Subpart 802.1 - Definitions

A/E means architect/engineer.

Business associate (or associate) means an entity, including an individual (other than a member of the workforce of a covered entity), company, organization, or another covered entity, as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191) Privacy Rule (45 CFR part 160), that performs or assists in the performance of a function or activity on behalf of the Veterans Health Administration (VHA) that involves the creating, receiving, maintaining, transmitting of, or having access to, protected health information (PHI), or that provides to or for VHA, certain services as specified in the HIPAA Privacy Rule that involve the disclosure of PHI to a contractor by VHA. The term also includes a subcontractor of a business associate that creates, receives, maintains, or transmits PHI or that stores, generates, accesses, exchanges, processes, or utilizes such PHI on behalf of the business associate.

Business Associate Agreement (BAA) means the agreement, as dictated by the HIPAA Privacy Rule (45 CFR part 160), between VHA and a business associate, which must be entered into in addition to the underlying contract for services and before any release of PHI can be made to the business associate, in order for the business associate to perform certain functions or activities on behalf of VHA.

Chief Acquisition Officer (CAO) means the Principal Executive Director, Office of Acquisition, Logistics, and Construction.

COR means Contracting Officer's Representative.

FAR means the Federal Acquisition Regulation.

GAO means the Government Accountability Office.

Gray market items means original equipment manufacturer goods intentionally or unintentionally sold outside an authorized sales territory or sold by non-authorized dealers in an authorized sales territory.

HCA means the Head of the Contracting Activity, an individual appointed in writing by the SPE.

Information system means, pursuant to 38 U.S.C. 5727, a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information whether automated or manual.

Information technology (see FAR 2.101) also means Information and Communication Technology (ICT).

Information technology-related contracts means those contracts which include services (including support services) and related resources for information technology as defined in this section.

OGC means the Office of the General Counsel.

Ordering officer means the VA official authorized to order supplies and services against a FAR-based contract or agreement in accordance with the ordering limits identified in the contract or agreement or the specific ordering guide in accordance with 801.601(b).

Privacy officer means the VA official with responsibility for implementing and oversight of privacy related policies and practices that impact a given VA acquisition.

Public Law (Pub. L.) 109-461 means the Veterans Benefits, Health Care and Information Technology Act of 2006, as codified in 38 U.S.C. 8127 and 8128.

SDVOSB/VOSB when used as an initialism means a service-disabled veteran-owned small business (SDVOSB) and/or veteran-owned small business (VOSB) that has been found by VA eligible to participate in the Veterans First Contracting Program implemented at subpart 819.70 and listed in the Vendor Information Pages. The term is synonymous with VA or VIP-verified small business concerns owned and controlled by Veterans.

Security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.

Sensitive personal information means, with respect to an individual, any information about the individual maintained by VA, including but not limited to the following:

(1) Education, financial transactions, medical history, and criminal or employment history.

(2) Information that can be used to distinguish or trace the individual's identity, including but not limited to name, Social Security Number, date and place of birth, mother's maiden name, or biometric records.

Service-disabled veteran-owned small business (SDVOSB) or small business concern owned and controlled by Veterans with service-connected disabilities has the same meaning as service-disabled veteran-owned small business concern defined in FAR 2.101, except that for acquisitions authorized by 38 U.S.C. 8127 and 8128 for the Veterans First Contracting Program, these businesses must be listed as verified in the VIP database. In addition, some SDVOSB listed in the VIP database may be owned and controlled by a surviving spouse. See definition of surviving spouse in this section.

Small business concern has the same meaning as defined in FAR 2.101.

SPE means the Senior Procurement Executive who is also the Executive Director, Office of Acquisition and Logistics. The SPE is responsible for the management direction of the VA acquisition system.

Surviving spouse means an individual who has been listed in the Department of Veterans Affairs' (VA) Veterans Benefits Administration (VBA) database of veterans and family members. To be eligible for inclusion in the VetBiz.gov VIP database, the following conditions must apply:

(1) If the death of the veteran causes the small business concern to be less than 51 percent owned by one or more service-disabled veterans, the surviving spouse of such veteran who acquires ownership rights in such small business shall, for the period described below, be treated as if the surviving spouse were that veteran for the purpose of maintaining the status of the small business concern as a service-disabled veteran-owned small business.

(2) The period referred to above is the period beginning on the date on which the veteran dies and ending on the earliest of the following dates:

(i) The date on which the surviving spouse remarries;

(ii) The date on which the surviving spouse relinquishes an ownership interest in the small business concern;

(iii) The date that is 10 years after the date of the veteran's death; or

(iv) The date on which the business concern is no longer small under federal small business size standards.

(3) The veteran must have had a 100 percent service-connected disability rating or the veteran died as a direct result of a service-connected disability.

VA means the Department of Veterans Affairs.

VAAR means the Department of Veterans Affairs Acquisition Regulation.

VA Information Security Rules of Behavior for Organizational Users/VA National Rules of Behavior means a set of VA rules that describes the responsibilities and expected behavior of users of VA information or information systems.

VA Rule of Two means the determination process mandated in 38 U.S.C. 8127(d)(1) whereby a contracting officer of the Department shall award contracts on the basis of competition restricted to small business concerns owned and controlled by veterans if the contracting officer has a reasonable expectation that two or more small business concerns owned and controlled by Veterans will submit offers and that the award can be made at a fair and reasonable price that offers best value to the United States. For purposes of this VA specific rule, a service-disabled veteran-owned small business (SDVOSB) or a veteran-owned small business (VOSB), must meet the eligibility requirements in 38 U.S.C. 8127(e), (f) and VAAR 819.7003 and be listed as verified in the Vendor Information Pages (VIP) database.

VA sensitive information means all VA data, on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information and includes sensitive personal information. The term includes information where improper use or disclosure could adversely affect the ability of VA to accomplish its mission, proprietary information, records about individuals requiring protection under various confidentiality provisions such as the Privacy Act and the HIPAA Privacy Rule, and information that can be withheld under the Freedom of Information Act. Examples of VA sensitive information include the following: individually-identifiable medical, benefits, and personnel information; financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, investigatory, and law enforcement information; information that is confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege; and other information which, if released, could result in violation of law or harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.

Vendor Information Pages (VIP) or VIP database means the Department of Veterans Affairs Office of Small and Disadvantaged Business Utilization (OSDBU) Center for Verification and Evaluation (CVE) Vendor Information Pages (VIP) database at https://www.vetbiz.va.gov/vip/. This site's database lists businesses that VA CVE has determined eligible for the Veterans First Contracting Program.

Veteran-owned small business (VOSB) has the same meaning as veteran-owned small business concern defined in FAR 2.101, except that for acquisitions authorized by 38 U.S.C. 8127 and 8128 for the Veterans First Contracting Program, these businesses must be listed as verified in the VIP database. SDVOSBs, including businesses whose SDVOSB status derive from ownership and control by a surviving spouse, are also considered VOSBs, as long as they are listed as eligible in VIP.

Veterans First Contracting Program means the program authorized by Public Law 109-461 (38 U.S.C. 8127 and 8128), as implemented in subpart 819.70. This program applies to all VA contracts (see FAR 2.101 for the definition of contracts) as well as Blanket Purchase Agreements (BPAs), Basic Ordering Agreements (BOAs), and orders against the Federal Supply Schedules (FSS), unless otherwise excluded by law.

VISN means Veterans Integrated Service Network, an integrated network of VA facilities that are focused on pooling and aligning resources to best meet local needs in the most cost-effective manner and provide greater access to care.