Attachment A - SOW EMR EHS final (002).pdf

Page - 1

Attachment A Statement of Work (SOW) - Specifications

NIST Gaithersburg Health Unit Occupational Medicine - Electronic Medical Records Software as a Service (SaaS)

INTRODUCTION

The NIST Gaithersburg Health Unit provides pre-employment physical examinations, annual physical examinations, allergic shots service, and urgent care services to NIST staff. All medical records from these services are stored in hard and or paper copies (approximately 3,700 records to-date) that are securely locked in file cabinets. In order to facilitate data collection and retrieval efficiency and accuracy, and to provide timely and better patient care for NIST staff, a transition from hard and or paper copies to an Electronic Health Records (EHR) system is required.

OBJECTIVE

The contactor shall provide the required licenses to allow the NIST Gaithersburg Health Unit Occupational Medicine to acquire an electronic health records system.

CONTRACT REQUIREMENTS

ELECTRONIC MEDICAL RECORDS SYSTEM TECHNICAL REQUIREMENTS

The contractor shall provide a cloud based customizable occupational medicine Electronic Medical Records (EMR) system with the following features:

- Appointment scheduling

- Department of Transportation (DOT) exams, testing procedures and compliance management

- Medical surveillance management

- Pre-employment exams management

- Annual physical exams management

- Vaccination management

- Diagnostic testing management

- Worker’s compensation management

- Incident management

- Employers letters and correspondence tracking

- Management of scanning and faxing

- Regulatory compliance management

- · Employer portal

- Patient portal that allows for customization to include Rules of Behavior and

Privacy Act notices

- Auto appointment and health maintenance reminders

Page - 2

- Mobile, onsite data capture

- Data hosting and backup

- System access by desktops, laptops, tablets, smart phones

Base Period:

Minimum Specifications o A web-based software product is required.

o The contractor shall provide a DOC and NIST IT security and privacy approved web based Electronic Medical Record system (EMR).

Delivery/Installation

• The contractor shall setup the EMR system within two weeks of being awarded the contract.

• The contractor shall provide training to the Health Unit staff on how to use the EMR system within one week of the system being installed.

• The contractor shall be available to consult and resolve EMR system issues free of charge with the Health Unit staff during normal business hours.

• 8 seats/licenses will be provided to Gaithersburg Health Unit Occupational Medicine for the base period.

• Account setup, training and unlimited technical support

• Initial online training will be provided to all users and any when there is a software update that requires additional training.

• Provide user support to NIST staff to upload paper records into the EMR system

Testing and Acceptance The Contractor will provide a fully operational service that requires no new design or build.

The contractor shall have met all IT Security and Privacy requirements as documented below resulting in a current Authority to Operate (ATO), issued by NIST, that is in place.

Option Periods:

o The contractor will provide maintenance service to the web-based system and continue to maintain the system as outlined in the SOW below.

o 8 seats will be provided to Gaithersburg Health Unit Occupational Medicine for each option period.

o Account setup and training for new staff o Unlimited technical support

ELECTRONIC MEDICAL RECORDS SYSTEM IT SECURITY AND PRIVACY REQUIREMENTS

Page - 3

Data -must reside on servers that are located inside the continental US or its territories.

1. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C.

552a); 36 CFR Part 1222 and Part 1228.

2. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

6. The Government Agency owns the rights to all data/records produced as part of this contract.

7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

8. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.

Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

10. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

Page - 4

Sanitization of Data and IT Asset Disposition

Transition of data. When and as directed by NIST, all data related to the project and related to patients, must be securely transitioned to NIST in support of records management schedules and data preservation.

Sanitization of data. When and as directed by NIST, information sanitization using a method approved by NIST must occur on all devices and services that store data related to this project and related to patients unless such devices and services are formally transitioned to NIST.

IT asset disposition. When and as directed by NIST, any devices funded by the project must be returned to NIST when and as directed by NIST.

Security and Privacy

• There is personally identifiable information involved in the use of this product

• NIST-developed Rules of Behavior will be followed

• The vendor will provide user training materials, and customer support via webinar, telephone, or email

Authentication (Personal Identify Verification (PIV)) The Contractor shall configure its system or application to be compliant with:

• Homeland Security Presidential Directive 12 (HSPD-12): Policy for a Common Identification Standard for Federal Employees and Contractors

• National Strategy for Trusted Identities in Cyberspace (NSTIC)

The preferred user authentication capabilities include integration with the NIST Active Directory Federation Services (ADFS), FICAM TFS approved Identity Service(s) and application issued credentials. The NIST ADFS instance can provide both Kerberos based SSO and PIV card authentication for NIST staff. External collaborators shall be given the option of using an acceptable third-party credential or establishing a credential with the Contractor provided solution. Applications that cannot integrate with the NIST ADFS will implement user authentication via Government issued PIV cards, approved third party credentials and Contractor solution-provided credentials. Third party authentication must be consistent with NSTIC; with providers and protocols approved by the Federal Identity, Credential, and Access Management (FICAM) Trust Framework Solutions (TFS) Program. In all cases a Contractor solution-provided credential must also be supported to allow access by external collaborators that do not have or do not wish to use a trusted third-party credential.

