The Amarillo VA Health Care System (AVAHCS) is seeking Service Disabled Veteran Owned Small Business (SDVOSB) or Veteran Owned Small Business (VOSB) sources capable of meeting the requirement listed below. The acquisition will be accomplished using commercial item procedures in accordance with FAR Part 13. NOTE: TO QUALIFY SDVOSB AND VOSB VENDORS MUST BE CERTIFIED IN THE VA VENDOR INFORMATION PAGES (VIP) DATABASE. The North American Industry Classification System (NAICS) are 524298, 524292, 541214 or 541219.. Any SDVOSB or VOSB firms who wish to identify their interests and capability to provide this product must provide product specifications, performance and delivery information by notifying the Contract Specialist no later than NOON PM Central Time, February 14, 2017. Notification shall be e-mailed to Lula Hill, at
[email protected]. DISCLAIMER This Source Sought Notice is issued solely for information and planning purposes only and does not constitute a solicitation. All information received in response to this Notice that is marked as proprietary will be handled accordingly. In accordance with the Federal Acquisition Regulation, responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. Responders are solely responsible for all expenses associated with responding to this Notice. SCOPE: 1. Amarillo Veterans Administration Health Care System (AVAHCS) is committed to providing Veteran patients served by Community Based Outpatient Clinics (CBOC s) a way to have emergent prescription needs filled quickly near where they live to preclude the need to drive longer distances to Department of Veterans Affairs (VA) pharmacies. Once a Veteran patient s emergent prescription need is met, subsequent refills can be provided by mail from a VA pharmacy. (a) Pharmacy requirements exist for AVAHCS to provide a mechanism whereby a Veteran patient seen at a Community Based Outpatient Clinic (CBOC) without an onsite pharmacy may have Pharmacy Services provided by a local contract Pharmacy for a defined list of medications on an emergent basis until therapy is complete or the patient s assigned VA Pharmacy can deliver a standard supply. (b) The contractor shall provide pharmacy services, specifically filling an estimated 200 prescriptions on an annual basis, to be located within a ten (10) mile radius or adjacent to the premises of a Department of Veterans Affairs (VA) CBOC associated with Amarillo Veterans Administration Health Care System Amarillo, Texas. The VA will designate pharmacy/pharmacies the contractor shall utilize. 2. The contractor will provide qualified personnel who will fulfill the requirement to provide Pharmacy services at a standard enabling AVAHCS to provide such services at a high level of quality. Services shall include the dispensing of pharmaceuticals reflected on the AHAHCS emergent pharmaceutical formulary listing as prescribed by authorized CBOC staff. CBOC providers prescribing emergent medications for Veterans from the formulary listing will complete a VA Initial Fill Certificate that will contain the Veteran s full name, and a 9-digit identifier (usually the social security number). The Veteran will take this certificate to a local contract pharmacy to have the emergent prescription filled. The emergent pharmaceutical listing may include vaccines and other injectable medications. When authorized CBOC staff prescribes an injectable from the list, the dispensing pharmacy will administer the injectable to the patient for a standard administration fee to be covered under the contract. Primarily, new prescriptions will be filled. In rare instances, where refills may be necessary, the Pharmacy filling the prescription will be provided a pre-authorization by the Chief, Pharmacy Service. Unless otherwise pre-authorized, prescription fills will be limited to a maximum of a 10-day supply. Prescriptions filled under this contract will be, to the extent permitted by law, the least expensive drug product the pharmacy has in stock. Generic drugs will be dispensed whenever possible. A product is not considered a generic equivalent unless the strength, quantity and dosage are the same as the brand name product. The generic name must be displayed on all labels for all medication. The authorized pharmacy will provide the date of filling, quantity provided (if other than the prescribed quantity), the prescription number and name or initials of the responsible pharmacist. The contractor shall be paid only for those prescriptions that are approved by the VA CBOC. A point of contact (POC) for this contract will be designated within 5 days of the contract award, and the Contracting Officer (CO) notified of the POC in writing. The name and address of the local servicing pharmacy will be provided to the CO within 10 days of contract award. The contractor shall provide a high level of quality service to both patients and VA CBOC providers. Communication with providers should be open and immediate in order to resolve professional issues. Patient satisfaction is paramount procedural issues should be immediately resolved with the designated COR. The contractor will be required to adhere to VA requirements regarding the use and disclosure of Protected Health Information (PHI) and Electronic Protected Health Information (EPHI). Payment will be made monthly in arrears for services rendered after receipt of properly submitted electronic invoice. Invoices must be submitted through the Invoice Payment Processing System (IPPS) within 30 days of service, to include total charges for the period and the contract number. Invoices will be accompanied by supporting documents to include: Patient s name Patient s Social Security Number (last four is acceptable) Prescription number Provider name Name of medication NDC number of the dispensed drug Contractor s charge Date prescription filled 3. REFERENCES: Federal Standards and Guidance: (1) The Health Insurance Portability and Accountability Act (HIPAA) of 1996 Computer Security Act of 1987, Public Law 10-235 (2) OMB Circular A-123 Internal Control Systems (3) OMB Circular A-130 Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources (4) 5 U.S.C. 552a, Privacy Act of 1974, 5 United States Code 552a, Public Law 99-08. (5) 5 U.S.C. 552, Freedom of Information Act, 5 United States Code 552, Public Law (6) 18 U.S.C. 1030 (a) (3), Fraud and related activity in connection with computers. (7) Electronic Communications Privacy Act of 1986, Public Law 99-08, 100 Stat. 1848. b. Agency Policy and Guidelines: (1) VA Directive 6210, Automated Information Systems (AIS) Security Procedures (2) VA Directive 6214, Information Technology Security Certification and Accreditation Program Local Policies: AVAHCS MCM ISO-03-0414, Policy and Procedures for Obtaining & Managing Remote Access to Amarillo Info Systems AVAHCS MCM ISO-01-0414, Information Security Program AVAHCS MCM ISO-06-0414, Policy and Procedures for Reporting and Managing Information Security and privacy. AVAHCS MCM ISO-04-0414 , Sensitive Record Access Monitoring 4. DELIVERABLES: The contractor shall provide pharmacy services, specifically filling an estimated 200 prescriptions on an annual basis, to be located within a ten (10) mile radius or adjacent to the premises of the Department of Veterans Affairs (VA) CBOC s associated Amarillo Veterans Administration Health Care System, Amarillo, Texas. The contractor will ensure contract pharmacies dispense pharmaceuticals reflected on the AVAHCS Emergent Pharmaceutical Listing as prescribed by authorized CBOC staff. The emergent pharmaceutical listing may include vaccines and other injectable medications; when a contract pharmacy administers an injectable medication, a standard administration fee will be charged. Unless otherwise pre-authorized, prescription fills will be limited to a maximum of a 10-day supply. Prescriptions filled under this contract will be, to the extent permitted by law, the least expensive drug product the pharmacy has in stock. Generic drugs will be dispensed whenever possible. A product is not considered a generic equivalent unless the strength, quantity and dosage are the same as the brand name product. The generic name must be displayed on all labels for all medication. The authorized pharmacy will provide the date of filling, quantity provided (if other than the prescribed quantity), the prescription number and name or initials of the responsible pharmacist. 5. QUALITY ASSURANCE SURVEILLANCE PROGRAM (QASP): The contractor will ensure quality pharmacy services are provided timely, by qualified and competent staff, and that any related PHI and EPHI is safe-guarded at all times in accordance with VA requirements. 6. SECURITY CONSIDERATIONS: Safeguarding PHI and EPHI is a primary concern for VA staff and must be a primary concern for contractor personnel providing services under this contract. The contractor will ensure that should contractor personnel cause and/or identify a breach of PHI or EPHI, such will be reported immediately to the Chief, Pharmacy Service, Amarillo Veterans Administration Health Care System and/or the COR. 7. PRIVACY INFORMATION: The C&A requirements do not apply and a Security Accreditation Package is not required. a. Information Systems Officer, Information Protection: The contractor will not have access to VA Desktop computers, nor will they have access to online resources belonging to the government while conducting services. b. Privacy Officer: The contractor will have access to Veterans patient health information in the form of a Veteran s full name, a 9-digit identifier (usually the Social Security number) provided by the VA CBOC via a hardcopy initial prescription fill certificate. The contractor will not have the capability of accessing other patient information during the services provided to the VA. SECURITY INCIDENT INVESTIGATION a. The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. b. To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident. LIQUIDATED DAMAGES FOR DATA BREACH a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. b. The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. c. Each risk analysis shall address all relevant information concerning the data breach, including the following: 1. Nature of the event (loss, theft, unauthorized access); 2. Description of the event, including: (a) Date of occurrence; (b) data elements involved, including any PII, such as full name, social security number date of birth, home address, account number, disability code; 3. Number of individuals affected or potentially affected; 4. Names of individuals or groups affected or potentially affected; 5. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; 6. Amount of time the data has been out of VA control; 7. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); 8. Known misuses of data containing sensitive personal information, if any; 9. Assessment of the potential harm to the affected individuals; 10. Data breach analysis as outlined in 6500.2 Handbook, Management of Breaches Involving Personal Information, as appropriate; and 11. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised. d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $31.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: 1. Notification; 2. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; 3. Data breach analysis; 4. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; 5. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and 6. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs. Records Manager: (1) Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228. (2) Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. (3) Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records. (4) Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act. (5) Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract. (6) The Government Agency owns the rights to all data/records produced as part of this contract. (7) The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data. (8) Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.]. (9) No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules. (10) Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.