Inactive Total Small Business Set-Aside (FAR 19.5)

Performance Work Statement (PWS) Network Support Services National Center for PTSD General: Base plus 4 option year - Services are required to perform systems analysis and administration as well as ot... Performance Work Statement (PWS) Network Support Services National Center for PTSD General: Base plus 4 option year - Services are required to perform systems analysis and administration as well as other related IT Services for the National Center for PTSD (Women s Health Sciences and Behavioral Sciences Divisions), VA Boston Healthcare System (hereinafter referred to as VABHS). This contract shall cover support and management of the needs of the professional staff. The Contractor may be called upon to support other programs that collaborate with the National Center for PTSD, if needed. Contactor policies and procedures shall comply with all VA policies and procedures. Description of Services: The contractor shall provide all personnel, transportation, tools, and other items necessary to perform network support services as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract. Objectives: Troubleshooting and eliminating issues within the local NC for PTSD IT infrastructure Analysis and updating of the system (file storage, workstations and related devices) to maintain functionality Analysis of the WHSD/BSD technology workflows for vulnerabilities and suggesting courses of action where appropriate Add new and enhanced technology capabilities as WHSD/BSD projects warrant Documentation of procedures and managed assets to aid future development and problem resolution Train users in appropriate IT tools & processes to optimize workflows Provide first level support for hardware and applications outside the facility IT scope Work with staff to ensure compliance with research oversight requirements Maintain specialized WHSD/BSD technology infrastructure (Psychophysiology Lab, AV Studio) Transition legacy implementations to contemporary standards Coordinate project implementation and support initiatives with facility IT Scope: The contractor shall provide technology support services, to include, but not limited to the above list of objectives. Contractor shall provide professional and technical services to include a 4-hour response to emergencies during non-normal business hours. Location: The work will take place at the VA Boston Healthcare System, Jamaica Plain Campus, 150 South Huntington Avenue, Boston, MA 02130. General Information: The Contractor shall have prior experience and knowledge in the following areas: Microsoft OS based Local Area Network (LAN) administration Wide area networks (WAN) Windows Server 2000 and Windows Server 2003 NAS based storage arrays Windows 10 workstations Microsoft Office 2013 and later editions Microsoft Outlook implementation in the Microsoft Exchange/Cloud infrastructure Citrix Virtual Private Network (VPN) connectivity within the National VA Network VA mandated standards and practices for end-user computing VA & local standards and practices for research data storage Patient Record Management and Administration systems (CPRS) Specialized research composition/publication tools including End Note Reference Manager Specialized statistical analysis and modeling software, including the following: Statistical Software for the Social Sciences (SPSS) Hierarchical Linear Modeling (HLM) Statistical Analysis System (SAS) Power & Precision STATA LISREL M-Plus NVIVO R and R Studio (including installation of custom analyses packages) PROCESS for SPSS, SAS, and R Data collection tools, including Teleform Alchemy SuperLAB WinWedge All aspects of computing interface with psychophysiological laboratory equipment involving data collection, storage, security, and cleaning. These include intimate knowledge of: Finapres Coulbourn General Purpose Interface Bus Serial Computer Standard Interface Serial I/O Networked medical device implementation and data acquisition, including, but not limited to: TopCon Dinamap Canon Imaging DICOM Audio & Video Capture, Processing, and Storage tools Endpoint encrypted audio recorders HD, DV, 4K video capture hardware Video capture software (OBS Studio) Editing and transcoding tools (Edius Pro, VLC, Switch, Audacity) Information Security: Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data- General, FAR 52.227-14(d) (1). b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA s information is returned to the VA or destroyed in accordance with VA s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements. c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. d. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. e. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. f. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. g. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated. h. The contractor/subcontractor s firewall and Web services security controls, if applicable, shall meet or exceed VA s minimum requirements. VA Configuration Guidelines are available upon request. i. The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. j. To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. k. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. l. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other items. m. Specialized knowledge of the evolving VHA guidelines related to information security and compliance with these guidelines. VA Sys Admin privileges for server administration and related training certificates required. Contract Performance Monitoring Quality Assurance: A quality assurance surveillance plan will be submitted as part of an offer and put into place upon final contract award. After acceptance of the quality surveillance plan the contractor shall receive the contracting officer s acceptance in writing of any proposed change to his quality system. The Contractor shall comply with all applicable OSHA, Federal and State laws, the Joint commission and regulations required as required for performing the type of services required. The government shall evaluate the contractor s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). Federal Holidays: (The contractor does not have to perform on these holidays) New Year s Day Labor Day Martin Luther King Jr. s Birthday Columbus Day President s Day Veteran s Day Memorial Day Thanksgiving Day Independence Day Christmas Day Hours of Operation: The contractor is responsible for conducting business at times designated by the National Center for PTSD during regular business hours except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property. Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend a post award conference convened by the contracting activity in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government. Key Personnel: The follow personnel are considered key personnel by the government: Tara Galovski, Ph.D., Director, WHSD/National Center for PTSD Amy Street, Ph.D., Deputy Director, WHSD/National Center for PTSD Christine Quigley, COR, WHSD/National Center for PTSD Sandra Tomasetti, Administrative Officer, WHSD/National Center for PTSD Brian Marx, Ph.D., Deputy Director, BSD/National Center for PTSD Andrea Carney, Management Analyst, BSD/National Center for PTSD Identification of Contractor: When/if the Contractor attends meetings or works in other situations where contractor status is not obvious to third parties, the requirement is to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials.