65--509-20-1-549-0013 BIO RAD Standing Order- Chemistry Base + Options (VA-19-00058730)

STATEMENT OF WORK (SOW) Bio-Rad Quality Control 1. Contract Title. Bio-Rad Quality Control 2. Period of Performance. This request is for a base year and four option years. Base Year 1 October 2019 30 September 2020 1st Option Period 1 October 2020 30 September 2021 2nd Option Period 1 October 2021 30 September 2022 3rd Option Period 1 October 2022 30 September 2023 4th Option Period 1 October 2023 30 September 2024 3. Background. Service: Pathology and Laboratory Medicine Service, Core Laboratory Requestor: Aubrey Moss, Supervisory Medical Technologist +1 (555) 000-0000 ext 2868 Control point: 549 QC results are used to validate whether an instrument is operating within pre-defined Specifications and when in range, this infers that patient test results are reliable. Once the test system is validated, patient results can then be used for diagnosis, prognosis, or treatment planning. Regular testing of quality control products creates a QC database that the laboratory uses to validate the test system. Validation occurs by comparing daily QC results to a laboratory-defined range of QC values. If the test is stable for less than 24 hours or a change occurred which could potentially affect the test stability, controls should be assayed more frequently. Controls must have a documented electronic peer group review plan and the Charlie Norwood VAMC must have access to it for validation purposes. 4. General Requirements Contractor must provide Biorad Unity access to peer group reports. Contractor must allow for sequestered lots for all materials. Contractor must provide materials with the longest outdates, preferable a year outdate for the same lot number, will be shipped as scheduled. Contractor must ensure materials will be scheduled for shipment according to the needs of the Core Lab. Contractor must ensure materials will be delivered on scheduled date. Reagents must be name brand or equal to those listed under the Products Requested . Contractor will provide monthly updates of materials shipped from the vendor sent via email to the Core Lab contact at the Charlie Norwood VAMC. Printed SDS will be available upon request. . Freight charges will be the responsibility of the contractor. Contractor will provide Biorad Unity Training upon request. 5. Products Requested: Item Number Item name Quantity Bio-Rad CARD MKR LT PLUS 1 6x3ml 24 146 Bio-Rad CARD MKR LT PLUS 3 6x3ml 24 148 Bio-Rad IA PLUS LIQ 1 12X5 24 361 Bio-Rad IA PLUS LIQ 3 12X5 24 363 Bio-Rad URINE CHEMISTRY 1 12 397 Bio-Rad URINE CHEMISTRY 2 12 398 Bio-Rad ETHANOL/AMMONIA 1 18 544 Bio-Rad ETHANOL/AMMONIA 2 18 545 Bio-Rad IMMUNOLOGY 1 LIQ 6 18 594 Bio-Rad IMMUNOLOGY 3 LIQ 6 18 596 Bio-Rad LIPIDS 1 LIQ 6X3ML 16 641 Bio-Rad LIPIDS 2 LIQ 6X3ML 16 642 Bio-Rad CHEM UNASSAYED 1 L 12 691 Bio-Rad CHEM UNASSAYED 2 L 12 692 Bio-Rad SPINAL FLUID 1 LIQ 12 751 Bio-Rad SPINAL FLUID 2 LIQ 12 752 Bio-Rad HB A1C Lin Lyph 6 x 0.5ml 4 12000070 Delivery schedule 6. Location Items will be delivered to the dock area of: Charlie Norwood VAMC 950 15th Street Augusta GA 30904 7. Invoices: Payment will be made upon receipt of a properly prepared detailed invoice, prepared by the Contractor, validated by the Contracting Officer s Representative (COR), and submitted electronically through IPPS. A properly prepared invoice will contain: Invoice Number and Date Contractor s Name and Address Accurate Purchase Order Number Supply or Service provided Total amount due 8. VA INFORMATION SYSTEM SECURITY/PRIVACY CLAUSE PER REVIEW OF VA HANDBOOK 6500.6, CONTRACT SECURITY, APPENDIX A- INFORMATION SECURITY AND PRIVACY CHECKLIST: The C&A requirements do not apply and a Security Accreditation Package is not required. Acquisition of this service does not involve the storage, generating, transmitting, or exchanging of VA sensitive information to the vendor There may exist exposure to VA sensitive information, in particular to sensitive personal information (SPI) while implementing contractual services Minimum Statutory Requirements Prohibition on unauthorized disclosure: Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). See VA Handbook 6500.6, Appendix C, paragraph 3.a. Requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access, the contractor/subcontractor shall immediately and simultaneously notify the COR, the designated ISO, and Privacy Officer for the contract. The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a Requirement to pay liquidated damages in the event of a data breach: Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. Each risk analysis shall address all relevant information concerning the data breach, including the following: (1) Nature of the event (loss, theft, unauthorized access); (2) Description of the event, including: (a) date of occurrence; (b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code; (3) Number of individuals affected or potentially affected; (4) Names of individuals or groups affected or potentially affected; (5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; (6) Amount of time the data has been out of VA control; (7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); (8) Known misuses of data containing sensitive personal information, if any; (9) Assessment of the potential harm to the affected individuals; (10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and (11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: (1) Notification; (2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; (3) Data breach analysis; (4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; (5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and (6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs (see VA handbook 6500.6, appendix c, paragraph 7.a, 7.d) END