B--Bereaved Family Survey/Veteran Experience Center - PHILA Sources Sought

CPL Michael J. Crescenz VA Medical Center (CMCVAMC) Nursing/Patient Care Services Veteran Experience Center Program GENERAL INFORMATION FOLLOWED BY A TENTATIVE STATEMENT OF WORK NOTICE: This is not a solicitation but rather a Request for Information (RFI) (Sources Sought) to determine capability of potential sources and is for information and planning purposes only. Veterans Health Affairs, Network Contracting Office 4, is issuing this request for information/sources sought notice in order to identify capable firms to perform Bereaved Family Survey Services for the Philadelphia VAMC. Responses must be submitted by 4:00 PM (EST) December 19, 2018. Submit responses to the information requested above via email to contact@example.gov . All SDVOSB and VOSB firms that respond shall include proof of CVE certification via www.vip.vetbiz.gov. All small business firms that respond shall include proof of small business status via their Representations and Certifications in accordance with (FAR 4.1102 Policy). While SDVOSB/VOSB contractors are preferred, all capable contractors are welcome to respond to this sources sought notice for market research purposes, and shall include as part of their response a brief capability statement that covers the information in the following tentative statement of work The results of this market research will assist in the development of (1) the requirement, and (2) the acquisition strategy (e.g., socioeconomic set-aside, full and open competition, etc.). VA assumes no responsibility for any costs incurred associated with the preparation of responses. Suggested NAICS: 519190 Suggested PSC: B553 Open to suggestions from the market as to a better NAICS and/or PSC. SAMPLE / TENTATIVE STATEMENT OF WORK (BELOW) PERFORMANCE WORK STATEMENT VETERAN EXPERIENCE CENTER PROGRAM SUPPORT SERVICES (Non-Personal Services) BACKGROUND The U.S. Department of Veterans Affairs (VA) requires data collection and entry services for the Veteran Experience Center (VEC) (formerly Performance Reporting and Outcomes Measurements to Improve Standards of care at End-of-Life (PROMISE) Center) located at the Corporal Michael J. Crescenz VA Medical Center (CMCVAMC) (Philadelphia) [also known as the Geriatrics and Extended Care (GEC) Resource Center]. The VEC was established in 2009 as part of the Comprehensive End of Life Care Initiative. The goal of the VEC and the Bereaved Family Survey (BFS) is to identify and reduce unwanted variability in end-of-life care throughout the VA and to define and disseminate processes of care that contribute to improved outcomes for Veterans near the end-of-life and their families. Beginning in FY2011, the BFS was one of two Veteran-centric measures in the National Directors Performance Plan (NDPP). The Bereaved Family Survey (BFS) is comprised of 19 items. Sixteen forced-choice items focus on specific aspects of care that the Veteran received at a VA inpatient facility during the last month of life. These items evaluate performance on areas of care including communication, emotional and spiritual support, pain/PTSD management, benefits, and personal care needs. Two open-ended questions solicit comments about both positive and negative aspects of care (e.g., how could the care be improved, and what else would you like to share about the Veteran's care during the last month of life?). The BFS Performance Measure (BFS-PM) consists of a single item on the BFS that asks respondents to provide a global rating of care during the last month of life. The BFS-PM is dichotomized into Excellent versus all other responses (i.e., Very good, Good, Fair, Poor ) and the facility / organizational level BFS-PM score reflects the percentage of respondents that rate care as Excellent. The BFS-PM is endorsed by the National Quality Forum (http://www.qualityforum.org/ProjectMeasures.aspx?projectID=73867). A slightly modified BFS is currently being expanded to support the Home-Based Primary Care (HBPC) programs throughout the VA. GENERAL REQUIREMENTS Services Required The Contractor(s) shall provide the Corporal Michael J. Crescenz VA Medical Center (CMCVAMC) (Philadelphia), 3900 Woodland Avenue, Philadelphia, PA 19104 with producing, printing, mailing and data collection services for the BFS to family members of deceased Veterans serviced by the VA Healthcare system as outlined below, but not limited to: Creation of Mailing Products/Surveys The VA currently utilizes existing templates for products mailed out to recipients (reference document appendix). The contractor shall make minor changes to templates upon VA request at no cost to the VA. If contractor incurs costs in modifying the templates, VA Contracting Officer will approve all additional costs prior to work being performed by the contractor. Products will be produced in both English and Spanish. Spanish materials will be sent to households where Veterans are serviced within the VA Caribbean Healthcare System, is designated as a Spanish speaking household or where Spanish is the primary language language preference is identified by the VA to the Contractor. Fielding of Surveys and Data Collection Contractor shall provide: Survey instruments (including introductory letter, BFS, magnet, prepaid addressed return envelope) Envelope Duplication and Printing Address File Cleaning Addressing Matching Mailing Data Collection Service Transfer of Resultant Survey Data White Mail Handling Online survey site Results Reporting The contractor shall provide all services and materials required to support the analyses of data and report preparation needed