All credentials shall be consistent with NIST Special Publication 800-63, Electronic Authentication Guideline, and the system’s accessed Level of Assurance (LOA). The required minimal Identity Assurance Level is IAL2. The required minimal Authenticator Assurance Level is AA2. Alternatively, the minimal Federated Assurance level is FAL2.

Page - 5

Electronic Signatures The Contractor shall comply with all applicable Federal regulations relating to proper use of electronic signatures.

Encryption The Contractor will provide a portal utilizing FIPS 140-2 validated cryptographic modules for encryption of data in transit and while at rest.

Hypertext Transfer Protocol Secure (HTTPS) and HTTPS Strict Transport Security (HSTS) The Contractor shall ensure that the publicly accessible Federal website(s) and web service(s) are required to provide service only through a secure connection through use of Hypertext Transfer Protocol Secure (HTTPS) and should have HTTP Strict Transport Security (HSTS) enabled, but HTTPS and TLS 1.3 is acceptable if HSTS is not feasible.

Incident Response The Contractor shall ensure coordination of its incident response team with the NIST Security Implementation and Incident Team (SIIRT), ensuring that incidents are reported consistent with NIST SP 800-61, Computer Security Incident Reporting Guide, and the United States Computer Emergency Readiness Team’s (US-CERT) Concept of Operations for reporting security incidents. Specifically, any confirmed incident of a system containing NIST project or patient data or controlling NIST assets shall be reported immediately to SIIRT that results in unauthorized access, loss or modification of NIST data, or denial of service affecting the availability of NIST data. The Contractor shall be able to provide any application and operating system logs associated with an incident as well as a file system timeline for potentially compromised hosts and any additional files referenced during forensic analysis upon request. Logging must be enabled and available for up to 90 days. If possible, the Contractor shall be able to provide audit logs and forensic images of devices that contain information pertaining to the compromise.

Internet Protocol Version 6 (IPv6) Contractor services shall be accessible through both Internet Protocol Version 6 (IPv6) and IPv4. If not already compliant, the Contractor shall provide the Government with a statement regarding its plans to implement IPv6, including timeframe.

IT Security and Privacy The Contractor shall have FedRAMP authorization or an Authorization to Operate (ATO) letter issued by a Federal Government agency as evidence that they have been assessed and authorized. If using an ATO letter, that letter shall clearly state the impact level (e.g., moderate or high) at which the Contractor has been assessed and authorized. If subcontractors are involved, each party shall have the above stated FedRAMP authorization or Federal agency-issued ATO letter stating the authorization. While FedRAMP authorization or ATO is preferred, in lieu of the above the Contractor, and/or its subcontractors, may demonstrate that they have passed an independent security

Page - 6 audit (e.g. Statement on Standards for Attestation Engagements (SSAE), PCI Data Security Standard (PCI DSS)) and/or compliant with the Global Data Protection Regulation (GDPR). Within 5 days of contract award, the Contractor shall provide to NIST, as a deliverable, evidence of the audit or instructions on how to obtain evidence of the above, if the Contractor has had any audits described above or other security audit.

In lieu of FedRAMP authorization, the contractor must undergo an Assessment and Authorization of security and privacy controls and receive an Authority to Operate from NIST and DOC.

Post contract award, the Government will perform a review for a local ATO decision, required for go-live, and ongoing security and privacy assessments for continuous monitoring thereafter. The Government will determine the risk rating of identified vulnerabilities. The Contractor shall respond to the Government with an action plan and schedule to mitigate security or privacy risks found within 10 business days of notification of security or privacy risks. The Government will notify the Contractor of whether or not the action plan and schedule are acceptable. The Contractor shall implement the action plan according to the agreed-upon schedule.

Anticipated impact rating levels based on NIST use cases (by security objective) are Integrity = Moderate, Availability = Low, and Confidentiality = Moderate.

Personnel Security / Physical and Logical Access Requirements The Contractor shall provide evidence that relevant personnel involved in the work have gone through proper background investigations or clearances, as identified by NIST.

Contractor personnel requiring access to IT systems operated by the Contractor for NIST or interconnected to a NIST network shall be screened at an appropriate level in accordance with the Department of Commerce IT Security Baseline Policy (ITSBP). The screening should be appropriate to the highest risk level of the IT systems and information accessed, using, as a minimum, National Agency Check with Inquiries

(NACI).

The Contractor may conduct its own screening of individuals requiring privileged access or limited privileged access provided the Contractor can demonstrate to the Contracting Officer that the procedures used by the Contractor are equivalent to DoC/NIST’s personnel screening procedures for the risk level assigned for the IT position.

The Contractor shall insert this language into all subcontracts, if the subcontractor will have access to an IT system:

Have physical or electronic access to NIST’s computer systems, networks, or IT infrastructure; or

Page - 7

Use information systems to generate, store, process, or exchange data with NIST or on behalf of NIST, regardless of whether the data resides on a NIST or a contractor’s information system.

Role-based and hardware Access The contractor will provide role-based access for both patient (i.e., user) and administrators. Access to the portal should be restricted to NIST IP addresses or devices with NIST certificates on them.

Section 508 The contractor is responsible for ensuring that all Electronic and Information Technologies (EIT) deliverables meet or exceed accessibility and usability design requirements under Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended, and the Web Content Accessibility Guidelines 2.0 (WCAG 2.0) Level AA. The contractor must have the ability and experience in determining 508 compliance of EIT including design specification, testing and verification, and remediation as required.

The contractor will be responsible for acquiring the necessary tools to perform accessibility and usability testing in multiple computing environments with a comprehensive selection of assistive technologies. The contractor shall be prepared to present a Government Product Accessibility Template (GPAT) for each EIT deliverable upon request. These findings must be presented in an accessible electronic format.

All EIT deliverables produced by the contractor shall be accessible and meet the criteria outlined in Section 508 of the Rehabilitation Act of 1973, as amended, and the Web Content Accessibility Guidelines 2.0 (WCAG 2.0) Level AA. EIT deliverables include but are not limited to: websites, mobile applications, webcasts, webinars, multimedia, social media, collaborative workspaces and tools, documents, PDFs, forms, and any training and related training materials. Print materials must be made available in an alternate accessible format when requested

Supply Chain Risk Assessment (SCRA) The Contractor shall comply with all applicable DOC and/or NIST requirements with regard to supply chain risk assessment (SCRM).

Privacy Federal Acquisition Regulation (FAR) Privacy Act clauses:

52.224-1 Privacy Act Notification.

As prescribed in 24.104, insert the following clause in solicitations and contracts, when the design, development, or operation of a system of records on individuals is required to accomplish an agency function:

Page - 8

Privacy Act Notification (Apr 1984)

The Contractor will be required to design, develop, or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of1974, Public Law93-579, December31, 1974 (5 U.S.C.552a) and applicable agency regulations.

Violation of the Act may involve the imposition of criminal penalties.

52.224-2 Privacy Act.

As prescribed in 24.104, insert the following clause in solicitations and contracts, when the design, development, or operation of a system of records on individuals is required to accomplish an agency function:

Privacy Act (Apr 1984)

(a) The Contractor agrees to—

(1) Comply with the Privacy Act of1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies—

(i) The systems of records; and

(ii) The design, development, or operation work that the contractor is to perform;

(2) Include the Privacy Act notification [FAR 52.224-1] contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

(3) Include this clause, including this paragraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

(b) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function.

For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

Page - 9

(c) [definitions] (1) “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

(2) “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

(3) “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

Federal Acquisition Regulation (FAR) Privacy or Security Safeguards in IT

39.105 -- Privacy.

Agencies shall ensure that contracts for information technology address protection of privacy in accordance with the Privacy Act (5 U.S.C. 552a) and Part 24. In addition, each agency shall ensure that contracts for the design, development, or operation of a system of records using commercial information technology services or information technology support services include the following:

(a) Agency rules of conduct that the contractor and the contractor’s employees shall be required to follow.

(b) A list of the anticipated threats and hazards that the contractor must guard against.

(c) A description of the safeguards that the contractor must specifically provide.

(d) Requirements for a program of Government inspection during performance of the contract that will ensure the continued efficacy and efficiency of safeguards and the discovery and countering of new threats and hazards.

52.239-1 --Privacy or Security Safeguards.

As prescribed in 39.106, insert a clause substantially the same as the following:

Privacy or Security Safeguards (Aug. 1996)

Page - 10

(a) The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government.

(b) To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

(c) If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.