DISCLAIMER

This Sources Sought is issued solely for information and planning purposes only and does not constitute
a solicitation. All information received in response to this Sources Sought that is marked as proprietary
will be handled accordingly. Responses to this notice are not offers and cannot be accepted by the
Government to form a binding contract. Responders are solely responsible for all expenses associated
with responding to this Sources Sought.

SOURCES SOUGHT NOTICE

VA Pacific Health Care System
Health Care for Homeless Veterans
EMERGENCY CONTRACTED HOUSING
STATEMENT OF WORK
Housing First/Dry House

Description of Services: Emergency Residential Placement and Case Management Services on a per
diem basis in accordance with Performance Work Statement

Estimated QTY: 2 Veterans per night

Location: Honolulu County

Estimated Period of Performance: October 1, 2018 – September 30, 2023

NAICS Code: 624221

Response Date: March 26, 2018

Contracting Office Address:

Department of Veteran Affairs

VA Sierra Pacific Network (VISN 21)
VA Northern California HealthCare System
5342 Dudley Blvd, Bldg. 209
McClellan, CA 95652-2609
Contract Specialist

Only firms interested and capable should send their information and capability statement and any
questions by email to Brian Trahan at [email protected] no later than 4:30pm Pacific Standard Time,
March 26, 2018. Information should include all the following:

Name of Company
Company Website
Address of Company
Facility size (in square feet)
Facility Address
Number of Beds Available

Capability Statement and copy of business license and insurance

Previous contracts
Licenses

POC Name
Phone
Email Address

References

DUNS number
VIP (if applicable)
Small Business Size
NAICS code
Socioeconomic Status
 VA Pacific Health Care System
Health Care for Homeless Veterans

EMERGENCY CONTRACTED HOUSING

STATEMENT OF WORK
Housing First/Dry House*

1. Emergency Contracted Housing/Housing First/Dry House

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations,
standards, and VA Directives and Handbooks regarding information and information system security as
delineated in this contract. This Veteran Health Administration (VHA) program provides emergency short
term housing to eligible Veterans through contracted agencies (contractor). The purpose of this housing
is to provide needed stability while additional short and long term supports are identified and accessed in
conjunction with the Veteran’s identified goals and wishes. Substance/Alcohol abstinence is expected.

2. Eligibility and Duration

A. Homeless: To be eligible for placement in a resident, all Veterans must be homeless or at
imminent risk of becoming homeless and must be eligible and registered for VA services. More
specifically, before contractors can bill for services provided to a Veteran, they must verify thru
the submission of a completed VA homelessness assessment, called a “HOMES assessment”
within the previous 30 days. This serves as verification of homelessness.
B. Denial: If denied eligibility/admission to the program the Veteran must be explained in writing
with copies to VA.
C. Open Beds: The contractor shall make every effort to keep the contracted number of beds
available for Veterans.
D. Length of Stay: The contractor shall furnish services to the beneficiaries for whom such care is
specifically authorized by VHA for the period not to exceed 75 days. An extension will be
considered after 75 days which will require justification and approval from the Emergency
Housing Coordinator, subject to the availability of funds. It is understood that the type of
Veterans to be cared for under this contract will require care and treatment services over and
above the level of room and board.
E. Informed Consent: The contractor shall utilize the VA material regarding Releases of
Information, Emergency Housing Admissions form, Veteran Rights and Responsibility, the
Housing Support Plan and other information as needed. The contractor may also utilize
admission and other forms that are specific to their agency.

3. Services to be provided
The contractor shall furnish each Veteran authorized for care under this contract with the
following basic services:
A. Residential Room and Board
1. Residential Rooms – The environment shall be clean, in good repair and free of rodent and
insects. Bedroom and bathroom space be appropriate and shall be of sufficient size as
determined by VHA. Each resident shall be provided with a bed and frame, bed linens, and
towels. Single bedrooms shall accommodate no more than 2 beneficiaries, unless
specifically authorized by VHA. Bathrooms (toilets, basins and showers) will be located
within the living space or located within a reasonable distance on the same floor of the
1
 living space. Showers and toilets must be kept clean. A secure space for belongings off the
floor, example includes dresser or cabinets for personal clothing and effects shall be
provided. In addition privacy shall be provided to the resident. Common area space shall be
equipped with seating and accessible to all residents.

2. Meals – The contractor shall provide nutritious meals. Food shall be prepared, served and
stored under sanitary conditions. Unless deemed inappropriate for the facility by VHA the
facility shall provide storage space in an onsite refrigerator for Veterans to store personal
food. The facility shall establish and maintain sanitary procedures for washing dishes,
cleaning equipment and work areas, and disposing of waste. At least three nutritious meals
or their equivalent shall be served daily at regular times with not more than a 14 hour span
between evening meal and breakfast of the following day. Snacks of nourishing quality, i.e.
fruits, shall be offered between meals or bedtime.

3. Laundry – Laundry facilities shall be available on site for residents to do their own laundry.

B. Support Services
1. Transportation – The contractor shall assist the Veteran to scheduled meetings and
appointments through the provision of transportation or secure public transportation for the
beneficiary thru the provision of bus passes.

2. On site rules and regulations – The contractor shall provide residents at the time of
admission the rule and regulations for program participants who shall include at minimum the
admissions process, rights and responsibilities, response to rule infractions, discharge criteria,
process for complaints and other program expectations. VHA shall be provided with a copy of
these rules and regulations.

3. Staffing- The contractor shall employ sufficient staff and other personnel to carry out the
policies and procedures of the program. There will be, at a minimum, an employee on duty on
the premises, or residing at the program and available for emergencies, 24 hours a day, 7 days
a week. All contractor staff providing services to Veterans under this contract must undergo
an appropriate background investigation.

D. Program Service
1. Case Management – The contractor shall assign a case worker as the primary contact for
the Veteran as well as the VHA representative. This case worker will, in conjunction with the
program participant and the VHA representative, develop a Housing Support Plan (HSP)
which outlines the planned services and supports which will assist the participant in their
efforts to secure permanent housing. The extent of service provision in the HSP will depend
greatly on the Veteran’s desires, wishes and their perceived motivation. The case worker
provided may include but not be limited to the following:

a. Provide direct assistance supporting the Veteran’s access to affordable, supported,

senior , or other housing options using the Veteran’s, program’s , community or VA
resources.

2
 b. Provide direct assistance supporting the Veteran’s accessing eligible financial and
supportive programs i.e. SS, SSDI, General Assistance, Food Stamps, VA service
connected benefits, etc. and as needed secure and assist in application preparation
and/or transportation to benefit site.
c. Provide where identified direct support for the Veteran’s coordination, referral and
attendance at PTSD and substance programs either at VA or at other programs.
d. Facilitate the Veteran’s attendance at medical and mental health programs at VA by
assuring awareness of program scheduling and transportation as needed.
e. Where appropriate support the Veteran to connect with peers and their family.
f. Provide direct discharge planning support by assisting the Veteran’s transition to next
environment.
g. Communicate with the VHA representative through the regular submission of a
summary and/or meetings which address the Veteran’s progress of the Housing
Support Plan or on issues that may arise.

E. Onsite Support Services – The contractor shall provide supportive services to individuals who
are receiving mental health and/or substance use therapies. This support will be determined
by the individual resident in the HSP. These services may include individual and group
support to reinforce or process existing therapeutic services provided by VA or other service
providers.

4. Administrative
A. Billing - Unless specifically excluded in the contract, the per diem rate established will include
the services listed in this document and will also include all services or supplies normally
provided other residents by the facility without extra charge. Payments made by the VA
under this contract shall constitute the TOTAL cost of care and housing of the homeless
Veterans. If a beneficiary is admitted to and discharged from the program on the same
calendar day, payment will not be authorized. Extended absences of the patient from the
facility will not be reimbursed unless authorized by the Emergency Housing Coordinator.

B. Records – The contractor shall make available to the VA, documentary information deemed
necessary by the VA to conduct utilization review audits for the mandated national
evaluation study as required by Section 2 of Public Law 100-6; to verify quality of patient care
for Veterans, to assure confidentiality of patient care for Veterans, to assure confidentiality
of patient record information and to determine the completeness and accuracy of financial
records. The facility shall maintain an individual client record on each Veteran admitted
under this contract. The facility shall comply with the requirements of the “Confidentiality of
Alcohol and Drug Abuse Patient” (38 CFR, Part II) and the “Confidentiality of Certain Medical
Records” (38 USC 4132). In addition contractor shall comply with standards of practice for
record storage and confidentiality set forth in the Commission on Accreditation of
Rehabilitation Facilities (CARF). All case records shall be secured and confidential. Records
will be made available on a need-to-know basis to appropriate VA staff members involved
with the treatment program of the Veteran concerned. The files shall include:
1. Reasons for referral.
2. All essential identifying data relevant to the resident including a weekly progress

3
 reports or notes, and documentation of any case management interventions or
patient care conferences.
3. Where appropriate copies of any medical prescriptions issued by physicians,
including orders, if any, for medications to be taken.
4. Final summaries on each resident who leaves the program, to include reasons for
leaving, the resident’s future plans, and follow-up locator information.
5. Incident Reports: The contractor shall notify the authorizing VHA representative
immediately of any incident involving Veterans residing in the residential program.
The contractor shall provide the VHA representative with a copy of the incident
report within 24 hours.

C. Reporting- The contractor shall comply with the reporting requirements as identified by the
VHA representative. This will include a monthly submission on the progress of the Veteran
on their HSP and the case management activity provided.

D. Fire, Safety, and Sanitation Practices - Facilities shall conform to the standards of the Life
Safety Code, National Fire Protection Association #101, Chapters 10 and 11. For additional
information, or to obtain copies, contact NFPA: http://www.nfpa.org, NFPA Headquarters
address: National Fire Protection Association, 1 Batterymarch Park, Quincy, MA. 02269,
Phone: 617-770-0700. The facility shall meet the requirements of Public Law 100-336, 42 USC
12101-12213, and Americans with Disabilities Act pertaining to handicapped accessibility in
effect on the date of contract award. Facility shall also conform to the fire and safety code
imposed by the State which adequately protects residents. In addition the contractor facility
must also meet fire safety requirements as follows:
a. All residents in the facility must be mentally and physically capable of leaving the
building unaided in the event of an emergency.
b. Fire exits drill must be held at least quarterly. Residents must be instructed in
evacuation procedures when the primary and /or secondary exits are blocked. A
written fire plan for evacuation in the event of fire shall be developed and
reviewed annually. The plan shall outline the duties, responsibilities and actions
to be taken by staff and residents in the event of a fire emergency. This plan shall
be implemented during fire exit drills.
c. A written policy regarding tobacco smoking in the facility shall be established and
enforced.
d. Portable fire extinguishers shall be installed at the facility. Use NFPA 10, Portable
Fire Extinguishers, as guidance in selection and location requirements of
extinguishers.
e. Requirements for fire protection equipment and systems shall be in accordance
with NFPA 101 as it pertains to the type and size of the facility. All fire protection
systems and equipment, such as the fire alarm system (if required), smoke
detectors, and potable extinguishers, shall be inspected, tested and maintained
in accordance with the applicable NFPA fire codes and the results documents.
f. The annual inspection by a VA team shall include a fire and safety inspection
conducted at the facility unless a review of past Department of Veteran Affairs
inspections or inspections made by the local authorities indicates that a fire and

4
 safety inspection would not be necessary, in which case the fire and safety
inspection may be waived by the VA.

5. Commission on Accreditation of Rehabilitation Facilities (CARF): While not required facilities are
encouraged to be accredited by CARF. Nevertheless, CARF standards do apply and the facility will be
required to authorize their compliance by sign off.

6. VA Patient’s Bill of Rights – The contractor shall comply with the VA Patient’s Bill of
Rights as set forth in Section 17.34a, Title 38, Code of Federal Regulations.

7. Facility Requirements - It is the responsibility of the contractor to properly maintain its facility and
the VA shall have no responsibility for paying or reimbursing the contractor for such expenses. The
contract facility must:
a. Have a current occupancy permit issued by the local and state government in the
jurisdiction where the facility is located.
b. Be in compliance with existing standards of State safety codes and local, and/or
State health and sanitation codes.
c. Be licensed under State or local authority.
d. Where applicable, be accredited by the State.
e. Be kept clean, free of bed bugs, dirt, grime, mold, or other hazardous substances
that detract from a healthy environment.
f. Be equipped with first aid equipment and an evacuation plan in case of
emergency.
g. Have windows and doors that can be opened and closed in accordance with
manufacturer standard.

8. Inspection of Facility and Program

A. Pre-inspection – Prior to the award of a contract and annually during the contract term
the VHA representatives including a Facilities Management Safety Officer plus other
subject matter experts as determined necessary by the Homeless Program Manager,
shall conduct a survey of the contractor’s facilities to be used to provide Veterans’ food,
shelter, and services. This is to assure the facility provides quality care in a safe
environment. Inspections may also be carried out at such other times as deemed
necessary by the Department of Veteran Affairs.

