6525-- CD/DVD BURNER SYSTEM

Solicitation / RFP / RFQ

This is a market research notice, not a formal solicitation. The VHA Network Contracting Office 6 (NCO 6) is seeking information to identify qualified vendors capable of providing a CD/DVD Burner System with onsite installation and training for the Asheville VA Medical Center (VAMC).

• CD/DVD Burner System: Must be a "Sorva Vertex 25ei" or equal.

• Functionality: Ability to burn both CD and DVD media, support standard formats (CD-R, DVD-R, DVD-RW, DVD+R), and burn a minimum of 100 discs per day.

• Integrated PC/Controller: Must include preloaded software integrated with the VA PACS System, be DICOM Compliant, and have the ability to import, index, and merge DICOM images into PACS, then burn them to media.

• Labeling: Must create custom labels based on VA needs.

• Data Protection: Must offer encryption and anonymization capabilities for exported media, consistent with data protection/HIPAA requirements.

• Workstation: Supply a preconfigured workstation (mouse, keyboard, monitor) meeting VA network and OS requirements (minimum Windows 11).

• Warranty & Support: Minimum 1-year warranty with included support service.

• Installation & Training: On-site installation, configuration, and training for VA personnel are required.

• Product Service Code: 6525

• NAICS Code: 334610 (Size Standard: 1,250 employees)

• Place of Performance: Asheville VAMC, 1100 Tunnel Road, Asheville, NC 28805, USA

• Response Deadline: March 12, 2026, 1:00 PM EDT.

• Submission Method: In writing via email to zanona.pickett@va.gov. No telephone inquiries.

• Required Information: Company name, address, POC with phone number, company socio-economic size (e.g., large, small, SDVOSB, VOSB, WOSB), interest description, FSS/GSA contract number and category (if applicable), Tax ID, UEI number, and capabilities statement.

• SBA Certification: Firms claiming SDVOSB or VOSB status must be SBA certified.

• This notice is for market research purposes only; no set-aside is indicated at this time.

• Vendors must be registered in the System for Award Management (SAM) prior to award.

• Salient Characteristics and Statement of Work (SOW-a) are referenced.

• This notice does not constitute a request for proposal, and no formal solicitation document currently exists.

Statement of Work (SOW) / Performance Work Statement (PWS)

To procure an additional CD/DVD burner for the Diagnostic Imaging PACS Administrative office at the Asheville VA Medical Center to handle an increased volume of patient exam disc requests from outside providers and patients.

• Download patient studies from the Radiology PACS system.

• Burn study images and reports onto a CD/DVD.

• Burn patient and study information onto a readable label on the CD/DVD.

• Delivery: Equipment must be delivered no later than 30 days from the award date to Asheville VAMC, 1100 Tunnel Road, Asheville, NC 28805. Delivery is accepted Monday-Friday, 8 am-4:00 pm.

• Installation & Training: Remote installation and training must be completed no later than 45 days from the award date.

• Contractor Training: Contractors must complete the "Compliance Awareness Training TMS course #43790" prior to accessing VA facility systems. This training is required within 90 days of hire and annually thereafter.

• Information Security & Privacy: Contractors must adhere to all Federal laws, VA Directives, and Handbooks regarding information and information system security and privacy. This includes:

  • Accessing VA information and systems only as necessary for contract performance.
  • Subjecting personnel to background investigations per VA Directive and Handbook 0710.
  • Complying with VA information custodial language, including data protection, media sanitization, and record retention requirements.
  • Storing, transporting, or transmitting VA sensitive information in encrypted form using VA-approved tools (FIPS 140-2 validated).
  • Meeting or exceeding VA's minimum firewall and web services security control requirements.
  • Referring all requests for VA information to the VA Contracting Officer.
  • Not releasing specific protected health information (PHI) without VA approval.
  • Completing annual Contractor Security Control Assessments (CSCA) for services involving VA sensitive information.
  • Designing, developing, and operating systems in compliance with FISMA, HIPAA, NIST, and VA security/privacy controls.
  • Complying with the Privacy Act of 1974 and including relevant clauses in subcontracts.
  • Ensuring security of procured or developed systems throughout the contract life, including timely remediation of vulnerabilities.
  • Notifying VA within 24 hours of discovering exploits that compromise system security.
  • Adhering to VA's prohibition of personally-owned equipment on VA networks unless explicitly stated and approved, with all required security controls funded by the owner.
  • Handling electronic storage media in adherence with VA Handbook 6500.1 upon contract completion or equipment disposal/return.
  • Complying with specific procedures for handling bio-medical devices containing VA sensitive information.

• Security Incident Reporting: Contractors must immediately notify the COTR, ISO, and Privacy Officer of any known or suspected security/privacy incidents or unauthorized disclosures.

• Liquidated Damages: Contractors are liable for liquidated damages in the event of a data breach or privacy incident involving sensitive personal information (SPI).

• Compliance Testing: VA reserves the right to evaluate security controls and privacy practices. Contractors must cooperate with government-sponsored assessments with 10 working-day notice.