to produce the periodic reports from the Bereaved Family Survey (BFS), to include, but not limited to: Quarterly (4 times a calendar year) VHA Support Service Center (VSSC) reports Quarterly (4 times a calendar year) VISN reports The contractor shall provide full national, VISN, facility and bed section data (and any data provided by VEC) as required for each BFS Report on a monthly basis. Provide technical training and documentation to VEC as needed to insure maximum practical use at all organizational levels. The data will contain tagging, so as to link individual surveys to a specific decedent. These items must be reported at the national, VISN, facility and bed section, as applicable. Full patient and question level results are required; including all cumulative data as well as the most recent data. All results are to be made available to VEC staff. Data Collection Methodology VEC requires that the surveys are sent via first class mail using a carefully timed mailing sequence designed to produce the highest possible response rate while keeping postal costs as low as possible. The mailing and response cycle requirements are delineated in Appendix A: Mailing and Response Time Schedule. A web-based option is available in English and Spanish for NOKs to complete if they choose. The web-based option is secure and does not allow for multiple completions of the survey online. Details of Process and Deliverables Table 2.1 outlines some details regarding the frequency and sample size of each survey project. The estimated total number of Next of Kin of Veterans to be mailed surveys for all population groups is approximately 25,000/year. The Survey Preparation phase will involve intense collaboration between VEC and the contractor as questionnaires are changed into a scannable format, cover-letters and envelopes are set-up and proofed, incorrect addresses are eliminated, and final sample sizes are determined. Active Data Collection, regular reports of progress, and delivery of accurate final data sets and related files will be the prime responsibility of the contractor. The forms to be used, the approximate numbers of patients, and the frequency for each study are annotated in Table 2.1. Table 2.1: Survey Type and Projected Numbers by Population Survey - Patient Population Survey Cycle and Data Collection Frequency Number of Patients per cycle Booklet Characteristics Key Patient Characteristics Reporting Frequency Recently Deceased Inpatients Monthly 1,750 approx. 4 pages, approx. Recently discharged as a result of death. Monthly performance measure reports, quarterly reports, semi-annual VSSC reports Recently Deceased Home-Based Primary Care (HBPC) Patients Monthly 306 approx. 4 pages, approx. Recently Deceased Recipients of VA Home-Based Primary Care. Monthly performance measure reports, quarterly reports, semi-annual VSSC reports Quantities for All Surveys VEC annually will target an estimated 25,000 Next of Kin who meet selection criteria for all population groups. It is anticipated that the National Change of Address (NCOA) and eligibility processes will reject a percentage of these addresses. For those surveys that are not returned, a second, reminder letter and BFS will be sent to the NOK. It is estimated that 60% of NOK will need a reminder letter and second BFS resulting in approximately 40,000 surveys administered annually. The VEC team projects HBPC to be approximately 3,672 patients in the 2018 cycle that meet the criteria for the BFS. Every year, it is projected the VEC program will expand to an additional 2 to 3 VISNs, or an additional 500-750 patients each cycle. Table 2.2 annotates the forecasted patient numbers to be executed within the HBPC patient population. Table 2.2: HPBC Forecasted Patient Numbers per Cycle BFS 2018 2019 2020 HBPC Patient 3,672 approx. 4,172 approx. 4,672 approx. SPECIAL REQUIREMENTS Services Required Materials Copies of existing materials, including VA letterhead will be supplied to the contractor by the VA. The materials list, descriptions and specifications are annotated in Table 3.1. Materials are gender specific. For patients serviced through the VA Caribbean Healthcare System or is designated as a Spanish speaking household, all materials will go out with the Spanish language version. Table 3.1: Materials for BFS Item Description Survey Cover Letter 8 1/2 by 11 #288 blue letterhead, black text; male and female versions; English and Spanish version Survey Questionnaire variable page double side booklet; male and female versions; English and Spanish versions Outgoing Envelope 9 x 12 window, #288 blue return address and indicia Magnet 2 x 3.5 , color Business Reply Envelope #10 closed face, #288 blue or black return address and business reply address and indicia, postage pre-paid Follow-up Survey Cover Letter 8 1/2 by 11 #288 blue letterhead, black text; male and female versions; English and Spanish version Follow-up Survey Questionnaire (duplicate for those that did not respond) 8 1/2 by 11 #288 blue letterhead, black text, variable page double side booklet; male and female versions; English and Spanish version Website for online survey completion Secure website with NOK specific access Process VA will provide the vendor the address files in Excel 2016 file (compressed if necessary using PKZIP), and must undergo Code 1 mail-streaming and National Change of Address (NCOA) cleaning. The vendor s systems must be compatible with these methods. An output file containing the rejected names and addresses must be provided to VEC along with the reject code or some explanation for reason of rejection. The output containing the names and