The contractor will be advised of the findings of the inspection team. If deficiencies are
noted during any inspection, the contractor will be given a reasonable time to take
corrective action and to notify the VHA representative that the corrections have been
made. A contract will not be awarded until noted deficiencies have been made and
eliminated. Failure by the contractor to take corrective action within a reasonable time
will be reported to the VA contracting officer. If corrections are not made to the
satisfaction of the VA, the contracting officer will consult with the appropriate officials
so that suitable arrangements can be made to discontinue plans to award a contract, or
in the case of an existing contract, to discharge or transfer Veterans and to terminate
the existing contract, as appropriate.

5
 B. Inspection Conformity– The inspection of the contractor facilities will include
inspection for conformity to the current Life Safety Code and will also include the
following:
a. General observation of residents to determine if they maintain an acceptable
level of personal hygiene and grooming.
b. Assessment of whether the facility meets applicable fire, safety and sanitation
standards.
c. Determine whether the facility’s surroundings are suitable and conductive to
social interaction and to the fullest development of the resident’s rehabilitative
potential.
d. Observation of facility operations to see if appropriate organized activity
programs are available during waking hours (including evenings) and degree to
which a high level of activity is observed in the facility, such as personal
support, physical activities, assistance with health and personal hygiene.
e. Seeking evidence of facility-community interaction, demonstrated by the nature
of scheduled activities or by information about resident contacts from
community providers and supports.
f. Observation of staff behavior and interaction with residents to determine if the
convey an attitude of genuine concern and caring.
g. Inspecting the type of meals and other nutrition provided to residents to see if it
is appetizing, nutritionally adequate and are provided in a setting which
encourages social interaction, and if nutritious snacks between meals and
bedtime are available for those requiring or desiring additional food, when it is
not medically contraindicated.
h. Making a spot check of Veteran records to ensure accuracy with respect to
Veteran’s length of stay and services provided to the Veteran consistent with
their HSP.
All Department of Veteran Affairs reports of inspections of residential facilities
providing contracted emergency housing services will be made available to all
government agencies charged with the responsibility of licensing or otherwise
regulating or inspecting such facilities

9. Contract Changes/Technical Directions

The VHA Contracting Officer is the only person authorized to approve changes or modify any of
the requirements of a contract. The contractor shall communicate with the VHA Contracting on all
matters pertaining to contract administration. Only the contracting officer in concert with the
VHA representative shall consult on any changes or issues that shall affect price, quantity or
quality of performance of this contract.

*Dry House – (Abstinence-Expected) – Appropriate for individuals, with co-morbid substance

disorder who choose abstinence, and who want to live in a sober group setting to support their
achievement of abstinence. Such homes may range from typical staffed group homes to
supported independent group sober living. In all of these settings, any substance use is a program

6
 violation, but consequences are usually focused and temporary, rather than “one strike and
you’re out”.

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE FOR INCLUSION

INTO CONTRACTS, AS APPROPRIATE

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to

the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA
personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information

and VA information systems for their employees, subcontractors, and affiliates only to the extent
necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with
VA information are subject to the same investigative requirements as those of VA appointees or
employees who have access to the same types of information. The level and process of background
security investigations for contractors must be in accordance with VA Directive and Handbook 0710,
Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is
responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security
clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to
ensure that cleared U.S. defense industry contract personnel safeguard the classified information in
their possession while performing work on contracts, programs, bids, or research and development
efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with
Defense Security Service (DSS). Verification of a Security Clearance must be processed through the
Special Security Officer located in the Planning and National Security Service within the Office of
Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the
maximum extent practical. If such services are proposed to be performed abroad and are not
disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-
U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to
address mitigation of the resulting problems of communication, control, data protection, and so
forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when
an employee working on a VA system or with access to VA information is reassigned or leaves the
contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by
the contractor or subcontractor prior to an unfriendly termination.

