U.S. flag
          An official website of the United States Government  Main navigation
  

        

              Data Initiatives
                              Regulations
                                                                        Row 1
                                              FAR FAR
                              Smart Matrix Smart Matrix
                              Chapter 99 (CAS) Chapter 99 (CAS)
                              Row 2
                                              DFARS DFARS
                              DFARSPGI DFARSPGI
                              AFARS AFARS
                              DAFFARS DAFFARS
                              DAFFARS MP DAFFARS MP
                              DARS DARS
                              DLAD DLAD
                              NMCARS NMCARS
                              Row 3
                                              SOFARS SOFARS
                              TRANSFARS TRANSFARS
                              AGAR AGAR
                              AIDAR AIDAR
                              CAR CAR
                              DEAR DEAR
                              DIAR DIAR
                              DOLAR DOLAR
                              Row 4
                                              DOSAR DOSAR
                              DTAR DTAR
                              EDAR EDAR
                              EPAAR EPAAR
                              FEHBAR FEHBAR
                              GSAM/R GSAM/R
                              HHSAR HHSAR
                              HSAR HSAR
                              Row 5
                                              HUDAR HUDAR
                              IAAR IAAR
                              JAR JAR
                              LIFAR LIFAR
                              NFS NFS
                              NRCAR NRCAR
                              TAR TAR
                              VAAR VAAR
                              Tools
                                                                        Archives
                              Smart Matrix
                              Regulations Search
                              Acquisition Regulation Comparator (ARC)
                              Policy Network
                                                                        CAOC
                              CAAC
                              FAR Council
                              ISDC
 Breadcrumb
        Home
                            Regulations
                            VAAR
                            PART 804 - ADMINISTRATIVE AND INFORMATION MATTERS
        
                  HTML
VAARPart Number: 804
        
                  

                                
                  
        Veterans Affairs Acquisition Regulations
« PreviousNext »
PART 804 - ADMINISTRATIVE AND INFORMATION MATTERSPART 804 - ADMINISTRATIVE AND INFORMATION MATTERS       Authority:                            38 U.S.C. 5723-5724, 5725(a)-(c); 40 U.S.C. 121(c); 41 U.S.C. 1702; and 48 CFR 1.301 through 1.304.          Source:                            73 FR 2717, Jan. 15, 2008, unless otherwise noted.                                       Subpart 804.1 [Reserved]                                          Subpart 804.13 - Personal Identity Verification                                                         804.1303 Contract clause.                                                                             Subpart 804.19 - Basic Safeguarding of Covered Contractor Information Systems                                                         804.1900-70 Scope of this subpart.                                                            804.1902 Applicability.                                                            804.1970 Information security policy - contractor general responsibilities.                                                            804.1903 Contract clause.    **Parent topic:**  SUBCHAPTER A - GENERALSubpart 804.1 [Reserved]Subpart 804.13 - Personal Identity Verification    804.1303 Contract clause.       The contracting officer shall insert the clause at 852.204-70, Personal Identity Verification of Contractor Personnel, in solicitations and contracts that require contractor employees to have routine access to a VA facility or to VA information systems. This clause is used in conjunction with FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel.Subpart 804.19 - Basic Safeguarding of Covered Contractor Information Systems       Source:                               88 FR 4745, Jan. 25, 2023, unless otherwise noted.    804.1900-70 Scope of this subpart.       This subpart prescribes policies and procedures for information security and protection of VA information, information systems, and VA sensitive information, including sensitive personal information.804.1902 Applicability.       This subpart applies to all VA acquisitions, including acquisitions of commercial products or commercial services other than commercially available off-the-shelf items, when a contractor's information system may contain VA information.804.1970 Information security policy - contractor general responsibilities.       Contractors, subcontractors, business associates, and their employees who are users of VA information or information systems, or have access to VA information and VA sensitive information shall -          (a) Comply with all VA information security and privacy program policies, procedures, practices, and related contract requirements, specifications, and clauses, this includes complying with VA privacy and confidentiality laws and implementing VA and Veterans Health Administration (VHA) regulations (*see* 38 U.S.C. 5701, 5705, 5721-5728, and 7332; 38 CFR 1.460 through 1.496, 1.500 through 1.527, and 17.500 through 17.511), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191), and the Privacy Act of 1974 (as amended) (5 U.S.C. 522a);          (b) Complete VA security awareness training on an annual basis;          (c) Complete VHA's Privacy and HIPAA Training on an annual basis when access to protected health information (PHI) is required;          (d) Report all actual or suspected security/privacy incidents and report the information to the contracting officer and contracting officer's representative (COR), as identified in the contract or as directed in the contract, within one hour of discovery or suspicion;          (e) Comply with VA policy as it relates to personnel security and suitability program requirements for background screening of both employees and non-employees who have access to VA information systems and data;          (f) Comply with directions that may be issued by the contracting officer or COR, or from the VA Assistant Secretary for Information and Technology or a designated representative through the contracting officer or COR, directing specific activities when a security/privacy incident occurs;          (g) Sign an acknowledgment that they have read, understand, and agree to abide by the VA Information Security Rules of Behavior (VA National Rules of Behavior) as required by 38 U.S.C. 5723, FAR 39.105, and the clause at 852.204-71, Information and Information Systems Security, on an annual basis. The VA Information Security Rules of Behavior describe the responsibilities and expected behavior of contractors, subcontractors, business associates, and their employees who are users of VA information or information systems, information assets and resources, or have access to VA information;          (h) Maintain records and compliance reports regarding HIPAA Security and Privacy Rules (see 45 CFR part 160) compliance in order to provide such information to VA upon request to ascertain whether the business associate is complying with all applicable provisions under both rules' regulatory requirements; and          (i) Flow down requirements in all subcontracts and Business Associate Agreements (BAAs), at any level, as provided in the clause at 852.204-71, Information and Information Systems Security.804.1903 Contract clause.       When the clause at FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems is required to be included in accordance with FAR 4.1903, the contracting officer shall insert the clause at 852.204-71, Information and Information Systems Security.
« PreviousNext »
FavoriteX

      VAAR Parts
            Regulations Vaar Menu
  

        
      Index
                              800
                              801
                              802
                              803
                              804
                              805
                              806
                              807
                              808
                              809
                              810
                              811
                              812
                              813
                              814
                              815
                              816
                              817
                              819
                              822
                              823
                              824
                              825
                              826
                              828
                              829
                              830
                              831
                              832
                              833
                              835
                              836
                              837
                              839
                              841
                              842
                              843
                              844
                              845
                              846
                              847
                              849
                              852
                              853
                              870
                              871
                              873
                              874

      ×
        Data Initiatives
                                                              Regulations
                                                              Tools
                                              Archives
                                                              Smart Matrix
                                                              Regulations Search
                                                              Acquisition Regulation Comparator (ARC)
                                                              Policy Network
                                              CAO.gov
                                                        CAO Home
                                                              Council Member
                                                                    Large Agencies
                                                              Small Agencies
                                                              Council Defining Documents
                                                                    CAOC History
                                                              CAOC Charter
                                                              Civilian Agency Acquisition Council (CAAC)
                                                              Federal Acquisition Regulatory Council
                                                              Interagency Suspension and Debarment Committee (ISDC)
                                                              Search
 ˄ Top Sign up for FAR News

                            Share the FAR
                        Upper Footer Menu
  

        
      Useful Links
                              FAR Resources
                              Training
                              Acquisition Systems
            
                            **Contact Us/FAQs**
                        **Privacy and Security Notice**
                        **Accessibility Aids**
                        **Last Updated 03/29/2024**
 ACQUISITION.GOV
                An official website of the General Services Administration About GSA
                Accessibility support
                FOIA requests
                No FEAR Act data
                Office of the Inspector General
                Performance reports
                Privacy policy Looking for U.S. government information and services?
            Visit USA.gov
 «
    
    Tt