802.101802.101 Definitions.#
A/E means architect/engineer. Business associate (or associate) means an entity, including an individual (other than a member of the workforce of a covered entity), company, organization, or another covered entity, as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191) Privacy Rule (45 CFR part 160), that performs or assists in the performance of a function or activity on behalf of the Veterans Health Administration (VHA) that involves the creating, receiving, maintaining, transmitting of, or having access to, protected health information (PHI), or that provides to or for VHA, certain services as specified in the HIPAA Privacy Rule that involve the disclosure of PHI to a contractor by VHA. The term also includes a subcontractor of a business associate that creates, receives, maintains, or transmits PHI or that stores, generates, accesses, exchanges, processes, or utilizes such PHI on behalf of the business associate. Business Associate Agreement (BAA) means the agreement, as dictated by the HIPAA Privacy Rule (45 CFR part 160), between VHA and a business associate, which must be entered into in addition to the underlying contract for services and before any release of PHI can be made to the business associate, in order for the business associate to perform certain functions or activities on behalf of VHA. Chief Acquisition Officer (CAO) means the Principal Executive Director, Office of Acquisition, Logistics, and Construction. COR means Contracting Officer's Representative. FAR means the Federal Acquisition Regulation. GAO means the Government Accountability Office. Gray market items means original equipment manufacturer goods intentionally or unintentionally sold outside an authorized sales territory or sold by non-authorized dealers in an authorized sales territory. HCA means the Head of the Contracting Activity, an individual appointed in writing by the SPE. Information system means, pursuant to 38 U.S.C. 5727, a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information whether automated or manual. Information technology (see FAR 2.101) also means Information and Communication Technology (ICT). Information technology-related contracts means those contracts which include services (including support services) and related resources for information technology as defined in this section. OGC means the Office of the General Counsel. Ordering officer means the VA official authorized to order supplies and services against a FAR-based contract or agreement in accordance with the ordering limits identified in the contract or agreement or the specific ordering guide in accordance with 801.601(b). Privacy officer means the VA official with responsibility for implementing and oversight of privacy related policies and practices that impact a given VA acquisition. Public Law (Pub. L.) 109-461 means the Veterans Benefits, Health Care and Information Technology Act of 2006, as codified in 38 U.S.C. 8127 and 8128. SDVOSB/VOSB when used as an initialism means a service-disabled veteran-owned small business (SDVOSB) and/or veteran-owned small business (VOSB) that has been found by VA eligible to participate in the Veterans First Contracting Program implemented at subpart 819.70 and listed in the Vendor Information Pages. The term is synonymous with VA or VIP-verified small business concerns owned and controlled by Veterans. Security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements. Sensitive personal information means, with respect to an individual, any information about the individual maintained by VA, including but not limited to the following: