J--Pharmacy Label Printer Maintenance|

STATEMENT OF WORK Maintenance Contract --- Kyocera Pharmacy Label Printers Tuscaloosa Veteran's Affairs Medical Center (TVAMC) Pharmacy 679-16-4-235-000X_ 1. Scope of Work The contractor will provide an all-inclusive support contract for one year with 4 option years that includes the following services for the Kyocera Printers: " Operating hours for Help Desk support and/or direct on/site repair to address questions and problems on an immediate, real-time basis available Monday- Friday during normal business hours " On-site field service maintenance, with technician arrival to be no later than the next business day after the call, unless otherwise agreed upon by the COR at the time of call " Software updates " Addition of subsequent printers purchased to be added via contract adjustment as needed Kyocera equipment " Replacement toner cartridges with at least one "extra" on-station at all times per printer " Maintenance kits provided and installed periodically based on need during preventive maintenance 2. Diagnostics and Issue Resolution The contractor will provide diagnostics as well as resolution services that include the following: " Diagnosis/root cause analysis " Defined resolution approach: workaround or fix " Operator instruction on actions to be taken on the customer's end to correct the problem " Correction of errors/defects in the programs " Correction of configuration errors " Quality/training initiatives to increase operator knowledge and decrease the number of incoming incidents 3. Technical Support The contractor will provide technical Support via telephone in times noted above. Systems and processes should be in place for thorough documentation of issues reported by the TVAMC with TVAMC having ability to access these reports when requested. The contractor will have a Technical Support number for contact for TVAMC pharmacy and/or IT employees for maintenance service, repair, or other assistance that is required. 4. On-site Field Support The contractor will have available to TVAMC the ability for on-site field support for diagnostic and repair services, as well as preventive maintenance. The contractor will provide fully qualified technicians to perform necessary maintenance service and repairs to Kyocera equipment to ensure optimum operation and efficiency of the equipment and that proper functioning of the equipment conforms to Kyocera's Original Equipment Manufacturer (OEM) standard specifications. The contractor will keep the system in good operating condition, meeting all published equipment requirements. Each technician must complete all required privacy training before entering TVAMC premises as well as have proper ID/name tag identifying the individual as a contractor for servicing the Kyocera printers. The Contractor's repairperson must report to the area designated by logistics before presenting to pharmacy. The contractor is then to present to the Pharmacy Program Support Assistant/Administrative Assistant, Procurement Pharmacist, or Outpatient Pharmacist, Building 135, outpatient pharmacy. At all times the contractor technician must have a name tag for identification purposes to enter the pharmacy. He/She is to sign in with date, time, and reason for entry into the pharmacy. After all work is completed, the contractor must report to the Pharmacy Program Support Assistant, Procurement Pharmacist, or Outpatient Pharmacist to submit a complete written report of services rendered. As a minimum, the report must contain a detailed description of all services performed including a list of all replacement parts when applicable. The service report must be signed by one of the individuals noted above. 5. Diagnostic and Repair Services If the Kyocera printer needs repair, the contractor will have the ability to dispatch a technician to repair, service, or troubleshoot issues that cannot be corrected via telephone instructions. The technician assigned by the contractor must arrive during the pharmacy's standard hours of operation or make special arrangements with Pharmacy Management to come during hours outside of normal operation. The standard response time to a request by TVAMC for repair will be no later than the following business day after notification of equipment malfunction. The technicians assigned by the contractor for repair/maintenance should be as non-intrusive as possible to prevent TVAMC pharmacy workflow issues. 6. Preventive Maintenance The contractor will schedule bi-annual preventive maintenance visits. The visit will include scheduled maintenance, inspections, replacement of defective and worn parts, and testing services in accordance with Kyocera's OEM specifications. 7. Part Replacement The Contractor shall provide all labor, personnel, equipment, tools, materials, maintenance kits, supervision and other items and services necessary to maintain the Kyocera printers. Parts requiring replacement to maintain the equipment in accordance with Kyocera's specifications can be replaced with rebuilt or new parts, if meeting manufacturer approval. Hard drives will require sanitation in conjunction with IT department at TVAMC and the Information Security Officer (ISO), if applicable. Toner cartridges must be delivered by the next business day from time of request, and at least one extra toner cartridge per printer must be on-site at all times. Vendor will be notified of usage of extra cartridge for replacement to be shipped. 8. Privacy and Security All privacy training is required annually of the contractor employees involved with this contract. The contractor is to self enroll into TMS via the link: http://www.tms.va.gov. (See Attachment VHA Mandatory Training for Contractor Course Guide). Courses to be completed are VA10176, Information Security and VA10203, Privacy and HIPPA. The COR/Contracting officer must have copies of Privacy Training Certificate prior to assignment. Certificates must be available from vendor upon request for audit purposes. At all times ID badges must be worn on premises at TVAMC. The Contractor is to ensure that all employees of the Contractor have the appropriate background investigation. Taking of photographs and/or videos on the premises is prohibited. If vendor must work in a patient care area, a VA escort is required at all times. 9. Property Damage The contractor shall take all necessary precautions to prevent damage to any government property. The contractor shall report any damages immediately and shall be assessed current replacement costs for property damaged by the contractor, unless corrective action is taken. Any damaged material (i.e., shelving, pharmacy equipment, etc.) will be replaced in a timely manner or corrected by the contractor with like materials, at no extra cost to the government, upon approval of the Contracting Officer. 10. Record Retention Upon completion or termination of the applicable contract(s) or agreement(s), return and/or destroy, at Covered Entity's option, VA information gathered, created, received, or processed during the performance of the contract(s) or agreement(s). No data will be retained by Business Associate, or contractor, subcontractor, or other agent of Business Associate, unless retention is required by law and specifically permitted by Covered Entity. As deemed appropriate by and under the direction of Covered Entity, Business Associate shall provide written assurance that all VA information has been returned to Covered Entity or destroyed by Business Associate. If immediate return or destruction of all data is not possible, Business Associate shall notify Covered Entity and assure that all VA information retained will be safeguarded to prevent unauthorized Uses or Disclosures. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. Termination of contract Note: If the vendor maintains any records whether hardcopy or electronic, they must be returned to the VA per contract and VA regulations by vendor. All files (hardcopy or electronic) shall not be shared with a 3rd party (unauthorized) unless authorized in writing by the COR or contracting Officer. If any disclosures of VA records to any 3rd party, an accounting of the disclosure must be kept by the vendor. 11. Performance Period The performance period of this maintenance contract will be July 1, 2016 through June 30, 2017, with 4 available one year options. This contract will have start date of July 1, 2016. 12. Incident Reporting The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously contact the designated ISO and Privacy Officer via by email and phone during normal business hours of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access within 1 hour of discovery. NOTE: Reporting of data loss or breach required within one hour of incident discovery to COR, Privacy Officer and ISO (205-554-2000x2140, 554-2000x3652, 205-554-2000x2885). Breaches occurring during WHEN hours (weekends, holidays, nights and weekends) will be reported to Administrative Officer of the Day (+1 (555) 000-0000). who will then report to ISO and Privacy Officer. 13. Monitoring Procedures Monitoring will be based on procedures established by the contracted Pharmacy Service to ensure services are appropriate, complete and satisfactory. The COR, to be designated upon contract award, will be responsible for monitoring contract compliance and reporting any noncompliance as evidenced by the established monitoring procedures to the Contracting Officer for necessary action. Print copies to be analyzed quarterly by TVAMC and vendor for potential adjustment in rates if applicable. 14. Records to Any 3RD Party The contractor will comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and maintain the minimum necessary protected health information data required for the survey process. The contractor will develop and use proprietary patient satisfaction measurement tools, methodologies, and databases to advise and assist health care providers improve the quality of patient care. Tuscaloosa VA Medical Center is a health care provider and will engage the contractor to assist with health care operations, specifically to provide services to help the medical center with internal quality oversight review, with conducting quality assessment and improvement activities which include evaluating outcomes, and evaluating practitioner and provider performance. In connection with services to be provided by the contractor, the Tuscaloosa VA Medical Center may disclose patient information (as defined below) which the medical center has obtained or created as part of the patient's treatment. Under the business relationship between the contractor and the Tuscaloosa VA Medical Center, the medical center will allow the contractor limited access to certain patient information, which is the sole property of the medical center. The contractor will provide reasonable administrative, technical and physical safeguards to protect the integrity and confidentiality of patient information within its control. The contractor will also prevent reasonably anticipated threats to the security or integrity of such patient information as well as unauthorized uses or disclosures of such patient information, and will secure compliance by its representatives. Definitions: "Patient information" means any individually identifiable health information which: (a) contains personal identifying demographic information which would, either alone or in combination with other publicly available information, allow identification of an individual, such as the patient's name, address, phone number, social security number, or other information; and (b) relates to the past or present physical or mental health or condition of an individual. Tuscaloosa VA Medical Center information means patient satisfaction measurement data, analyses and reports created for the medical center by the contractor based on data furnished by the medical center and by medical center's patients and that is readily identifiable to the medical center as the source of the information. "Representatives" include directors, officers, employees, accountants, attorneys and other agents. Restrictions on the use and re-release of patient information. The parties agree that the contractor and its representatives may use patient information (a) to do statistical analyses and create reports to be released only to the Tuscaloosa VA Medical Center. The contractor will not re-release patient information or Tuscaloosa VA Medical Center information to any person other than to the Tuscaloosa VA Medical Center and to contractor representatives who have a need to know such information for providing services to the Tuscaloosa VA Medical Center in accordance with the underlying agreement between the parties, except with the written consent of the Tuscaloosa VA Medical Center. All contractor representatives will be required to sign a non-disclosure agreement as a condition of their employment, a copy of which is available for review upon request by the Tuscaloosa VA Medical Center. The vendor will be required to perform background checks on all contractor representatives having access to Tuscaloosa VA Medical Center patient information and be able to provide information upon request related as to the information obtained in the background check to the Tuscaloosa VA Medical Center. (b) De-identification of patient information. Within the contractor's base, any Tuscaloosa VA Medical Center patient information will be required to be de-identified and stripped of indicators such that one skilled in administering medical records could not link medical information to a specific patient. Data which has been stripped of patient identifying indicators such as patient name and address and incorporated into the contractor's comparative or benchmark databases shall cease to be patient information creates large comparative or benchmark patient satisfaction databases to help health care providers improve the efficiency and effectiveness of health care delivery. The contractor may include in their database data that has been de-identified and stripped of indicators such that one skilled in administering medical records could not link medical information to a specific patient. 15. Security Controls Compliance Testing On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days' notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.