THIS REQUEST FOR INFORMATION (RFI) IS ISSUED SOLELY FOR INFORMATION AND PLANNING PURPOSES ONLY AND DOES NOT CONSTITUTE A SOLICITATION. THE SUBMISSION OF PRICING, CAPABILITIES FOR PLANNING PURPOSES, AND OTHER MARKET INFORMATION IS HIGHLY ENCOURAGED AND ALLOWED UNDER THIS RFI IN ACCORDANCE WITH (IAW) FAR 15.201(e). DISCLAIMER This RFI is issued solely for information and planning purposes only and does not constitute a solicitation. All information received in response to this RFI that is marked as proprietary will be handled accordingly. IAW FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. Responders are solely responsible for all expenses associated with responding to this RFI. SOURCES SOUGHT DESCRIPTION This is NOT a solicitation announcement. This is a sources sought/RFI only. The purpose of this sources sought/RFI is to gain knowledge of potential qualified sources and their size classification relative to NAICS 811219 (size standard of $22.0 Million). Responses to this sources sought will be used by the Government to make appropriate acquisition decisions. After review of the responses to this sources sought, a solicitation announcement may be published. Responses to this sources sought synopsis are not considered adequate responses for a solicitation announcement. The Department of Veterans Affairs (VA), VISN 22 Network Contracting Office, is seeking sources that can provide Medical Gas System repairs that at a minimum meets the following Statement of Work for the Northern Arizona VA Healthcare System: DEPARTMENT OF VETERANS AFFAIRS NORTHERN ARIZONA VA HEALTH CARE SYSTEM STATEMENT OF WORK FOR (ONLY COMPLETE SECTIONS A, B, AND C) GENERAL INFORMATION Purpose: This Statement of Work (SOW) describes the Repairs required for the Medical Gas system. This includes repairs of the medical gas compressor systems, vacuum system, O2 tank and medical alarm panels. Background: The services described in this SOW is required due to the aging of the current systems and availability of repair parts to operate the system effectively and efficiently for proper patient care. There is a frequent amount of leaks around the current piping to include valves, gauges, manifolds and isolation points around the medical gas compressor systems, medical gas vacuum systems, O2 supply systems (both main tank and secondary tanks). The medical alarm panels require replacing due to non-availability of replacement and repair parts. The cabling for the medical gas alert/alarm system has been spliced, broken, damaged to the extent that nuisance alarms are sent to the master alarm panels or no alarms are sent or received to some of the panels or to the central panel to alert nursing and/or facilities maintenance staff of medical gas issues or outages. Type of Contract: Firm-Fixed Price Places of Performance: Northern Arizona VA Healthcare System 500 HW 89N Prescott, AZ 86113 The repairs are required in Bldg 107, 148, 160 & 162 and the B Courtyard. Period of Performance: This is a repair by replacement. Deliverables, installation, and repairs must be completed within one year upon award. Hours of Service: Work is to be done between the hours of 8:00 a.m. and 4:00 p.m. Monday thru Friday, excluding federal holidays. Request for weekend work must be submitted in writing. Warehouse Hours: Deliveries are accepted between the hours of 8:00 a.m. and 3:30 p.m. Monday thru Friday, excluding federal holidays. Federal Holidays New Year s Day January 1st Martin Luther King s Birthday 3rd Monday in January President s Day 3rd Monday in February Memorial Day Last Monday in May Juneteenth June 19th Independence Day July 4th Labor Day 1st Monday in September Columbus Day 2nd Monday in October Veteran s Day November 11th Thanksgiving Day Last Thursday in November Christmas Day December 25th When one of the above designated legal holidays falls on a Sunday, the following Monday will be observed as a legal holiday. When a legal holiday falls on a Saturday, the preceding Friday is observed as a holiday by U.S. Government agencies GENERAL REQUIREMENTS Basic Requirements: NAVAHCS requires repairs and updates to its current medical air and vacuum systems for patient care areas of the facility within buildings 107, 148, 160, 162 and the B Courtyard. There are multiple medical gas, vacuum and O2 manifolds, gauges, valves, and piping that are leaking and are no longer repairable or efficient. There is too much air loss that is occurring at the manifolds. Too much to the extent that when backup systems or tanks are turned on, the tanks must be closely monitored by facilities staff in the event of backup tanks running out of medical air or gases. Manifold leaks at the Bulk O2 tank. Manifold leaks at the Bulk O2 tank area for the secondary tank system. Manifold leaks at the secondary tank system at Bldg 107. Manifold leaks for the Medical Air system in the Medical Air Compressor room in Bldg 107. The two (2) medical