7
3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or

administration of this contract or information developed by the contractor/subcontractor in
performance or administration of the contract shall be used only for those purposes and shall not be
used in any other way without the prior written agreement of the VA. This clause expressly limits the
contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-
14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the
contractors/subcontractor’s information systems or media storage systems in order to ensure VA
requirements related to data protection and media sanitization can be met. If co-mingling must be
allowed to meet the requirements of the business need, the contractor must ensure that VA’s
information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA
reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to
ensure data security controls, separation of data and job duties, and destruction/media sanitization
procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not

destroy information received from VA, or gathered/created by the contractor in the course of
performing this contract without prior written approval by the VA. Any data destruction done on
behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and
Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and
Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA
Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification
by the contractor that the data destruction requirements above have been met must be sent to the
VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and
dispose of VA information only in compliance with the terms of the contract and applicable Federal
and VA information confidentiality and security laws, regulations and policies. If Federal or VA
information confidentiality and security laws, regulations and policies become applicable to the VA
information or information systems after execution of the contract, or if NIST issues or updates
applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to
negotiate in good faith to implement the information confidentiality and security laws, regulations
and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as

authorized and necessary to perform the terms of the agreement or to preserve electronic
information stored on contractor/subcontractor electronic storage media for restoration in case any
electronic equipment or data used by the contractor/subcontractor needs to be restored to an
operating state. If copies are made for restoration purposes, after the restoration is complete, the
copies must be appropriately destroyed.

8
f. If VA determines that the contractor has violated any of the information confidentiality,
privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold
payment to the contractor or third party or terminate the contract for default or terminate for cause
under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and
appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate
Agreements. Absent an agreement to use or disclose protected health information, there is no
business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an

encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet
or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of
the contract, the contractor/subcontractor may use and disclose VA information only in two other
situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s
prior written approval. The contractor/subcontractor must refer all requests for, demands for
production of, or inquiries about, VA information and information systems to the VA contracting
officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records
protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38
U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia,
alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the
contractor/subcontractor is in receipt of a court order or other requests for the above mentioned
information, that contractor/subcontractor shall immediately refer such court orders or other
requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive
information but does not require C&A or an MOU-ISA for system interconnection, the
contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a
yearly basis and provide it to the COTR.

4. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized
access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA
security procedures. The contractor/subcontractor shall immediately notify the COTR and
simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected
security/privacy incidents, or any unauthorized disclosure of sensitive information, including that
contained in system(s) to which the contractor/subcontractor has access.

9
b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA
shall identify the information involved, the circumstances surrounding the incident (including to
whom, how, when, and where the VA information or assets were placed at risk or compromised), and
any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have
discovered a data breach when the business associate knew or should have known of a breach of
such information. Upon discovery, the business associate must notify the covered entity of the
breach. Notifications need to be made in accordance with the executed business associate
agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must

concurrently report the incident to the appropriate law enforcement entity (or entities) of
jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees,
and its subcontractors and their employees shall cooperate with VA and any law enforcement
authority responsible for the investigation and prosecution of any possible criminal law violation(s)
associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil
litigation to recover VA information, obtain monetary or other compensation from a third party for
damages arising from any incident, or obtain injunctive relief against any third party arising from, or
related to, the incident.

5. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive
personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data
breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains
under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the
Security Incident Investigation section above. Upon such notification, VA must secure from a non-
Department entity or the VA Office of Inspector General an independent risk analysis of the data
breach to determine the level of risk associated with the data breach for the potential misuse of any
sensitive personal information involved in the data breach. The term 'data breach' means the loss,
theft, or other unauthorized access, or any access other than that incidental to the scope of
employment, to data containing sensitive personal information, in electronic or printed form, that
results in the potential compromise of the confidentiality or integrity of the data. Contractor shall
fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a
material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the
following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

10
(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth,
home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of
protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made
accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy
Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the
results of identity theft based on the sensitive personal information that may have been
compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible
for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the
cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3
relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit
freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

11
(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records,
histories, or financial affairs.

6. SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any
or all of the security controls and privacy practices implemented by the contractor under the clauses
contained within the contract. With 10 working-day’s notice, at the request of the government, the
contractor must fully cooperate and assist in a government-sponsored security controls assessment
at each location wherein VA information is processed or stored, or information systems are
developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of
Inspector General. The government may conduct a security control assessment on shorter notice (to
include unannounced assessments) as determined by VA in the event of a security incident or at any
other time.

7. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA
information systems shall complete the following before being granted access to VA information and
its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for
compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information
and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and
annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy
training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA
personnel with equivalent information system access [to be defined by the VA program official and
provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based
information security training required in accordance with NIST Special Publication 800-16, Information
Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training
certificates and certification of signing the Contractor Rules of Behavior for each applicable employee
within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within
the timeframe required, is grounds for suspension or termination of all physical or electronic access
privileges and removal from work on the contract until such time as the training and documents are
complete.

12