This notice is being published in accordance with Federal Acquisition Regulation (FAR) Part 5.101(a)(2) requiring the dissemination of information on proposed contract actions. This is a notice of intent to award a sole-source contract pursuant to 10 U.S.C 2304 (C)(1), as implemented by FAR 6.302-1(a)(2) and 6.301-1(c), only one responsible source and no other supplies or services will satisfy agency requirements, and brand-name descriptions. The Department of Veterans Affairs Medical Center located at 150 South Huntington Avenue, Boston, MA 02301 has a requirement for a methadone dispensing system. The Government intends to award a firm-fixed-price sole source contract with Netsmart Technologies, Inc. A determination by the Government not to compete with this proposed contract based upon responses to this notice is solely within the discretion of the Government this notice of intent is not a request for competitive proposals. This is a written notice to inform the public of the Governments intent to award on a sole source basis. Interested parties may identify their interest and capability to respond to the requirement. Any response to this notice must show clear and convincing evidence that competition will be advantageous to the Government. Please contact Manasés Cabrera, Contracting Specialist with the responses or questions regarding this requirement at
[email protected]. This notice will close on April 12, 2023, at 4:30 PM Eastern Standard Time (EST) STATEMENT OF WORK NETSMART TECHOLOGIES Methadone Dispensing Software REQUESTING SERVICE: Clinical Engineering Objective: Reference the Business Associate Agreement (BAA) between Department of Veterans Affairs and Netsmart Technologies dated 9/26/2022, Boston Healthcare System (BHS) will renew a service contract with Netsmart Technologies for methadone dispensing service at VAMC Jamaica Plain, methadone clinic. 1.2 Performance Period: BHS VA requests a one-year base contract plus four option years. 1.3 Type of Contract: Firm Fixed Price 1.4 Contract Award Meeting: The contractor shall not commence performance on the tasks in this SOW until the CO has conducted a kick-off meeting or has advised the contractor that a kick-off meeting is waived. 2.0 Background: Netsmart owns the equipment and has proprietary rights to software which uses pumps, computer system that dispenses the medication and the software that records PII and records receipt of the medication by the patient. 3.0 Scope: The Vendor shall provide all labor, personnel, equipment, tools, materials, parts, supervision and other items necessary to accomplish the deliverables and perform onsite maintenance, repairs and support on the Netsmart equipment and software. 3.1 Contractor on site: When required by the vendor and authorized by a BHS Pharmacist or CE staff. 3.2 Professional Qualifications: The assigned field service agent (FSA) must have the appropriate training, experience, expertise, and certification by the OEM to work on the equipment. 4.0 SCHEDULING A VISIT: Contact the BHS Jamaica Plain Pharmacy to schedule a visit at a mutually agreed upon date and time. 4.1 SECURITY REQUIREMENTS: FSA shall report to the pharmacy to check in and obtain a short-term identification (ID) badge. This must be obtained before any work is performed. 4.2 IDENTIFICATION: FSA must present a current (not expired) Federal ID, PIV card, State or local government ID card/badge before the temporary Federal ID badge is issued. 5.0 Upon arrival: Contractors can proceed to the pharmacy where the FSA ID presented is verified. If deemed official, the pharmacy liaison will have the contractor sign in and will then give the FSA a temporary U. S. Government ID badge. The badge shall be worn prominently by the FSA while on VA Property. 5.1 WORK SITE: The contractor will be escorted by pharmacy staff or other designated VA employee to the work site and must return to the pharmacy to sign out and turn-in said badge along with the documented service report for the service performed. 6.0 Federal Law: The FSA must follow all Government laws, rules and regulations regarding National Security, patient privacy and information security. And must adhere to the privacy Act, HIPAA, and COVID-19 screening requirements. 6.1 GOVERNMENT RULES AND REGULATIONS: The FSA must follow all Government laws, rules and regulations regarding National Security, patient privacy and information security. And must adhere to the privacy Act, HIPAA, and COVID-19 screening requirements. 7.0 AUTHORIZED SERVICE: Maintenance, repair and replacement of vendor equipment. Service must meet the manufacturer s required service frequency and must include all steps detailed in the OEM service manual. 7.1 EQUIPMENT TO BE SERVICED: Scilog Pump EE 180004 Scilog Pump EE 144970 Scilog Pump EE 131273 Scilog Pump EE 131274 OIT Workstation EE 180639 OIT Workstation EE 184802 OIT Workstation EE 172005 7.2 Computer hard drives: If there is a need to replace any hard drive, hard drives and all information on them, are Federal property and must remain in the control of the VA Clinical Engineering department for proper destruction. 