A--Intent to Sole Source to Quantitative Applications

STATEMENT OF WORK Biostatistical Services Needed Expert biostatistical services of a Professor level biostatistician are needed to meet the needs of the VA for completion of the VA-funded research project. The contracted statistician will evaluate the initial database design, perform interim analyses, perform the final data analyses, format and report the results to the principal investigator and co-investigators, and contribute to the manuscript and presentations of the research findings from the VA Rehabilitation R&D-funded study "Efficacy of Supported Employment within the OIF/OEF Patient Aligned Care Team." The study compares the employment and clinical outcomes of Individual Placement and Support (IPS) supported employment delivered within the Patient Aligned Care Team (PACT) to a control condition called Transitional Work Program (TWP), in assisting unemployed Veterans to obtain and sustain competitive employment. This is a firm-fixed-price contract. Period of performance is September 18, 2015 to September 17, 2019: " Based Year Service: 9/18/15 to 9/17/16 for 40 hours (database creation, check, first pass analysis) " Option Year 1: 9/18/16 - 9/17/17 for 40 hours (Interim analyses and database checks) " Option Year 2: 9/18/17 - 9/17/18 for 40 hours (Interim analyses and database checks) " Option Year 3: 9/18/18 - 9/17/19 for a 100 hours (Final analyses, final report, manuscripts) The C&A requirements do not apply, and that a Security Accreditation Package is not required. Mandatory Privacy and Information Security Requirements The contractor is fully responsible for ensuring compliance with Veteran Affairs (VA) privacy, information security, and safety requirements, to include background checks and all life safety requirements, and is fully responsible for and must resolve to the VA satisfaction any breach of privacy or information security resulting from the Contractor or the Contractor's employees or representative's conduct and or performance regardless of time period violation occurred. The contractor to provide a completed copy of the HIPAA/Privacy and Information Security (VA10176) certificate to the Contracting Officer Representative (COR) prior to performing a work assignment and annually there afterwards (see attachment beginning on page 5, the VA Talent Management System (TMS) to self-enroll). Record Management Upon completion or termination of the applicable contract(s) or agreement(s), return and/or destroy, at Covered Entity's option, VA information gathered, created, received, or processed during the performance of the contract(s) or agreement(s). No data will be retained by Business Associate, or contractor, subcontractor, or other agent of Business Associate, unless retention is required by law and specifically permitted by Covered Entity. As deemed appropriate by and under the direction of Covered Entity, Business Associate shall provide written assurance that all VA information has been returned to Covered Entity or destroyed by Business Associate. If immediate return or destruction of all data is not possible (such as is the case of de-identified electronic research data), Business Associate shall notify Covered Entity and assure that all VA information retained will be safeguarded to prevent unauthorized Uses or Disclosures. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. De-identification of patient information. Within the contractor's base, any TVAMC VA Medical Center patient information will be required to be de-identified and stripped of indicators such that one skilled in administering medical records could not link medical information to a specific patient. Data which has been stripped of patient identifying indicators such as patient name and address and incorporated into the contractor's comparative or benchmark databases shall cease to be patient information creates large comparative or benchmark patient satisfaction databases to help health care providers improve the efficiency and effectiveness of health care delivery. The contractor may include in their database data that has been de-identified and stripped of indicators such that one skilled in administering medical records could not link medical information to a specific patient. Contractor Personnel Security Requirements: It is the policy of the TVAMC to ensure the integrity and security of patient health and personally identifiable information and data compiled during the course of doing research within this facility. The contractor will NOT be accessing sensitive patient data or have access to TVAMC data systems. The individual will be viewing de-identified data as outlined in the approved Data Use Agreement. Upon completion or termination of the applicable contract(s) or agreement(s), return and/or destroy, at Covered Entity's option, VA information gathered, created, received, or processed during the performance of the contract(s) or agreement(s). No data will be retained by Business Associate, or contractor, subcontractor, or other agent of Business Associate, unless retention is required by law and specifically permitted by Covered Entity. As deemed appropriate by and under the direction of Covered Entity, Business Associate shall provide written assurance that all VA information has been returned to Covered Entity or destroyed by Business Associate. If immediate return or destruction of all data is not possible, Business Associate shall notify Covered Entity and assure that all VA information retained will be safeguarded to prevent unauthorized Uses or Disclosures. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. The contractor will not be physically working at the Tuscaloosa VA Medical Center; all work will be performed at the Quantitative Applications Consultants, Inc., facility located at 5508 Hunters Hill Road, Birmingham, AL 35210. In accordance with Privacy and Records Management requirements at the TVAMC the following steps will be taken in order to ensure compliance with applicable rules and regulations governing outside contractors: a. All contract personnel will complete the VA on-line training program titled VA Privacy and Information Security Awareness Training and Rules of Behavior (VA10176). This training can be found at https://www.tms.va.gov/plateau/user/login.jsp. The COR will provide detailed guidance on accessing this site. Contractors coming onto the facility must provide the COR a copy of their certificate showing completion of the online training prior to performing any service and/or repair. Training is required to be completed annually. b. The contractor will need to print the Contractor Rules of Behavior (VA10176) and present it to the COR. If the contractor were to come on site at TVAMC the following would be required: a. Any contractor/subcontractor coming onto the TVAMC facility will physically check-in in the Logistics Office and be escorted by a staff representative. b. Contractor/subcontractors will wear identification badges at all times when at the TVAMC Medical Center. c. No photographs will be taken by contractors/subcontractors while on the premises, unless otherwise specified in the contractors description of work. SECURITY CONTROLS COMPLIANCE TESTING On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days' notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time. Attachment In order for you to engage in your work at VA, you are required to ensure all contractors who will be working on the contract complete a mandatory training program titled VA Privacy and Information Security Awareness Training and Rules of Behavior. This training is offered through the VA Talent Management System (TMS), a system that offers web-based training to VA employees and its partners. You must ensure each contract employee self-enrolls for a profile on the VA TMS by visiting https://www.tms.va.gov/plateau/user/login.jsp. Once there, employees should follow the steps below to create a profile, launch the mandatory training, and complete the content prior to their next day at VA. Upon completion by all employees, the contractor shall provide their Contracting Officer Representative with each employee's printed certificate of completion from the TMS. This certificate displays the employee's TMS User ID. Managed Self-Enrollment (MSE) enhances VA's training and reporting compliance, and is another step toward establishing VA as a 21st century organization built on providing the best care and service possible for our Veterans! 1.1 Step-by-Step Instructions 1. From a computer, launch a web browser and navigate to https://www.tms.va.gov/plateau/user/login.jsp 2. Click the [Create New User] link in the menu below the "TMS" logo and login fields 3. Select the radio button for "Contractor" 4. Click the [Next] button 5. Enter appropriate information in each required field, and also in any non-required field if you have the information a. My Account Information: i. Create Password (Follow the guidelines presented on screen) ii. Re-enter Password iii. Security Question iv. Security Answer v. Re-enter Security Answer vi. Social Security Number (Your SSN is used only as a unique identifier in the system to ensure users do not create multiple profiles. The SSN is stored in a Private Data Table that cannot be accessed anywhere via the VA TMS interface. It is securely transferred to a VA database table inside the VA firewall where it can be confirmed, if necessary, by appropriately vested system administrators and/or Help Desk staff.) vii. Re-enter Social Security Number viii. Date of Birth ix. Legal First Name x. Legal Last Name xi. eMail Address (Enter your business email address. If you have a VA email address assigned to you, it is preferred. The eMail Address will be used as your UserID) xii. Re-enter eMail Address xiii. Phone Number - Enter a number where you can be reached by VA staff if issues arise with this self-enrollment process or in other circumstances) b. My Job Information i. VA City - Enter "XX" ii. VA State - Select from the list iii. VA Location - Select from the list iv. VA Point of Contact First Name - Enter "XXX" v. VA Point of Contact Last Name - Enter "XXX" vi. VA Point of Contact eMail Address - Enter "XXX" vii. VA Point of Contact Phone Number - Enter "XXX" viii. If you have a requirement to take HIPAA Training, check the HIPPA Training Required check box Once you have entered all of the necessary data, click on the "Submit" button. Your profile will be immediately created. Copy and save the UserID displayed to you on the confirmation page, as you will need this for future logons to the VA TMS. Once done, click on the "Continue" button and wait until your "To-Do List" populates with the title(s) of the mandatory training content. 1.2 Launching and Completing the Content 1. Mouse over the title of the available Item in the To-Do List 2. Click the [Go to Content] button in the pop-up window that appears. 3. Complete the content following the on-screen instructions. 4. When you have completed the Rules of Behavior, print that out and save it. 5. Exit the course and a completion should be recorded for your effort. 6. Click on the "Completed Work" pod on the lower right hand side of your internet browser window. 7. Move your mouse over the title of the course you just completed and choose to "Print Completion Certificate". 8. Print off your completion certificate and save it with your signed Rules of Behavior. 9. When you report to VA, bring both the signed Rules of Behavior and the Certificate of Completion for your mandatory training for verification by VA personnel. 1.3 Trouble-shooting and Assistance The Check System link on the VA TMS is an automated tool that confirms the existence of basic, required software on the computer you are using to complete this training. If one is not in compliance with the requirements, a red "x' will appear next to the Check System link. Should this be the case with your computer, please follow the instructions to bring your computer up to the standards that will work with the VA TMS. If you do not have a Social Security Number, or if you experience any difficulty creating a profile or completing the mandatory content, contact the VA MSE Help Desk at 1.888.501.4917 or via email at [email protected].