Attachment A - W81K00-23-Q-0124 - Statement of Objectives for HPV testing FY24 (1).docx

STATEMENT OF OBJECTIVES

HPV DNA Amplification/Detection Test Department of Pathology and Area Laboratory Services (DPALS) Brooke Army Medical Center (BAMC)

1. Scope

1.1. The Contractor shall provide new molecular testing equipment, reagents, consumables, maintenance support and instrument warranties used in support of Human Papillomavirus (HPV) Deoxyribonucleic Acid (DNA) Amplification/Detection Testing for the Department of Pathology and Area Laboratory Services (DPALS), Microbiology Section, Molecular Laboratory at the Brooke Army Medical Center (BAMC), Joint Base San Antonio, TX 78234.

1.1.1. All supplies and warranties outlined in this Statement of Objectives (SOO) shall be supplied and serviced through a single Contractor (to whom the contract is awarded, to include any parts, equipment, or supplies not manufactured, provided or serviced by the Contractor).

1.1.2. All supplies and work performed in connected with warranties shall preserve the US Food and Drug Administration (FDA) approved status of the assays and instrumentation used.

2. Purpose Persistent infection with human papillomavirus (HPV) is the principal cause of cervical cancer. HPV 16 is by far the most common and oncogenic genotype. HPV DNA detection, in conjunction with cytology, is important in cervical cancer screening and the treatment of cancer precursors. Genotyping of different high-risk HPV types (including genotyping for 16 and 18) is helpful for the risk stratification of HPV-positive women. It is essential that these HPV DNA detection testing supplies are obtained as quickly as possible for BAMC and all its surrounding clinics/healthcare network to ensure protection of the public’s health.

In order to be able to conduct these tests, reagents and automated analyzers are needed for period of performance 1 October 2023 to 30 September 2024 with four (4) option years 1 October 2024 thru 30 September 2028. The equipment shall be able to connect to MHS Genesis and shall come with an un-interruptible power supply capable of providing power for at least 45 to 60 minutes. All equipment and supplies shall be approved by the FDA. The system is FDA Approved Guided programming. This requirement is needed NLT 1 October 2023. All detailed information regarding delivery and installation is provided in the SOO.

3. Ordering Period

Base Period: 1 October 2023 – 30 September 2024 Option 1: 1 October 2024 – 30 September 2025 Option 2: 1 October 2025 – 30 September 2026 Option 3: 1 October 2026 – 30 September 2027 Option 4: 1 October 2027 – 30 September 2028

3.1. The Government will order items on as needed basis and shall only pay for the actual number of tests ordered, received, and accepted by the Government. The quantities listed in the workload data table represent anticipated test volumes for the period of performance listed; however, quantities could increase and/or decrease during certain periods and/or months.

3.2. The inspection and acceptance for all deliverables rendered under this contract will be by the appointed Ordering Officer. The performance by the contractor technician, the quality of services rendered, and any documentation or written material in support of same, shall be subject to continuous inspection, surveillance and review for acceptance by the designated ordering officer representative. Other evaluation factors will be monitored that are not quantified by numerical measurements.

4. Hours of operation:

The Molecular Laboratory is in operation 24 hours a day, 7 days a week. Normal business hours for administrative personnel are Monday through Friday between the hours of 0730 – 1630 CST. Contractor shall coordinate maintenance scheduled with Ordering Officer (OR) and appointed on duty staff in absence of OR no less than 48 hours after receipt of notification.

5. Security requirements and safety:

5.1. SECURITY. The Contractor shall ensure its personnel comply with the local installation requirements for vehicle registration and operation on the military facility. Any vehicle entering the military installation shall have the minimum liability coverage required by the state in which the performance is located. The Contractor shall ensure its personnel comply with installation and military treatment facilities (MTF) personnel identification and access requirements.

5.2. Contractor and all associated sub-contractors personnel shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

5.3. SAFETY. The Contractor shall ensure its personnel comply with all installation and MTF safety regulations. Such regulations include, but are not limited to, general safety, fire prevention, and waste disposal. Copies of these regulations are available in the medical activity safety office or may be obtained through the appointed personnel. The government and the contractor’s service representative will exchange hazard communication information before the commencement of any repair. When required, the contractor’s service representative will comply with the Office of Safety and Health Administration (OSHA) lockout/tag-out standards.

6. Instrument/equipment requirement (owned by contractor):

6.1. The offeror shall provide two new (not refurbished) instruments for BAMC molecular lab.

6.2. Testing systems shall be FDA-approved primary screening for cervical carcinoma and shall include testing for the following: HPV High Risk pool plus HPV 16 & 18 Genotype simultaneously eliminating the need to re-run a sample; as well as a traditional High Risk pool (14 HR Genotypes) with no grey zone or indeterminate results.

6.3. Testing shall be performed on a fully automated In vitro diagnostics (IVD) platform. Each analyzer and all associated reagents shall be approved by the Food & Drug Administration (FDA). All analyzers and associated parts and accessories shall be new. No used, refurbished, or like-new equipment shall be provided in support of this contract at any time.

6.4. Testing for HPV shall be FDA approved and meet HPV testing needs in Atypical Cells of Undetermined Significance (ASCUS) and Negative for Intraepithelial Lesion or Malignancy (NILM) as detailed in recent American Congress of Obstetricians and Gynecologists (ACOG) guidelines and allowed to be used as a first-line primary cervical cancer screening test to detect high risk HPV including genotyping for 16 and 18.

6.5. Testing systems shall process at least 376 to 400 specimens per day using 2 instruments in an 8 hour shift.

6.6. Testing shall contain an internal control for cellularity check such as β globin.

6.7. Testing shall detect HPV DNA

6.8. Testing shall show no cross-reactivity with low-risk HPV genotypes.

6.9. Testing shall accept multiple primary vial formats, including liquid-based cytology PreservCyt containers, for automatic nucleic acid extraction so that no routine pipetting into secondary tubes is required.

6.10. Automated pipetting of specimens shall have a system to prevent cross-contamination by securely locking pipette tips in place to avoid motions that could create aerosols of samples/reagents. Pipetting aspiration and dispensing shall be monitored by pressure within the tips to detect low volumes and clogs to ensure valid results. The system shall have criteria that exist to report an error when low volumes and/or clogs are detected.

6.11. Testing shall offer detection and separation of multiple targets from 1 reaction tube.

6.12. The testing system shall provide bi-directional LIS communication with MHS Genesis to simplify test ordering and support the integrity of results so that no manual data entry is required.

6.13. The testing system shall offer a fully automated pre-analytical component that standardizes sample handling and automates mixing and uncapping of PreservCyt containers and automated barcode check and sample alignment. This pre-analytical step shall have minimal hands-on time requiring less than 5 minutes of setup.

6.14. Pipetting shall be performed utilizing aerosol barrier tips.

6.15. Platform shall be compatible with facility data transfer systems.

6.16. A data management system, to include middleware, not contained within the Molecular analyzer

6.17. The system shall provide a central data management hub, to which all major systems included in this SOW connect to Unit 1 - Sample processing/extraction unit; Unit 2 Amplification/detection unit.

6.18. The system shall not require remote communication to outside sources to be functional.

6.19. Software shall track instrument maintenance requirements.

6.20. The analyzers shall be able to recognize MHS Genesis generated bar-code labels (both code 39 and 128) on primary sample tubes.

6.21. Peripherals, to include Uninterruptable Power Sources (UPSs), electrical line conditioners as required, instrument-specific computer terminals/CPUs, printers to include toner for each as needed, and other equipment where required.

6.22. Sample Processing System to perform the requested processing:

6.22.1. System shall be able to perform automated uncapping of various samples to include ThinPrep container, etc.

6.22.2. Shall be able to perform automated recapping of various samples to include ThinPrep containers, etc.

6.22.3. Shall perform standardized sample handling to include automated barcode check and alignment

6.22.4. Shall perform automated mixing produces consistent homogeneity

6.22.5. Shall contain built in feature to reduce the risk of cross-contamination

6.22.6. Shall decap or recap 94 samples in less than 30 minutes (walkaway time)

6.22.7. The system shall not require remote communication to outside sources to be functional.

6.22.8. Platform shall operate using one computer.

6.22.9. Pedestal(s) capable of supporting each workcell system as appropriate, to include computer terminals or other automated instruments/peripherals as appropriate, providing a neat work area (e.g., reagent, cable and tubing control/maintenance).

6.23. The Instruments will be installed with backs of machines near wall. Each analyzer, including printer, monitor, UPS, and computer system, shall fit within the dimensions outlined in figure below and complete operations on one platform. Sufficient room for proper exhaust and heat clearance based on manufacture’s site specifications shall be maintained, with at minimum a 6” clearance between the existing wall and instruments. Any sliding compartments or access drawers for servicing cannot extend beyond the width of each individual unit outlined in figure below when fully expanded.

6.24. Lab Layout. The offeror shall provide a diagram or other graphical representation demonstrating how its proposed equipment fits within the dimensions below with its quote.

7. Reagent Requirements – Molecular Diagnostics Laboratory The Contractor shall provide the following at a minimum for Molecular Laboratory operations at the main hospital located at BAMC:

7.1. The contractor shall have FDA approved Reagents/consumables that shall meet the requirements of the Reference laboratory mission, workload, and test menu (see Tables 1).

7.2. The Contractor shall provide all reagents/reagents packs, calibrators/standards, quality control materials, user- replaceable maintenance items, and analyzer specific tools/supplies to support the ongoing delivery of laboratory services using the equipment outlined in this section.

7.3. Reagents/consumables shall meet the requirements of the 24/7 BAMC mission, workload, and test menu.

7.4. The Contractor shall provide quality control materials acceptable to the Molecular Laboratory Medical Director. This includes third-party controls when requested/required by the laboratory.

7.5. In determining reagent requirements, the Contractor shall consider requirements for routine quality control runs (as defined by the Laboratory Director), routine calibration, periodic calibration/calibration verification in accordance with departmental policy and troubleshooting of out-of-control assays when calculating the yearly requirements.

7.6. Reagents used for troubleshooting analytical systems shall be reimbursed (or replaced) by the Contractor at no additional cost.

7.7. The Contractor shall sequester lots of required quality control materials and test reagents so that a change in lot will not be more frequent than once a year.

7.8. The Contractor shall provide, upon shipment, an electronic tracking mechanism whereby the Government is able to identify the shipping status of any equipment, reagents, or materials. Deliveries of required items shall be in monthly drop shipments on the second Wednesday of the month. Orders called in by the COR or ACOR shall arrive no later than one week from the requested date of delivery. Any supplies that are placed on back order shall be communicated electronically to the Government, clearly identified on the shipping documents and delivered in a timely manner, not to exceed ten (10) working days. In the instance a back- order exceeds 10 working days, the Contractor shall provide testing services through local sub-contract at their cost.

7.9. Emergency orders shall be delivered within 24 hours after the order is placed.

7.10. The Contractor shall provide paper and electronic copies of safety data sheets (SDSs) for each reagent item delivered under this contract (as appropriate).

8. Delivery of Equipment

8.1. Vendor shall provide transition plan for instrument(s)/equipment delivery, installation, and verification that aims at avoiding or minimizing interruption of in-house testing, expenses associated with send-out of samples to reference laboratory for testing, and impact to patient care.

8.2. Vendor shall indicate in transition plan what facility modifications will be required for instrument(s)/equipment delivery.

8.3. All equipment (owned by contractor) shall include delivery, installation, maintenance, and removal upon termination of contract. Contractor shall furnish all necessary calibrators/standards and quality control materials necessary to perform the initial method verifications per Clinical Laboratory Improvement Amendments (CLIA)/ National Committee for Clinical Laboratory Standards (NCCLS) guidelines.

8.4. The instrument(s)/ equipment shall be delivered to the Brooke Army Medical Center (4th floor), Molecular laboratory (room 428-5) within 30 days or less after contract award. Exact installation location shall be coordinated by contractor and government point of contact (OIC and/or NCOIC). Equipment setup, LIS connectivity, on-site training, and method verification studies, shall be completed by vendor personnel within six (6) weeks or less after contract award to ensure that equipment is fully operational.

8.5. SAFETY DATA SHEETS (SDS): The contractor shall provide safety data sheets (SDS) for each item delivered under this contract that is considered to be HAZARDOUS MATERIAL. The SDS shall contain information on the hazards associated with each specific chemical or material. The SDS shall contain at a minimum the following information: identification of the specific hazard, the required practice for the safe use of the product, first aid procedures, and what to do in the event of a spill or other mishap or accident.

8.6. The contractor shall be responsible for installation, which consists of in-house delivery, positioning, and mounting of all equipment listed on the delivery order and connections of all equipment and interconnecting wiring and cabling if applicable in coordination with the facility biomedical engineer. Upon receipt of notice to proceed with installation, it shall be the contractor's responsibility to inform the Contracting Officer of any problems which may be anticipated in connection with installation, or which will affect optimum performance once installation is completed. In the event that progress of the installation is interrupted through no fault of the contractor, the continuous installation referenced in the preceding paragraphs may be terminated until such time as the cause of delay has been eliminated, and then shall be resumed within 24 hours after the contractor has been notified that work may again proceed.

8.7. Vendor shall provide equipment installation and possible reinstallation at minimal costs if the equipment is required to be moved due to construction or laboratory redesign.

8.8. All reagents shall be available for delivery within one business day of contract award date.

Delivery shall be to the following address:

Brooke Army Medical Ctr Bldg. 3600 3551 Roger Brooke Dr Fort Sam Houston TX 78234

The Point of Contact (POC) for all deliveries:

NCOIC or Supervisor, Microbiology Laboratory Department of Pathology and Area Laboratory Services San Antonio Military Medical Center Tel: (210) 916-5005

9. Installation and Validation During the installation and validation of the equipment and tests to be performed by the Contractor, the Contractor will coordinate scheduled meetings with technical experts of the Laboratory to discuss milestones and to provide updates on completion date. Following the completion of the installation of the new equipment and validation of the tests to be performed, the Contractor will meet with technical experts from the Laboratory at times mutually agreeable to discuss areas of interest to the Laboratory or hospital staff. When the validation of the equipment and tests are to be performed, the Contractor shall provide all reagents, calibrators, controls and any other materials used at no additional cost to the Government. The contractor will provide analyzed data to laboratory supervisor for approval. If the validations are not found to be adequate, the Contractor will be responsible for repeating studies in a timely manner in order for the laboratory to meet go live deadlines.

10. Preventative maintenance, failures and repairs

10.1. The contractor shall provide all personnel, equipment, tools, materials, supervision, parts, transportation, and other items and services necessary to perform all required repairs and scheduled preventive maintenance/safety inspections and calibrations of their equipment. Contractor shall coordinate with the designated point of contact all scheduled maintenance within ten (10) business days prior to performing preventative maintenance services.

10.2. The performance of scheduled periodic preventive maintenance, safety checks, and calibrations that are not normally performed at the operator level will be performed by contractor service personnel in accordance with requirements as specified in the contractor’s instrument maintenance manual. The contractor shall be responsible for furnishing maintenance, services, repairs, and parts as required by manufacturer in order to maintain the system in optimal operating condition.