7.3 UNAUTHORIZED WORK: Work outside the scope of this agreement is not authorized. Purchase of parts is not authorized. 8.0 DELIVABLES: Field Service Report (FSR) must be completed by the FSA and a copy given to CE staff. The FSR must include: Name & work phone number of FSA who performed services. Contractor service ESR number/log number. Date, time (starting and ending), equipment downtime and hours on site for service call. Identification of equipment serviced to include: Facility Inventory EE ID number Manufacturer Device name Model number Serial number 8.1 Hours of Coverage: 24-hour, 7 day per week, 800# Helpline for software, hardware, and user questions. 8.2 Guaranteed Uptime: A guaranteed uptime of 95% shall be maintained during hours of coverage to date: Uptime % = productive time down time divided by productive time times 100. Productive time is planned time of use of equipment. Downtime begins at time of first service call until equipment is returned to proper operating conditions. 8.3 Response time: The vendor shall respond immediately twenty-four hours a day, seven days a week when called. 8.4 Maintenance: Maintenance, repair of the vendor s equipment and software must meet the manufacturer s required service frequency and must include all steps detailed in the OEM service manual. 8.5 Computer Hard Drives: If there is a need to replace any hard drive, hard drives and all information on them, are Federal property and must remain in the control of the VA Clinical Engineering department for proper destruction. 8.6 Investigative Requirements: All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. 8.7 Custom software development: Outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not 8.8 disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor. 8.8 VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE: Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information security. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS: Contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. 9.1 VA Directive and Handbook 0710: Personnel Suitability and Security Program. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. 9.2 Custom software development: and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor. 9.3 Unfriendly termination: The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination. 9.4 Prior to Termination: or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. 9.5 Disclose and Dispose of VA information: The contractor and Subcontractors must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and VA Handbook 6500.6, Contract Security APPENDIX C. 3. 10.0 VA INFORMATION CUSTODIAL LANGUAGE: Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). 10.1 VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA s information is returned to the VA or destroyed in accordance with VA s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures must follow VA directives. 10.2 Copy of VA Information: The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor media storage for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. 10.3 SECURITY: Information System Security The contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard contract language, conditions laws, and regulations. The contractor s firewall and web server shall meet or exceed the government minimum requirements for security. All government data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA project manager and the VBA Headquarters Information Security Officer as soon as possible. The contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification accreditation 10.4 Security Training: All contractor employees and subcontractors under this contract or order are required to complete the VA's on-line Security Awareness Training Course and the Privacy Awareness Training Course annually. Contractors must provide signed certifications of completion to the CO during each year of the contract. This requirement is in addition to any other training that may be required of the contractor and subcontractor(s). 11.0 Records Management The contractor/subcontractors must follow: Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228. 11.1 Deliverables: Contractor/subcontractors shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. 11.2 Contractor/subcontractors shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records. 11.3 Contractor/subcontractors shall not create, retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act. 11.4 Contractor/subcontractors shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract. 11.5 Contractor/subcontractors shall agree that the Government Agency owns the rights to all data/records produced as part of this contract. 11.6 Contractor/subcontractors shall agree that the Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data. 11.7 Contractor/subcontractors shall agree to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.]. 11.8 Contractor/subcontractors shall agree that no disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules. 11.9 Contractor/subcontractors shall agree that it s required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.