the Use or Disclosure is authorized under this Agreement.
Implement appropriate administrative, physical, and technical safeguards and controls to protect PHI and document applicable policies and procedures to prevent any Use or Disclosure of PHI other than as provided by this Agreement.
Provide satisfactory assurances that PHI created or received by Business Associate under this Agreement is protected to the greatest extent feasible.
Notify Covered Entity within twenty-four (24) hours of Business Associate s discovery of any potential access, acquisition, use, disclosure, modification, or destruction of either secured or unsecured PHI in violation of this Agreement, including any Breach of PHI.
Any incident as described above will be treated as discovered as of the first day on which such event is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate.
Notification shall be sent to and and to the VHA Health Information Access Office, Business Associate Program Manager by email at VHABAAIssues@va.gov.
Business Associate shall not notify individuals or the Department of Health and Human Services directly unless Business Associate is not acting as an agent of Covered Entity but in its capacity as a Covered Entity itself.
Provide a written report to Covered Entity of any potential access, acquisition, use, disclosure, modification, or destruction of either secured or unsecured PHI in violation of this Agreement, including any Breach of PHI, within ten (10) business days of the initial notification.
The written report of an incident as described above will document the following:
The identity of each Individual whose PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, disclosed, modified, or destroyed;
A description of what occurred, including the date of the incident and the date of the discovery of the incident (if known);
A description of the types of secured or unsecured PHI that was involved;
A description of what is being done to investigate the incident, to mitigate further harm to Individuals, and to protect against future incidents; and
Any other information as required by 45 C.F.R. B'B' 164.404(c) and 164.410.
The written report shall be addressed to:
and submitted by email to and to the VHA Health Information Access Office, Business Associate Program Manager at VHABAAIssues@va.gov
To the greatest extent feasible, mitigate any harm due to a Use or Disclosure of PHI by Business Associate in violation of this Agreement that is known or, by exercising reasonable diligence, should have been known to Business Associate.
Use only contractors and Subcontractors that are physically located within a jurisdiction subject to the laws of the United States, and ensure that no contractor or Subcontractor maintains, processes, uses, or discloses PHI in any way that will remove the information from such jurisdiction. Any modification to this provision must be approved by Covered Entity in advance and in writing.
Enter into Business Associate Agreements with contractors and Subcontractors as appropriate under the HIPAA Rules and this Agreement. Business Associate:
Must ensure that the terms of any Agreement between Business Associate and a contractor or Subcontractor are at least as restrictive as Business Associate Agreement between Business Associate and Covered Entity.
Must ensure that contractors and Subcontractors agree to the same restrictions and conditions that apply to Business Associate and obtain satisfactory written assurances from them that they agree to those restrictions and conditions.
May not amend any terms of such Agreement without Covered Entity s prior written approval.
I. Within five (5) business days of a written request from Covered Entity:
Make available information for Covered Entity to respond to an Individual s request for access to PHI about him/her.
Make available information for Covered Entity to respond to an Individual s request for amendment of PHI about him/her and, as determined by and under the direction of Covered Entity, incorporate any amendment to the PHI.
Make available PHI for Covered Entity to respond to an Individual s request for an accounting of Disclosures of PHI about him/her.
Business Associate may not take any action concerning an individual s request for access, amendment, or accounting other than as instructed by Covered Entity.
To the extent Business Associate is required to carry out Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the provisions that apply to Covered Entity in the performance of such obligations.
Provide to the Secretary of Health and Human Services and to Covered Entity records related to Use or Disclosure of PHI, including its policies, procedures, and practices, for the purpose of determining Covered Entity s, Business Associate s, or a Subcontractor s compliance with the HIPAA Rules.
Upon completion or termination of the applicable contract(s) or agreement(s), return or destroy, as determined by and under the direction of Covered Entity, all PHI and other VA data created or received by Business Associate during the performance of the contract(s) or agreement(s). No such information will be retained by Business Associate unless retention is required by law or specifically permitted by Covered Entity. If return or destruction is not feasible, Business Associate shall continue to protect the PHI in accordance with the Agreement and use or disclose the information only for the purpose of making the return or destruction feasible, or as required by law or specifically permitted by Covered Entity. Business Associate shall provide written assurance that either all PHI has been returned or destroyed, or any information retained will be safeguarded and used and disclosed only as permitted under this paragraph.
Be liable to Covered Entity for civil or criminal penalties imposed on Covered Entity, in accordance with 45 C.F.R. B'B' 164.402 and 164.410, and with the HITECH Act, 42 U.S.C. B'B' 17931(b), 17934(c), for any violation of the HIPAA Rules or this Agreement by Business Associate.
Obligations of Covered Entity. Covered Entity agrees that it:
Will not request Business Associate to make any Use or Disclosure of PHI in a manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if made by Covered Entity, except as permitted under Section 2 of this Agreement.
Will promptly notify Business Associate in writing of any restrictions on Covered Entity s authority to use or disclose PHI that may limit Business Associate s Use or Disclosure of PHI or otherwise affect its ability to fulfill its obligations under this Agreement.
Has obtained or will obtain from Individuals any authorization necessary for Business Associate to fulfill its obligations under this Agreement.
Will promptly notify Business Associate in writing of any change in Covered Entity s Notice of Privacy Practices, or any modification or revocation of an Individual s authorization to use or disclose PHI, if such change or revocation may limit Business Associate s Use and Disclosure of PHI or otherwise affect its ability to perform its obligations under this Agreement.
Amendment. Business Associate and Covered Entity will take such action as is necessary to amend this Agreement for Covered Entity to comply with the requirements of the HIPAA Rules or other applicable law.
Termination.
Automatic Termination. This Agreement will automatically terminate upon completion of Business Associate s duties under all underlying Agreements or by termination of such underlying Agreements.
Termination Upon Review. This Agreement may be terminated by Covered Entity, at its discretion, upon review as provided by Section 9 of this Agreement.
Termination for Cause. In the event of a material breach by Business Associate, Covered Entity:
Will provide an opportunity for Business Associate to cure the breach or end the violation within the time specified by Covered Entity;
May terminate this Agreement and underlying contract(s) if Business Associate does not cure the breach or end the violation within the time specified by Covered Entity.
Effect of Termination. Termination of this Agreement will result in cessation of activities by Business Associate involving PHI under this Agreement.
Survival. The obligations of Business Associate under this Section shall survive the termination of this Agreement as long as Business Associate creates, receives, maintains, or transmits PHI, regardless of whether a compliant Business Associate Agreement is in place.
No Third Party Beneficiaries. Nothing expressed or implied in this Agreement confers any rights, remedies, obligations, or liabilities whatsoever upon any person or entity other than Covered Entity and Business Associate, including their respective successors or assigns.
Other Applicable Law. This Agreement does not abrogate any responsibilities of the parties under any other applicable law.
Review Date. The provisions of this Agreement will be reviewed by Covered Entity every two years from Effective Date to determine the applicability and accuracy of the Agreement based on the circumstances that exist at the time of review.
Effective Date. This Agreement shall be effective on the last signature date below.
Department of Veterans Affairs Veterans Health Administration
By: By:
Name: Name:
Title: Title:
Date: Date:
Tammy Davis
Tammy.Davis6@va.gov
Tammy.Davis6@va.gov