10.3. The contractor shall provide a full-service plan to include the recommended unscheduled and preventive maintenance service for their instrument/equipment period. Service shall include repair and replacement of defective parts, complete maintenance program (as required by the manufacturer’s maintenance manuals), and hotline telephone service, in order to assist customer in troubleshooting problems.

10.4. Preventive maintenance services shall be performed in accordance with the manufacturer’s standard/procedures. A preventive maintenance service shall include, but is not limited to, safety, calibration, complete operational testing, lubrication, adjustments, and cleaning of equipment to which the operator does not have access. This also includes the installation of all non-operator parts required to ensure proper operation.

10.5. Upon notification of equipment failure own by contractor, the contractor shall respond to telephonic requests for unscheduled repair within 24 hours. Shall the instrument/equipment become inoperable, the contractor’s Repair Service Engineer / technician shall be on-site within 24 hours of initial notification for routine/emergency failures. If the equipment is out of service for longer than 72 hours (from the time-of-service technician’s arrival on site), the contractor shall notify the government point of contract on duty, in writing, as to the reason(s) (i.e. non-availability of parts, etc.) for non-compliance.

10.6. If the equipment cannot be repaired, a replacement instrument shall be provided within seven (7) days. If the equipment cannot be replaced, the Government may seek remedies for non-compliance with terms and conditions of this contract.

10.7. Within one (1) business day after completion of a repair, the contractor’s representative shall furnish the Point of Contact (POC) one (1) copy of a service report for all services performed. The service report shall contain, at a minimum, the following information:

a. Nomenclature, date, description of services performed (i.e., preventative maintenance service, or unscheduled repair service)

b. Location of services performed, duration of services performed, list of parts replaced, and other actions taken to restore operability of the instrument/equipment, name of technician.

**Full report shall be submitted to designated government point of contact**

10.8. Contractor shall notify government of any hazard information before beginning equipment repair and shall comply with the Occupational Safety and Health Administration while performing maintenance on electrical equipment.

10.9. When appropriate, the contractor’s representative shall attach and complete a DD Form 2163 (sticker), entitled “Medical Equipment Verification/Certification” to the equipment upon completion of calibration services. The Point of Contact will provide the DD Form 2163 to the contractors’ representative. If the DD Form 2163 is already attached to the equipment, the contractors' representative shall update the existing DD Form 2163. Procedures for updating the 2163 will be provided by the Point of Contact.

11. Customer service

11.1. The Contractor shall provide direct customer service and support, during normal business hours and on-call emergency repair service support, to assist operators in correcting equipment operation problems.

11.2. For Emergency Services and unscheduled services, the Contractor’s qualified service technician shall be on-site to provide emergency service (service requiring immediate repair) within 24 hours. The equipment shall be repaired and operational at the minimum of 72 hours after arrival of contractor on site.

11.3. The Contractor shall perform preventive maintenance services (PMS), safety tests, calibrations, and unscheduled repair services in accordance with procedures and practices prescribed by the manufacturer of the equipment. Scheduled routine services shall be performed between 0730-1630 LOCAL Monday-Friday, excluding U.S. Holidays.

11.4. The Contractor shall provide a full unscheduled and preventive maintenance service for the instrument/ equipment owned by contractor. All maintenance and repairs shall be inclusive of all costs for the performance of scheduled periodic maintenance (as required by the Contractor’s instrument maintenance manuals), unscheduled maintenance and repair of the analyzers and any associated equipment provided by the Contractor as part of the analyzer system, including replacement parts, replacement part shipment costs, and service technician travel costs for performance of maintenance services.

11.5. The contractor’s qualified service technician shall be on site to provide routine services; service requiring immediate repair; and scheduled services for preventive maintenance (as specified in the Contractor’s instrument maintenance manual), safety and calibration as required by this statement of work. The equipment shall be repaired and operational within 72 hours after arrival of contractor on site.

11.6. Upon analyzer failure, the Contractor’s qualified service technician shall be on-site to provide unlimited emergency service (service requiring immediate repair; an unscheduled maintenance/service requirement) within 24 hours. The equipment shall be repaired and operational within 72 hours after arrival of contractor on site.

11.7. Shall the analyzer at BAMC become inoperable, the Contractor’s technical repair specialist shall be on-site within 24 hours of initial notification and make the repair within 72 hours after arrival of contractor on site. If the analyzer cannot be repaired within 72 hours after arrival of contractor on site, a replacement analyzer, at no additional cost to the U. S. Government, will be provided within seven (7) days of the initial notification to be utilized by the U.S. Government until the original instrument is fully repaired and accepted for service.

11.8. During the period when the analyzer is inoperable, the Contractor will arrange the pickup and delivery of critical specimens to a College of American Pathologists accredited clinical laboratory of their choice. The selected laboratory will provide patient reports. Each patient report shall include the testing laboratory’s reference range for the test being performed. The Contractor will be responsible for all costs associated with the provision of this service, including those for delivery of hardcopy patient results, for as long as the analyzer remain inoperable.

11.9. The Contractor shall provide all necessary user-replaceable maintenance items that will be required to support the analyzer, and any analyzer specific tools/supplies necessary to perform operator-level periodic maintenance tasks, at no additional cost to the U.S. Government.

11.10. Minimal Hands-on System Maintenance required, including limited reagent preparation time/steps prior to use. List reagent /calibrator prep for assays.

11.11. Computer Patient Data Handling: No hardware, containing any patient information is to be removed from any location, without the approval and removal of data by the facility information technology department.

11.12. Preventative and Predictive Maintenance: Contractor shall provide regular, scheduled maintenance to assure the continued reliable operation of the equipment. These preventive maintenance visits shall be of a frequency that conforms to the manufacturer's operation and maintenance instructions for the supported equipment. Minimum of 1 per year per instrument unless documentation for volume performed denotes not required for optimum quality of operation.

11.13. Emergency Repair: Emergency repairs shall be performed after notification that the equipment is inoperative. The contractor shall provide the government with a designated point of contact and shall make arrangements to enable its maintenance representative to receive such notification. The contractor shall perform emergency repair service within 24 hours of time of notification of the malfunction.

11.14. Maintenance Support: Service repair person locally based within San Antonio geographical area,

11.15. Operator Procedure Manuals: Operator and Service manuals along with Clinical and Laboratory Standards Institute (CLSI) compliant procedures shall be furnished for each instrument model supplied, unless provided electronically on board the instrument. Vendor to write Standard Operating Procedures for each assay in the laboratory template, to ensure that procedures are totally available prior to implementation.

12. Training

12.1. The Contractor will provide initial operator training to all technicians assigned to the U.S. Government site (BAMC Department of Pathology Microbiology staff), as well as annual refresher training, as needed, to ensure adequate user competency during times of personnel turnover.

12.2. All training manuals/guides, instructional literature, and any other related written/electronic material shall be provided. Training shall include basic operation of the equipment, troubleshooting procedures, performance of operator-level periodic preventive maintenance procedures, and use of the data management/quality control software.

12.3. In addition, the contractor shall provide supplemental operating training to above government personnel, without additional charge to the government, upon installation of the upgrade in equipment hardware or operating system software connected with the operation of an instrument already furnished.

12.4. In the case of any significant software or assay procedural updates, the Contractor shall provide one (1) primary (key) operator training slot per major instrument/equipment, one (1) key operator Training per new instrument install, one (1) key operator training for the existing instrumentation, two (2) On-site in lab training slots for the instrumentation to be used over the agreement as the lab needs for staff changes. This training can be on or off-site at the Contractor’s full expense.

