R615--Beneficiary Locator and Outreach Services VBA Philadelphia - Insurances Services

Form / Attachment / Pricing Sheet

This document, Appendix C of VA Handbook 6500.6, provides mandatory "Information and Information System Security/Privacy Language" for inclusion into VA contracts. It outlines the security and privacy requirements that contractors and subcontractors must adhere to when handling VA information and accessing VA information systems.

• General Security Requirements: Contractors must comply with Federal laws, regulations, standards, and VA directives regarding information and information system security.
• Access to VA Information Systems: Requirements for requesting access, background investigations, security clearances for national security programs, and handling of custom software development.
• VA Information Custodial Language: Rules for using VA-provided or contractor-developed information, data co-mingling, data destruction, and compliance with Federal and VA confidentiality and security laws.
• Information System Design and Development: Standards for systems developed for VA, including compliance with FISMA, HIPAA, NIST, FIPS, and VA directives. Requirements for Privacy Impact Assessments (PIAs), contractor certification, and adherence to security controls.
• Information System Hosting, Operation, Maintenance, or Use: Responsibilities for ensuring compliance with security and privacy directives for systems hosted at non-VA facilities, including risk assessments, vulnerability scanning, and contingency planning.
• Security Incident Investigation: Procedures for reporting and investigating security incidents, including unauthorized access, loss or damage to VA assets, or breaches of security procedures.
• Liquidated Damages for Data Breach: Contractor liability for liquidated damages in the event of a data breach or privacy incident involving sensitive personal information.
• Security Controls Compliance Testing: VA's right to evaluate security controls and privacy practices.
• Training: Mandatory cybersecurity and privacy training for contractor and subcontractor employees.

This document is critical for any bidder whose proposed work involves accessing, storing, processing, transmitting, or developing information systems for the VA. It details the stringent security and privacy obligations, compliance requirements, and potential liabilities that must be incorporated into their approach and pricing. Bidders must understand these requirements to ensure their proposals are compliant and their execution meets VA's security standards.

Statement of Work (SOW) / Performance Work Statement (PWS)

To provide beneficiary locator and outreach services for the Veteran Administration – Insurance Service and Operations Center (VA INS) to facilitate the completion of claims for Veterans' life insurance benefits.

• Beneficiary Locator and Outreach Services: Identify and contact beneficiaries (primary, contingent, and alternate) who are entitled to VA Insurance proceeds.

• Case Tiers: Services are categorized into three tiers based on the time since the Veteran's date of death:

  • Tier 1 (6 months to 1 year): Locate primary beneficiaries, confirm their living status, and conduct outreach.
  • Tier 2 (1 to 2 years): Locate contingent beneficiaries (if primary is deceased), confirm their living status, and conduct outreach.
  • Tier 3 (2+ years): Conduct in-depth research to identify and locate alternate beneficiaries (e.g., next of kin), and conduct outreach.

• Specific Services: Include Electronic Address Search, Death Determination, Claims Outreach (providing claim instructions and assistance), and Reporting on Updated Information and Results.

• Data Handling: Secure transmission of PII via encrypted methods (SFTP, HTTPS, encrypted email, or shared folder).

• Success Criteria:

  • Tier 1: 90% success rate in locating, confirming living status, and providing outreach to primary beneficiaries.
  • Tier 2: 90% success rate in locating, confirming living status, and providing outreach to contingent beneficiaries.
  • Tier 3: 70% success rate in locating an alternate beneficiary and providing outreach that leads to a claim application submission.

• Reporting: Monthly Progress Reports detailing work completed, planned work, problems encountered and resolved, and a log of VA-approved outreach templates.

• Compliance: Adherence to VA Handbook 6500, FISMA, privacy requirements, and other applicable federal laws and VA directives.

• Period of Performance: One 6-month base period followed by four 12-month option periods.

• Place of Performance: Off-site at the contractor's location(s).

• Project Management: Submission of a Contractor Project Management Plan (CPMP) and adherence to VA project management methodologies.

• Security: Background investigations (NACI, MBI, or BI) required for contractor personnel based on task sensitivity.

• Deliverables: Contractor Project Management Plan, Monthly Progress Reports, and technical kickoff meeting participation.

• Personnel: Contractor must perform at least 51% of the total work.

Request for Information (RFI)

This RFI is issued by the Department of Veterans Affairs (VA) Veterans Benefits Administration (VBA) for Beneficiary Locator and Outreach Services. The VA Insurance Service and Operations Center (INS) requires assistance in locating hard-to-find beneficiaries and establishing contact to facilitate the completion of claims. This RFI seeks to gather information on vendor capabilities, methodologies, technologies, and cost structures related to the services outlined in the Beneficiary Locator Services Performance Work Statement (PWS).

Vendors are requested to provide information on their capabilities in the following areas:

• Electronic address search
• Genealogical research
• Encrypted file transfer solutions
• Claims outreach mailings and return mail processing

Responses should include:

• Company Information (name, contact, overview)

• Service & Technology Capabilities (specific services, location processes, tools used, reporting, case studies, VA experience, image capture of outreach letters)

• Cost Structure (pricing models, estimated costs for research, cost variability factors, line item structure)

• Compliance and Security (approach to standards, data protection)

• Key Personnel (qualifications, experience)

• Any other relevant information

• Responses should be in Microsoft Word or compatible format, not exceeding 20 pages plus a cover page.

• Use Times New Roman 12pt font (10pt for tables).

• Subject line for email submission: "RFI Response: Beneficiary Locator Service".

This RFI is for informational and planning purposes only and does not constitute a solicitation. Responses will not obligate the VA to any contractual action. All submitted information will remain confidential.

• The RFI references an attached Performance Work Statement (PWS) and VA6500.6 Appendix_C.