air compressor systems and the one (1) medical vacuum compressor system have aged extremely past their acceptable life expectancy. These systems have been maintained extensively by facilities staff; however, replacement parts, equipment, motors, and controls are no longer available, and the systems need to be replaced. Bldg 148 Medical Air Compressor will need to be changed out however when the system is shutdown, the work must be completed within three (3) days and cannot coincide with weekends or holidays. Coordination must be done with facility staff prior to shutdown to determine impact to patient care. Bldg 107 Medical Air Compressor system can be installed in room A next to the existing Medical Air & Vacuum room B. The piping can be attached or connected to a medical air valve pipe with the marking of future designated on the pipe. This will allow for limited total down time between the replaced system and new system being started and made operational. Once the old medical air compressor is isolated, then this can be removed. Then in room B, prior to the existing Medical Vacuum system being removed, the new Vacuum system will be installed in the same space where the previous medical air compressor was removed. Once the vacuum system has been installed and operational, the previous system can be removed. These details are needed because at this moment there are electrical panels that are situated in these rooms and are currently not meeting the required working distances for electrical panels in accordance with NFPA 70 & 70E. These panels require a minimum of 36 inches of distance for allowable working space. By completing the above in this order will minimize the total downtime to the facility medical air and vacuum systems and limit the total impact to patient care. Medical Air Compressor for Bldg 148. Medical Air Compressor for Bldg 107. Medical Vacuum Compressor for Bldg 107 (picture #1). Medical Vacuum Compressor for Bldg 107 (picture #2). The medical alarm master panels (2 one is located in ED Bldg 160 and the other is located in Bldg 107 in Bio Med shop) need to be updated as well as the network cabling will need to be replaced utilizing the existing raceways, conduits and boxes. One (1) medical gas alarm master panel needs to be completely disabled and removed as it is too close to the dementia ward (Bldg 148), and it receives frequent nuisance alarms which affects the dementia patients. Wiring and network wiring/cabling needs to be replaced with proper frequency shielded cabling due to frequent building upgrades and renovations, the current cabling is failing and causing frequent nuisance alarms from breaks and over splicing without the proper cable/wiring protections from frequency connections. We need to add in remote monitoring of the bulk tank O2 area to the alarm system through either BACnet or BAS so that the Boiler Plant can receive audible and visual alarms of the O2, Medical Air & Medical Vacuum systems. We would like to have an assessment or evaluation done to provide a solution and recommendations for monitoring the flow and usage of O2, medical air, and medical vacuum for patient care areas of the facility. Master Alarm in Bldg 160-ED (now obsolete). Need to assess and survey location of the O2 fill connection port that is still attached to building 148 when building 162 was built (where the dock was located). We would like to get this evaluated to determine if this fill port is required in accordance with NFPA 99. There are two other EOC fill ports (1 at Bldg 148, D-Wing & 1 at Bldg 107 in the B Courtyard by Room C). If the port that is located inside of Bldg 148 is not required, then we would like to have it disabled and removed back to the T-connection which is located in the old SPS area. This will also require inspection, verification, and certification once completed by a certified Medical Gas Inspector. O2 fill connection port for Bldg 148 (picture #1). O2 fill connection port access hatch in Bldg 148/Bldg 162. O2 fill connection port for Bldg 148 (picture #2). We will require, upon completion of installation and repairs, a complete Medical Gas Inspection, testing, and certification with a provided report on the total NAVAHCS Medical Gas System. The contractor shall perform a Master and Area Alarms testing and certification. Testing and certification of the Medical Center s medical gas systems shall comply with Engineering Policy Memorandum No. FM-20. This policy is used to schedule, monitor, and document the testing and maintenance of the Medical Center s medical gas systems. These systems include medical air, oxygen, medical vacuum. All critical components of the piped medical gas system including master signal panels, area alarms, automatic pressure switches, shutoff valves, flexible connectors, and outlets (to include usage ports at patient care areas), shall be tested, inspected, and maintained in compliance with NFPA