13. Information security

13.1 The Contractor shall comply with the most recent published versions of the following references, as well as all regulations or guidance referenced within those publications:

13.1.1. United States Law

· The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

· The Federal Information Security Management Act (FISMA)

· The E-Government Act of 2002

13.1.2. Office of Management and Budget (OMB)

· Circular A-130

· Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors

13.1.3. National Institute of Standards and Technology (NIST)

· NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems

· NIST SP 800-39—Managing Information Security Risk: Organization,

· NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

· NIST SP 800-60—Volume 1 Revision 1: Guide for Mapping Types of Information and Information Systems to Security Categories

13.1.4. Federal Information Processing Standards (FIPS)

· FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

· FIPS PUB 199 – Standards for Security Categorization of Federal Information and Information Systems

· FIPS PUB 200: Minimum Security Requirements for Federal Information and Information Systems

· FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

13.1.5. Department of Defense (DoD)

· DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

· DoD Instruction 8500.1, Cybersecurity

· DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

· DoD Instruction 8510.01, Risk Management Framework Process (RMF)

· DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

· DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

· DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs

· DoD Directive 5400.11, DoD Privacy Program

13.2. TELECOMMUNICATION

13.2.1. Systems that provide the ability to control instrument software from remote locations are preferred. All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software shall be able to pass MITC testing and review and be awarded a Certificate of Networthiness (CoN) from NETCOM. Submission of the CoN shall be completed within six (6) months of contract award.

13.2.2. In accordance with contract requirements, Contractors shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

13.2.3. The Contractor shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies and will provide, maintain and configure VPN concentrator that complies with DoD security standards.

13.2.4. All costs for VPN hardware and software shall be incurred by the Contractor.

13.2.5. The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chief Information Officer.

13.2.6. The Contractor shall validate that systems authenticate users through the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the vendor's technical users will maintain secure logon.

13.3. RISK MANAGEMENT. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security. "Vendors shall ensure ability to conform to all standards set forth by Department of Defense Risk Management Framework."

13.4. BUSINESS TO BUSINESS (B2B) PARTNERS AND 3rd PARTY VENDORS-General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow

13.5. PERSONNEL SECURITY.

13.5.1. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

13.5.2. Follow the DoD guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

13.5.3. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility local area network (LAN).

13.5.4. Immediately report to the MTFs Security Office and deny access to any automated information system (AIS), network, or information if a Contractor personnel filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for any reason.

13.5.5. Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

13.5.6. Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractors personnel shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce shall comply with all personal identity verification requirements as direct by DOD, HQDA, and or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, shall the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

13.6. . ELECTRONIC SECURITY.

13.6.1. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of SAMMC shall operate in accordance with controlling laws, regulations, DoD/DHA, and local policy.

13.6.2. Risk Management Framework(RMF) requirements apply to all DoD/DHA and Contractor’s IS/networks that receive, process, display, store or transmit DoD information. The Contractor shall comply with the RMF process for safeguarding IS.

13.6.3. Authorization to Operate is the formal approval by the Government to operate the Contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, authorization allows IS/networks to operate within the given operational environment with stated interconnections; and with appropriate monitor level of protection for the specified period.

13.6.4. The Contractor shall comply with RMF requirements, as specified by the Government that meet appropriate DoD/DHA Information Assurance requirements. The RMF requirements shall be met before the Contractor’s system is authorized to access DoD/DHA data or interconnect with any DoD/DHA IS/network that receives, processes, stores, displays or transmits DoD/DHA data. The Contractor shall ensure the proper Contractor support staff is available to participate in all phases of the RMF process. They include, but are not limited to:

· Attending and supporting RMF meetings with the Government

· Supporting/conducting the vulnerability mitigation process

· Supporting the RMF Team during system security testing

13.6.5. Contractors shall confirm that their networks are locked down prior to initiating testing.

13.6.5.

13.6.5.1. Conformation of system lock down shall be agreed upon during the definition of the RMF boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

13.6.5.2. Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

13.6.6. Any re-configuration or change in the system during the C&A testing process shall require a re- base lining of the system and documentation of system changes. Some changes will necessitate a pause in work depending on the severity and impact of change and determined by the COR in conjunction with the IA representative.

13.6.7. Vulnerabilities that have been identified by the DHA as "must-fix" issues during C&A process shall be mitigated according to the timeline identified by the DHA Representative. C&A Checklists are provided for complying DHA C&A requirements.

13.6.8. A request for a waiver to the C&A requirements may be submitted for temporary testing and other usual circumstances. A waiver request shall be submitted, in writing, to the Designated Approving Authority (DAA). The request shall include mitigation strategies that ensure adequate protection measures and security controls are in place (for example: air gapping a testing network).

13.6.9. Information Assurance Vulnerability Management (IAVM). The contractor shall implement an information assurance vulnerability management program. The DHA IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to DHA systems. As part of the program, the contractor shall provide a primary and secondary point of contact for IAVM compliance reporting. The contactor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance to the DHA IA Operations POC. Receipt and compliance messages to DHA shall occur within the stipulated time window, as stated in the vulnerability message.

13.6.10. Guidance regarding the requirement for IAVM is contained in the Army Regulation 25–2, "Information Assurance” and Army Regulation 25–1, “Army Knowledge Management and Information Technology.” An asset is defined as any hardware device, such as a router, firewall, server, or an operating system image accessed by more than one user. The “MEDCOM IASO list server is the primary means to disseminate IAVAs, Information Assurance Vulnerability Bulletins (IAVBs), and Information Assurance Technical Advisories down to the System Administrator (SA) and applicable personnel throughout the chain of command. Requests to be added to the IASO list server shall be sent to medcom.ia@amedd.army.mil.

13.6.11. The contractor shall maintain any development environments in accordance with MEDCOM Information Assurance (IA) best practices and operational requirements. During product development for the Army, the contractor shall ensure that all IA mitigation strategies have been applied to the development environment prior to any Army data being loaded onto any assets or software for testing or delivery.

13.6.12. IA mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the Army shall be in compliance with all known applicable Army Computer Emergency Response Team (ACERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

13.6.13. Disposing of Electronic Media. Contractors shall follow the Army standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with Army Regulation 25–2, "Information Assurance” and Army Best Business Practices (BBP), “Reuse of Computer Hard Drives.”

13.6.14. Ports Protocols and Services. Contractors shall follow all current Army standards and requirements for acceptable Ports, Protocols, and Services. Any requests for exception to using the current Army Ports, Protocols, and Services standards requires an request for exception sent through the Program Manager to the DAA.

13.6.15. Public Key Infrastructure and Encryption. Contractors shall follow the Army standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication. Where interoperable PKI is required for the exchange of unclassified information between the Army and its contractors and contractors, industry partners shall obtain all necessary certificates. Contractors shall turn over to the Army all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support. The Contractor shall provide a written report detailing all of the above, prior to task order expiration, regardless of modifications or extensions.

13.7. INFORMATION SYSTEMS (IS)/NETWORKS PHYSICAL SECURITY.

13.7.1. The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor shall support a Physical Security Audit performed by the Government of the Contractor's internal information management infrastructure.

13.7.2. The MHS Physical Security Audit information is available at:

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls.

13.7.3. The Contractor shall correct any deficiencies identified by the Government of the Contractor's physical security posture. New Army policies will be posted to the following website:

http://www.apd.army.mil/

13.8. SPECIAL REQUIREMENTS FOR PROTECTED HEALTH INFORMATION.

13.8.1. Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the Contractors shall :

13.8.2. Notify the MTF HIPAA Security Manager.

13.8.2.1. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

Table 1. Expected Annual Tests Volume for the Molecular Laboratory:

Personally Identifiable Information, Protected Health Information, and Federal Information Requirements Revised 10/27/2020)

1. General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws.

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11-R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2. Records Management When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA) The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at dha.ncr.pcl.mbx.foia-requests@health.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers shall be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria.