Office of Acquisition and Logistics (OAL)

Part 802 - Definitions of Words and Terms

AUTHORITY: 40 U.S.C. 121(c); 41 U.S.C. 1121(c)(3); 41 U.S.C. 1702; and 48 CFR 1.301 through 1.304.

Deviation per Class Deviation from VAAR parts 802, 806, 808, 810, 813, 819, 852, and 873, dated February 16, 2023, to implement the expansion of the certification requirement across all Federal agencies for Service-Disabled Veteran-Owned Small Businesses (SDVOSBs), and the transfer of the certification authority for both SDVOSBs and Veteran-Owned Small Businesses (VOSBs) from the VA to the Small Business Administration (SBA), effective January 1, 2023. The class deviation updates various VAAR parts to implement the new policy regarding the SBA Veteran Small Business Certification Program, the relevant SBA certification database, and removing the VA VIP database title and web address, and other pertinent information.

Subpart 802.1 - Definitions

802.101  Definitions. (DEVIATION)

A/E means architect/engineer.

Business associate (or associate) means an entity, including an individual (other than a member of the workforce of a covered entity), company, organization, or another covered entity, as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191) Privacy Rule (45 CFR part 160), that performs or assists in the performance of a function or activity on behalf of the Veterans Health Administration (VHA) that involves the creating, receiving, maintaining, transmitting of, or having access to, protected health information (PHI), or that provides to or for VHA, certain services as specified in the HIPAA Privacy Rule that involve the disclosure of PHI to a contractor by VHA. The term also includes a subcontractor of a business associate that creates, receives, maintains, or transmits PHI or that stores, generates, accesses, exchanges, processes, or utilizes such PHI on behalf of the business associate.

Business Associate Agreement (BAA) means the agreement, as dictated by the HIPAA Privacy Rule (45 CFR part 160), between VHA and a business associate, which must be entered into in addition to the underlying contract for services and before any release of PHI can be made to the business associate, in order for the business associate to perform certain functions or activities on behalf of VHA.

Chief Acquisition Officer (CAO) means the Principal Executive Director, Office of Acquisition, Logistics, and Construction.

COR means Contracting Officer’s Representative.

FAR means the Federal Acquisition Regulation.

GAO means the Government Accountability Office.

Gray market items means original equipment manufacturer goods intentionally or unintentionally sold outside an authorized sales territory or sold by non-authorized dealers in an authorized sales territory.

HCA means the Head of the Contracting Activity, an individual appointed in writing by the SPE.

Information system means, pursuant to 38 U.S.C. 5727, a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information whether automated or manual.

Information technology (see FAR 2.101) also means Information and Communication Technology (ICT).

Information technology-related contracts means those contracts which include services (including support services) and related resources for information technology as defined in this section.

OGC means the Office of the General Counsel.

Ordering Officer means the VA official authorized to order supplies and services against a FAR-based contract or agreement in accordance with the ordering limits identified in the contract or agreement or the specific ordering guide in accordance with 801.601(b).

Privacy officer means the VA official with responsibility for implementing and oversight of privacy related policies and practices that impact a given VA acquisition.

Public Law (Pub. L.) 109-461 means the Veterans Benefits, Health Care and Information Technology Act of 2006, as codified in 38 U.S.C. 8127 and 8128.

SBA certification database means the database of certified VOSBs and SDVOSBs eligible to participate in the Veteran Small Business Certification Program (VetCert) (see 13 CFR 128) or the VA Veterans First Contracting Program.

SDVOSB/VOSB (see 13 CFR 128.102) when used as an initialism means a service-disabled veteran-owned small business (SDVOSB) and/or veteran-owned small business (VOSB) that has been certified by SBA as eligible to participate in the Veteran Small Business Certification Program (VetCert) or the VA Veterans First Contracting Program after January 1, 2023 and appearing in the SBA certification database. The term is synonymous with certified small business concerns owned and controlled by Veterans.

Security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.

Sensitive personal information means, with respect to an individual, any information about the individual maintained by VA, including but not limited to the following:

(1) Education, financial transactions, medical history, and criminal or employment history.

(2) Information that can be used to distinguish or trace the individual’s identity, including but not limited to name, Social Security Number, date and place of birth, mother’s maiden name, or biometric records.

Service-disabled Veteran-owned small business (SDVOSB) or small business concern owned and controlled by service-disabled Veterans or Veterans with service-connected disabilities has the same meaning as service-disabled veteran-owned small business concern defined in 15 U.S.C. 632(q)(2), except that for acquisitions and subcontracts authorized by 38 U.S.C. 8127 and 8128 under the Veterans First Contracting Program, these businesses must be certified pursuant to 13 CFR 128 and listed as such in the SBA certification database.

Small business concern has the same meaning as defined in FAR 2.101.

SPE means the Senior Procurement Executive who is also the Executive Director, Office of Acquisition and Logistics.  The SPE is responsible for the management direction of the VA acquisition system.

VA means the Department of Veterans Affairs.

VAAR means the Department of Veterans Affairs Acquisition Regulation.

VA Information Security Rules of Behavior for Organizational Users / VA National Rules of Behavior means a set of VA rules that describes the responsibilities and expected behavior of users of VA information or information systems.

VA Rule of Two means the determination process mandated in 38 U.S.C. 8127(d)(1) whereby a contracting officer of the Department shall award contracts on the basis of competition restricted to certified small business concerns owned and controlled by Veterans if the contracting officer has a reasonable expectation that two or more SDVOSBs/VOSBs will submit offers and that the award can be made at a fair and reasonable price that offers best value to the United States. For purposes of this VA specific rule, a service-disabled Veteran-owned small business (SDVOSB) or a Veteran-owned small business (VOSB), must meet the eligibility requirements in 38 U.S.C. 8127(e), (f) and VAAR 819.7003 and be listed as certified in the SBA certification database.

VA sensitive information means all VA data, on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information and includes sensitive personal information. The term includes information where improper use or disclosure could adversely affect the ability of VA to accomplish its mission, proprietary information, records about individuals requiring protection under various confidentiality provisions such as the Privacy Act and the HIPAA Privacy Rule, and information that can be withheld under the Freedom of Information Act. Examples of VA sensitive information include the following: individually-identifiable medical, benefits, and personnel information; financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, investigatory, and law enforcement information; information that is confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege; and other information which, if released, could result in violation of law or harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.

Veteran-owned small business (VOSB) has the same meaning as Veteran-owned small business concern defined in 15 U.S.C. 632(q)(3), except that for acquisitions authorized by 38 U.S.C. 8127 and 8128 for the Veterans First Contracting Program, these businesses must be listed as certified in the SBA certification database. SDVOSBs are also considered VOSBs, as long as they are listed as certified in the SBA certification database.

Veterans First Contracting Program means the program Public Law 109-461 (38 U.S.C. 8127 and 8128), as implemented in subpart 819.70. This program applies to all VA contracts (see FAR 2.101 for the definition of contracts) as well as Blanket Purchase Agreements (BPAs), Basic Ordering Agreements (BOAs), and orders against the Federal Supply Schedules (FSS), unless otherwise excluded by law.

return to top