addresses of those records retained after NCOA cleaning (i.e. cleared for mailing) must be provided to VEC in the layout described in Appendix B: Mailing Output File Format. Information regarding the NCOA process can be obtained from the Post Office or other survey vendors that provide mailing services. NCOA software is available through a software retailer. NCOA software must be updated monthly, at a minimum, to guarantee accuracy. The VEC is currently using SAS 9.3 and Microsoft Office 2016 on a Windows 7 Enterprise operating system. The vendor must have compatible systems in order to work with all VA systems and must adhere to Secure Socket Layer (SSL) Protocols and Public Key Infrastructure (PKI), as appropriate, in the transference of any sensitive patient identifiable data. All data transfers must be completed via PKI encrypted email through the VA virtual private network (VPN) access that will be provided. Personalization of Survey Materials Four versions of the survey, male and female specific, each in English and Spanish, will be mailed according to the gender of the deceased Veteran and facility of death (VA Caribbean Healthcare System decedents or other identified by the VA will receive the gender specific Spanish language version of the survey). The addressing for the survey cover letter will, at a minimum, contain the name and address of the Veteran s Next of Kin (NOK), the name of the Veteran, and his/her unique identification number (provided by the VEC). The purpose of the patient unique identification number serves as a way of tracking respondents so that their names will not appear directly on the questionnaire. The VEC guarantees survey respondents anonymity. The identification numbering system used to track surveys specifies a unique number to each individual in the sample. This number will be used during data analysis to link survey respondents to their demographic data. The numbering system will be provided by the VEC to the vendor. Data Collection Data collection for the surveys will be done using optical scanning or digital image capture techniques backed up by direct double entry keypunching where necessary for damaged surveys. Data shall be reported back to VEC based on the schedule detailed in Attachment A: Mailing and Response Time Schedule and in the format provided in Attachment C: Data File to VEC Format. The Bereaved Family Survey contains two questions that are open-ended to allow additional feedback from families. All these responses shall be provided in full as digital images and transcribed with the responses linked to the unique identifier for correct identification by the VEC. These responses shall be transmitted to VEC on a monthly basis with the raw, quantitative survey data. White Mail Processing Additional materials and comments that NOKs enclose on attached sheets of paper, recorded audiocassettes, photographs, etc. are commonly called white mail . The vendor will be required to screen all white mail for NOKs in distress or in need of critical assistance. These conditions include but, are not limited to: language consistent with threats of suicide, homicide or other threats to self or others, threats of lawsuit, and indications of depression and or desperation, or complaints being brought to the President, members of Congress or the local media. Any instance of a critical alert in white mail must be brought to the attention of VEC immediately for review and response via telephone or fax, depending on the urgency, and follow up next day mailing of any original correspondence to VEC. All contractor staff screening white mail will be required to complete available suicide and depressions training courses available through the VA s Talent Management System (TMS). Non-critical white mail must be returned to VEC for processing, at a minimum, once a week as some of the material may be time sensitive. If the material includes additional information detailing the care given , the information must be transcribed with the responses linked to the unique identifier in Attachment C: data File to VEC Format. Each piece of white mail sent to VEC must have the patient s ID code to allow rapid follow-up in critical situations. Special care must be taken to ensure the security of these identified documents in transit and to ensure that items received by VEC are in the form it was received by the Vendor. Return to Sender (RTS) and Deceased NOKs The file containing the mailing list of NOK of deceased Veterans provided by VEC will only include Veterans that were known to have died as an inpatient and deceased Veterans with HBPC at time of the eligibility pull, and although VEC requires the vendor to run the mailing list through NCOA and Code 1 mail streaming to remove any incorrect addresses, some Veteran s Next of Kin pass away or move before the surveys reach them. Any survey returned to the vendor as undeliverable will be coded in the data set as returned to sender or deceased according to the reason noted on the envelope. This information is important for statistical purposes to compute our true and adjusted response rates. Any white mail forwarded to VEC from returned surveys marked as deceased must have some indicator written on them by the vendor that the accompanying survey has been coded as deceased in the data file. Mailing The business reply envelopes must have the name of the VEC and the Corporal Michael J. Crescenz VAMC as the recipient of the returned piece along with the address of the data processing facility of the vendor. The mailing of all components must be done via first class mail, taking advantage of all available sorting and bulk mail discounts. At the completion of each mailing segment (reference Attachment A: Mailing and Response Time Schedule), a postal summary of all activity that can be individually identified, including postage dates and costs incurred, will be supplied to the VA by the vendor. TERM OF CONTRACT These activities will be monitored in accordance with VHA and CMCVAMC regulations. Place of Performance: Off-site support to the CMCVAMC, 3900 Woodland Avenue, Philadelphia, PA 19104. Period of Performance: This contract is effective for one year from date of award, with two (2) one-year options. The contract is subject to the availability of VA funds to support the VEC Program. Definitions CONTRACTOR. A supplier or vendor awarded a Contract to provide specific supplies or services to the government. The term used in this Contract refers to the prime Contractor. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate Contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government. CONTRACTING OFFICER S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the Contracting Officer to administer the Contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the Contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the Contract. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a Contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance. SUBCONTRACTOR. One that enters into Contract with a prime Contractor. The Government does not have privity of Contract with the subContractor. Acronyms BAA Business Associate Agreement BFS Bereaved Family Survey CMCVAMC Corporal Michael J. Crescenz VA Medical Center CO Contracting Officer COR Contracting Officer s Representative FAR Federal Acquisition Regulation FIPS Federal Information Processing Standards FISMA Federal Information Security Management Act of 2002 HBPC Home Based Primary Care HIPAA Health Insurance Portability and Accountability Act of 1996 ISO Information Security Officer NCOA National Change of Address NDPP National Directors Performance Plan NIST National Institute of Standards and Technology NOK Next of Kin PROMISE Performance Reporting and Outcomes Measurements to Improve Standard of care at End-of-Life QA Quality Assurance QASP Quality Assurance Surveillance Plan TJC The Joint Commission TMS Talent Management System VA Veterans Administration VEC Veteran Experience Center VHA Veterans Health Administration VISN Veterans Integrated Service Network VSSC VHA Support Service Center Contractor Staff Conflict of Interest The Contractor will ensure services performed by the Contractor personnel will be performed in accordance with VA policies and procedures and the regulations of the Medical Staff Bylaws of the VA facility. Section D, VHA Handbook 1660-3, Conflict of Interest Aspects of Contracting for Scarce Medical Specialist Services, Enhanced Use Leases, Health Care Resource Sharing, Fee Basis and Intergovernmental Personnel Act Agreements (IPAs). VHA Handbook 1660.3, Conflict of Interest Aspects of Contracting for Scarce Medical Specialist Services, Enhanced Use Leases, Health Care Resource Sharing, Fee Basis and Intergovernmental Personnel Act Agreements (IPAs), dated September 22, 2008, is incorporated into this Contract by reference. Any VA employee who is employed by the Contractor is prohibited from participating, on behalf of the Government, in a VA Contract with the Contractor. Citizenship Related Requirements Contractor Certification (Immigration) The Contractor shall comply with all applicable immigration laws, rules and regulations, including but not limited to the Immigration and Nationality Act of 1952, as amended and shall prior to performance under this Contract execute the Contractor Certification incorporated herein. Office of Inspector General (OIG) Statement HEALTH AND HUMAN SERVICES (HHS)/OFFICE OF INSPECTOR GENERAL (OIG): To ensure that the individuals providing services under the Contract have not engaged in fraud or abuse regarding Sections 1128 and 1128A of the Social Security Act regarding federal health care programs, the Contractor is required to check the HHS - OIG, List of excluded individuals/entities on the OIG Website www.hhs.gov/oig for each person providing services under this Contract. Further, the Contractor is required to certify in its proposal that all persons listed in the Contractor s proposal have been compared against the OIG list and are not listed. During the performance of this Contract, the Contractor is prohibited from using any individual or business listed on the List of Excluded Individuals/Entities. Information Security Officer (ISO) Statement VA Information Custodial Language Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data- General, FAR 52.227-14(d) (1). VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA s information is returned to the VA or destroyed in accordance with VA s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if National Institute of Standards and Technology (NIST( issues or updates applicable Federal Information Processing Standards (FIPS) or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated. The contractor/subcontractor s firewall and Web services security controls, if applicable, shall meet or exceed VA s minimum requirements. VA Configuration Guidelines are available upon request. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR. Security Incident Investigation The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident. Liquidated Damages for Data Breach Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. Each risk analysis shall address all relevant information concerning the data breach, including the following: (...