standards by the Contractor. Prime Contractor shall have completed NFPA 99C Medical Gas Certifier training and provide a current certificate of qualification. The documentation shall be provided in electronic format and a hard copy format will be provided in a 3-ring binder. We will require as-built drawings of the Medical Gas system upon completion of the contract. NAVAHCS will provide a current set of as-built drawings upon contract award to the contractor. The drawings shall include layout of the total medical gas system, medical vacuum system, O2 system, master alarm & area alarm system with locations, isolation valves and locations for the total NAVAHCS Medical Gas System. Contractor will be required to conduct coordination efforts with NAVAHCS staff prior to any medical gas shutdowns in order to perform repairs. Contractor will be required to provide a Dewar oxygen system to provide backup oxygen during repairs in the event that repairs are estimated to take longer than 8 hours. Qualifications: Installation, testing, inspection, and certification shall be accomplished by certified installers and inspectors. Certificates shall be provided upon arrival prior to the certification process. Installers, verifiers, and inspectors will need to be from different companies. Installers will not be permitted to inspect or verify their own work. Verifiers shall not be allowed to install equipment or perform any part of the installation or repairs. Verifiers shall not be permitted to inspect or act as inspectors for any portion of this contract. Inspectors shall not be allowed to perform any portion of the installation or repairs, nor will they be permitted to verify any portion of the installation or repairs. The installers, verifiers, and inspectors shall not be employed by the same company or contractor no matter if they are the Prime Contractor or the Sub-Contractor. All installations, repairs, documentation, inspections, vacuum, brazing, piping, purging, labeling, breaching to include all documentation shall be performed in accordance with NFPA 99 Chapter 5 Gas and Vacuum Systems. Installers: Shall be made by qualified, competent technicians who are experienced in performing such installations, including all personnel who install the piping system in accordance with NFPA 99 Section 5.1.10.11.10 Qualification of Installers. Installers shall be certified in accordance with ASSE 6010 Medical Gas Systems Installers. Inspectors: Shall be certified in accordance with ASSE 6020 Medical Gas Systems Inspectors. Verifiers: Shall be certified in accordance with ASSE 6030 Medical Gas Systems Verifiers. Reporting: Contractor (or Representative) shall sign-in upon arrival at the M&O Supervisor Office, building 31, Room 111, at the beginning of each visit. All documentation for installation, inspection, and certifications shall be provided to Northern Arizona VA Health Care System (NAVAHCS) facilities personnel during the contract period of period and upon completion of the awarded contract. Documentation shall be provided in both electronic format (pdf) and hard copy format with 3-ring binder. Contractor will be required to conduct coordination efforts with NAVAHCS staff prior to performing any medical gas shutdowns to perform repairs. Coordination efforts must start 72 hours prior to any scheduled shutdown for repairs. This will allow proper coordination with hospital staff and patient relocation during shutdowns for repairs to be performed. Shutdowns will not be allowed during the hours of 6:00am to 10:00am during the regular work week (Monday to Friday). Shutdowns will not be permitted for the entire facility. When a shutdown is required for Bldg 107, then Bldg 148 must remain online, engaged, and intact. The same goes for if a shutdown is required for Bldg 148, then Bldg 107 must not be taken down for repairs. Once repairs are started, then repairs that require an outage shutdown must be completed within 3 days and will not coincide with weekends or holidays. If a repair will require the system to be down longer than eight (8) hours, then the contractor will be required to provide two (2) backup oxygen system tanks (Dewars) with a manifold setup, and it must be equipped with an alarm tied into the medical gas master alarm panel. The tanks will be required to be equipped with an automatic transfer switch in the event that one tank is low, it will engage the second so there will be no loss of oxygen flow. Salient Characteristics Vacuum System Medical Vacuum Single Point Connection Base Mount System 208VAC, 3 PH, 60 Hz Main electrical connection 65kAIC SCCR rating 200-gallon air receiver with three-valve bypass 104 scfm NFPA system capacity @ 19" Hg Integrated HEPA air inlet filter per pump with glass collection canister Total Alert Embedded Control System with Touchscreens High-detail 5.7 touchscreen displays vital system information, alarms and warnings, 3.5 service screens and event logs Embedded web server, remote monitoring, and e-mail/pager alerts Ethernet connectivity for simple installation and Total Alert networking NEMA 12 control panel enclosure 24V control circuit 65 kAIC SCCR rating BACnet communication with TCP/IP protocol Single point connections Non-Contacting, Dry Claw technology BACnet compatible for connection to medical air, gas, vacuum alert panel 6.4 HP Motor 82 dB Noise Level 63.9 FLA rating Base (66in x 52.5in) Height 84.48in Overall (68.54in x 66.93in x 84.48in) 3 Flange Discharge Connection 3 Flange Inlet Connection ½ FNPT Condensate Drain Medical Air System Medical Air Duplex 5 HP Lifeline Single Point Connection System 208VAC, 3 PH, 60 Hz Main electrical connection 65kAIC SCCR rating Heavy-duty isolation system Integrally mounted corrosion resistant ASME Coded 80-gallon air receiver cfm NFPA system capacity @ 50 psig Fully NFPA 99 code compliant Single point connections High-detail touchscreen displays vital system information, alarms and warnings, service screens and event logs Embedded web server, remote monitoring, and e-mail/pager alerts Ethernet connectivity for simple installation and Total Alert networking Total Alert Embedded Control System with Touchscreens High-detail 5.7 touchscreen displays vital system information, alarms and warnings, 3.5 service screens and event logs Embedded web server, remote monitoring, and e-mail/pager alerts Ethernet connectivity for simple installation and Total Alert networking NEMA 12 control panel enclosure 24V control circuit 65 kAIC SCCR rating BACnet communication with TCP/IP protocol Pre-piped and wired dew point sensor and CO sensor with remote contacts Duplexed drying system with purge-controlled desiccant dryers with mounted prefilters, after filters, and regulators Quiet oil-less scroll technology BACnet compatible for connection to medical air, gas, vacuum alert panel 5 HP Motor 70 dB Noise Level 27.0 FLA rating Overall (47.5in x 34.5in x 74.0in) ¾ FNPT Discharge Connection 1 ½ FNPT Inlet Connection ½ FNPT Condensate Drain Medical Air System Medical Air Triplex 5 HP Lifeline Single Point Connection System 208VAC, 3 PH, 60 Hz Main electrical connection 65kAIC SCCR rating Heavy-duty isolation system Integrally mounted corrosion resistant ASME Coded 120-gallon air receiver cfm NFPA system capacity @ 50 psig Fully NFPA 99 code compliant Single point connections High-detail touchscreen displays vital system information, alarms and warnings, service screens and event logs Embedded web server, remote monitoring, and e-mail/pager alerts Ethernet connectivity for simple installation and Total Alert networking Total Alert Embedded Control System with Touchscreens High-detail 5.7 touchscreen displays vital system information, alarms and warnings, 3.5 service screens and event logs Embedded web server, remote monitoring, and e-mail/pager alerts Ethernet connectivity for simple installation and Total Alert networking NEMA 12 control panel enclosure 24V control circuit 65 kAIC SCCR rating BACnet communication with TCP/IP protocol Pre-piped and wired dew point sensor and CO sensor with remote contacts Duplexed drying system with purge-controlled desiccant dryers with mounted prefilters, after filters, and regulators Quiet oil-less scroll technology BACnet compatible for connection to medical air, gas, vacuum alert panel 5 HP Motor 71 dB Noise Level 40.5 FLA rating Base (66.0in x 62.0in) Height 81.9in Overall (66.0in x 62.0in x 81.9in) 1 FNPT Discharge Connection 2 FNPT Inlet Connection ½ FNPT Condensate Drain Medical Gas Alarm Panels 10.2 Touch Screen LCD Display Ethernet Connectivity with Embedded Web Page Accessible through any SMTP Gateway Allows for remote alerts of alarm conditions Event Logging 4-20mA Options BACnet Compatible for conformance to the current building automation system (BAS) Audible Horn with minimum of 80dBA measured at 3 ft and adjustable to 90dBA at 3 ft. Wi-Fi 802.11 b/g/n to enable interface to panel web page and retrieve operating information and event history. Input power 100 to 250 VAC 50/60 Hz, fused on input side and rated at 250mA, time delayed. Internal power conversion to low voltage 24VDC. Alarm should have Biomaster (an additive proven to reduce bacterial growth). Pipe connections are 3/8 nominal (1/2 OD) type K copper tube and include a DISS check fitting. Should accommodate 1 to 8 gases and monitor up to 60 normally closed dry contact switches wired locally. Should also be retrofit capable to be installed in existing wall enclosures. Dimensions (14.0in x 9.0in) Wiring Requirements Wiring or cabling shall be shielded cable to protect from frequency interference. If installed in conduit, and if spliced, cabling must be protected from frequency interference and protected by properly rated enclosures and wireways to include all splicing connections. Medical Gas Manifolds Should include a line pressure gauge with two bank contents gauges. LED electronics overlay for easy visual status of gas flow. Left Bank and right bank LED visual indicators In Use (Green) Ready (Green) Empty (Red) Secondary Low (Yellow) Reserve in Use (Yellow) Reserve Low (Red) Power source and control board furnished inside a pre-mounted NEMA 4 enclosure. 250mA max at 100-250 VAC, 50/60 Hz single phase input to 24VDC output ¾ FNPT (manifold outlet) ½ FNPT (high-preserve reserve header inlet) O-ring sealed zero clearance unions ¾ full port with 3-piece, ball-type source shut-off valve with 1/8 FNPT port Source valve has ¾ NPT attachment to union outlet and ¾ nominal copper (type K) tube for brazing to main supply line 5.8 SCFM (350 SCFH) for Oxygen gas flow ¼ shut-off valve to isolate manifold from hospital piping Connections to liquid container (primary) side provided on one end and connections to 10 high pressure cylinder containers (secondary) side provided on the other end Control Box/Panel dimensions 20 W x 18.25 H x 9.88 D Overall manifold length 61 inches (for liquid tank & high pressure 10 tanks) Overall manifold length 86 inches (high pressure tanks 10 tanks) Embedded web server, remote monitoring Ethernet connectivity for simple installation and networking Accessible through any SMTP gateway BACnet compatible for connection to alert panels and building automation systems (BAS) Acronym Legend kAIC available interrupting current x 1000 SCCR short-circuit current rating FLA full load amperes FNPT female national pipe thread NPT national pipe thread scfm standard cubic feet per minute scfh standard cubic feet per hour NEMA National Electrical Manufacturers Association BACnet Building Automation and Control networks TCP/IP transmission control protocol/internet protocol BAS building automation system ASME American Society of Mechanical Engineers NFPA National Fire Protection Association CO carbon monoxide LCD liquid crystal display SMTP simple mail transfer protocol DISS diameter index safety system psig pounds per square inch gauge Specific Tasks Medical Air Compressors Replace and remove medical air compressors (2) one air compressor at Bldg 107 (Powerex) & one air compressor at Bldg 148 (Beacon Medaes). Install new medical air compressors and connect to piping. Bldg 148 Medical Air Compressor will need to be changed out however when the system is shutdown, the work must be completed within three (3) days and cannot coincide with weekends or holidays. Coordination must be done with facility staff prior to shutdown to determine impact to patient care. Bldg 107 Medical Air Compressor system can be installed in room A next to the existing Medical Air & Vacuum room B. The piping can be attached or connected to a medical air valve pipe with the marking of future designated on the pipe. This will allow for limited total down time between the replaced system and new system being started and made operational. Once the old medical air compressor is isolated, then this can be removed. These details are needed because at this moment there are electrical panels that are situated in these rooms and are currently not meeting the required working distances for electrical panels in accordance with NFPA 70 & 70E. These panels require a minimum of 36 inches of distance for allowable working space. By completing the above in this order will minimize the total downtime to the facility medical air and vacuum systems and limit the total impact to patient care. Medical Vacuum Compressor Replace and remove medical vacuum compressor at Bldg 107 (Powerex). Install new medical vacuum compressor and connect to piping. Bldg 107 In room B, prior to the existing Medical Vacuum system being removed, the new Vacuum system will be installed in the same space where the previous medical air compressor was removed. Once the vacuum system has been installed and operational, the previous system can be removed. These details are needed because at this moment there are electrical panels that are situated in these rooms and are currently not meeting the required working distances for electrical panels in accordance with NFPA 70 & 70E. These panels require a minimum of 36 inches of distance for allowable working space. By completing the above in this order will minimize the total downtime to the facility medical air and vacuum systems and limit the total impact to patient care. Medical Gas Manifolds, Valves, Piping, Gauges repairs and replacements. Replace bad leaking manifolds, valves, piping, gauges at buildings 107, 148, 160, and 162. Manifolds at Bldg 162 in the O2 bulk tank area need to be replaced due to leaking with proper valves and manifolds and should be inspected and tested. Manifolds for backup tanks in the O2 bulk tank area need to be replaced due to leaking with proper valves and manifolds and should be inspected and tested. Gas manifolds, valves & gauges at Bldg 107 for secondary tanks need to be replaced due to leaking with proper valves, manifolds, and gauges and should be inspected and tested. Vacuum and Medical Air compressor valves, manifolds, gauges, and isolation valves in Bldg 107 need to be replaced due to leaking with proper required valves, manifolds, gauges, and isolation valves and inspected and tested. Medical Air compressor valves, manifolds, gauges, and isolation valves in Bldg 148 need to be replaced due to leaking with the proper required valves, manifolds, gauges, and isolation valves and inspected and tested. Medical Gas Master Alarm Panels Replace medical gas master alarm panels one (1) is located in Bldg 107 in the Bio Medical shop area, and one (1) is located in Bldg 160 in the ED area. Remove completely one (1) master alarm panel from Bldg 148 close to the Dementia ward. Install new medical gas master alarm panels one (1) in Bldg 107 in Bio Medical shop and one (1) in Bldg 160 in ED area. Reuse existing box enclosures for both medical air master alarm panels and connect to newly installed wiring. Connect to BACnet system and server used for building automation system (BAS) so that Boiler Plant can receive Medical Gas alerts and alarms through the central building automation system (BAS). Provide remote monitoring of the bulk tank area to alarm system through the BAS or BACnet. Provide a solution or recommendation by evaluation for monitoring the O2 bulk tank area of O2, Air, Vacuum for flow and usage. Wiring for Alarm Panels Replace deteriorated wiring connected to medical gas alarm panels and system with new wiring and network cabling. Wiring will use existing raceways, conduits, and boxes. Cable and wiring shall be shielded and protected from any frequency interference throughout system to include all wireways, junction boxes, splices, and connections/terminations. Evaluate O2 Fill Connection Port Need to assess and survey relocation of the O2 fill connection port that is still attached to building 148 when building 162 was built (where the dock was located). We would like to get this evaluated to determine if this fill port is required in accordance with NFPA 99. If the port that is located inside of Bldg 148 is not required, then we would like to have it disabled and removed back to the T-connection which is located in the old SPS area. This will also require inspection, verification, and certification once completed by a certified Medical Gas Inspector. Medical Gas Testing, Inspection, and Certification Complete Medical Gas Inspection, testing, and certification with a provided report on the total NAVAHCS Medical Gas System. All critical components of the piped medical gas system including master signal panels, area alarms, automatic pressure switches, shutoff valves, flexible connectors, and outlets (to include usage ports at patient care areas), shall be tested, inspected, and maintained in compliance with NFPA standards by the Contractor. The documentation shall be provided in electronic format and a hard copy format will be provided in a 3-ring binder. As-Built Drawings of the Medical Gas System Provide as-built drawings of the Medical Gas system upon completion of the contract. A current set of as-built drawings will be provided by facility staff. The drawings shall include layout of the total medical gas system, medical vacuum system, O2 system, master alarm & area alarm system with locations, isolation valves and locations for the total NAVAHCS Medical Gas System. This should be provided in electronic formats (pdf and CAD) upon completion of the contract. PERFORMANCE MEARSURES (IF A SERVICE IS INVOLVED) Performance measures are comprised of performance indicators (some characteristic of a deliverable that can be measured) and performance measures (a mark, measure, or benchmark that government personnel use as a point of comparison when evaluating contractor performance). The Government performs surveillance to determine if the contractor exceeds, meets, or does not meet these measures. The Performance Requirements Summary Matrix, paragraph in the Performance Work Statement (PWS), includes performance measures. The Government shall use these measures to determine contractor performance and shall compare contractor performance to the Acceptable Quality Level (AQL). VA INFORMATION SYSTEM SECURITY/PRIVACY CLAUSES GENERAL SECURITY REQUIREMENTS: Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS: A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data- General, FAR 52.227-14(d) (1). VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA s information is returned to the VA or destroyed in accordance with VA s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures comply with VA directive requirements. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated. The contractor/subcontractor s firewall and Web services security controls, if applicable, shall meet or exceed VA s minimum requirements. VA Configuration Guidelines are available upon request. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR. Security Incident Investigation: The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident. Liquidated Damages for Data Breach: Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. Each risk analysis shall address all relevant information concerning the data breach, including the following: Nature of the event (loss, theft, unauthorized access); Description of the event, including: date of occurrence; data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code; Number of individuals affected or potentially affected; Names of individuals or groups affected or potentially affected; Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; Amount of time the data has been out of VA control; The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); Known misuses of data containing sensitive personal information, if any; Assessment of the potential harm to the affected individuals; Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: Notification; One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; Data breach analysis; Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs. SECURITY CONTROLS COMPLIANCE TESTING: On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time. Training: All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems: Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems; Successfully complete the VA Privacy and Information Security and Rules of Behavior training and annually complete required security training; Successfully complete the appropriate VA privacy training and annually complete required privacy training; and Successfully complete any additional information security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.] The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete. INVOICES Payments will be made upon receipt of a properly prepared detailed invoice, prepared by the Contractor, validated by the Contracting Officer s Representative (COR), and submitted electronically through OB-10. A properly prepared invoice will contain: Invoice Number and Date Contractor s Name and Address Accurate Purchase Order Number Supply or Service provided Total amount due The information identified above is intended to be descriptive, not restrictive and to indicate the quality of the supplies/services that will be satisfactory. It is the responsibility of the interested source to demonstrate to the government that the interested parties can provide the supplies/services that fulfill the required specifications. If you are interested and are capable of providing the sought-out supplies/services, please provide the requested information as well as the information indicated below. Response to this notice should include company name, address, point of contact, size of business pursuant to the following questions: (1) Please indicate the size status and representations of your business, such as but not limited to: Service-Disabled Veteran Owned Small Business (SDVOSB), Veteran Owned Small Business (VOSB), HUBZone, Woman Owned Small Business (WOSB), Large Business, etc.) (2) Is your company considered small under the NAICS code identified under this RFI? (3) Are you the manufacturer or distributor of the items being referenced above (or equivalent product/solution)? What is the manufacturing country of origin of these items? (4) If you re a small business and you are an authorized distributor/reseller for the items identified above (or equivalent product/solution), do you alter; assemble; modify; the items requested in any way? If you do, state how and what is altered; assembled; modified? (5) Does your company have an FSS contract with GSA or the NAC or are you a contract holder with NASA SEWP or any other federal contract? If so, please provide the contract type and number. (6) If you are an FSS GSA/NAC or NASA SEWP contract holder or other federal contract holder, are the referenced items/solutions available on your schedule/contract? (7) Please provide general pricing for your products/solutions for market research purposes. (8) Please state your company s DUNS number. (9) Please submit your capabilities in regard to the SOW being provided and any information pertaining to services to establish capabilities for planning purposes? *** Submissions addressing Section (9) should show clear, compelling and convincing*** evidence that all services meet all required SOW. Responses to this notice shall be submitted via email to Clift.Domen@va.gov. Telephone responses shall not be accepted. Responses must be received no later than Tuesday, July 26th, 2022, at 1:00 p.m. PDT. If a solicitation is issued it shall be announced at a later date, and all interested parties must respond to that solicitation announcement separately from the responses to this request for information. Responses to this notice are not a request to be added to a prospective bidders list or to receive a copy of the solicitation.
