20230731-022112 - PWS - PIAS-E FY24_0112024 (DRAFT).pdf

DHA PWS Template V13 November 16, 2021

Department of Defense Defense Health Agency

Performance Work Statement

Pharmacy Inpatient Automation Solution-Enterprise (PIAS-E)

Healthcare Operations

Pharmacy Operations Division

Solicitation Number:HT001124R0001 Version: 1

Date: 12/22/2023

November 16, 2021

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide maintenance and support services including licenses for the Pharmacy Inpatient Automation Solution – Enterprise (PIAS-E).

1.2 Description of services/introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform PIAS-E as defined in this Performance Work Statement (PWS), except for those items specified as government furnished property and services. The Contractor shall perform to the standards in this performance work statement.

1.3 Background: The Defense Health Agency (DHA) is the Department of Defense (DoD) agency that administers the health care plan for the Uniformed Services, retirees, and their families. DHA serves more than 9.6 million eligible beneficiaries worldwide. Under the DHA authority, the Pharmacy Operations Division (POD), provides policy guidance, and coordinates DoD pharmacy policy with the Assistant Secretary of Defense for Health Affairs (ASD/HA) and the individual Service Surgeons General through the DoD Pharmacy Board of Advisors.

Furthermore, the POD is responsible for management and benefit delivery to the DoD beneficiaries. A major focus of DHA is to continue to offer the Military Health System (MHS) a set of safe, effective, and efficient tools supporting the provision of healthcare.

1.4 Objectives: This PWS requires the sustainment of the Commercial-Off-The-Shelf (COTS) PIAS – E solution offering:

Maintenance – provide activities to maintain the operational capabilities of the solution Storage – provide capabilities to store and manage different types of medications and pharmaceutical items at the local site Administration – provide system configuration and management and product life cycle of medications Interfacing – provide industry standard interfacing and integration capabilities Recovery – provide data recovery, data collection, and data retention capabilities Reporting – provide documentation, generation, and management of reporting functionalities at the local, regional, and enterprise level Data Analysis – provide integrated data analysis functions and capabilities at the local, regional, and enterprise level Infrastructure – consolidate the currently deployed regional server architecture [MHS

Application Access Gateway (MAAG)], and then transition to a single enterprise server environment

Licensing – provide the appropriate access to the software capabilities

1.5 Scope: The scope of this contract is to deliver PIAS-E maintenance, support, licensing, equipment relocations, DHA personnel training, technology refreshes, additional components, architecture enhancements, and enterprise reporting for all Government facilities.

1.6 Period of Performance (PoP):

Base Period: 5/1/2024 through 1/31/2025 (Nine months) Option Period I: 2/1/2025 through 1/31/2026 (Twelve months) Option Period II: 2/1/2026 through 1/31/2027 Option Period III: 2/1/2027 through 1/31/2028 Option Period IV: 2/1/2028 through 1/31/2029 FAR 52.217-8: 2/1/2029 through 7/31/2025

1.6.1 Transition: Transition-in/transition-out period RESERVED

1.7 Administrative specifications

1.7.1 Place of Performance: Work will be performed at the Contractor’s facility and at Government Facilities worldwide.

1.7.2 Recognized Federal holidays: No observance of holidays will be recognized.

1.7.3 Hours of operation: The Contractor must always maintain an adequate workforce for the uninterrupted 24/7 performance of all tasks defined within this PWS.

1.7.4 Emergency Services: On occasion, services may be required to support an activation or exercise of contingency plans.

1.7.4.1 Continuity of Operations Plan: The Contractor shall develop and maintain a plan to operate under emergency services.

1.7.4.2 The Contractor shall coordinate with the Contracting Officer Representative (COR) on required tasks while operating under emergency services.

1.8 Contractor travel: Travel is incidental to the primary tasks identified in this PWS.

Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. No separate Travel CLIN shall be included.

1.9 Other Direct Costs (ODC): Government facilities may require expedited air shipping of equipment resulting in additional costs (Exhibit 1).

1.10 Quality

1.10.1 Quality Control (QC): The Contractor shall develop maintain, and document within a Quality Control Plan (QCP) [Attachment 1, Contract Data Requirements List (CDRL) A001] an effective quality control program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is how the work complies with stated requirements. The QCP shall include procedures covering key control (PWS Section 1.11.4.).

1.10.2 Quality assurance: The government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP) (Attachment 2). The QASP defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s) as described in Performance Requirements Summary Matrix (Attachment 3).

1.11 Contractor personnel

1.11.1 Common Access Card (CAC) requirements: The Contractor shall complete or provide to the Government all information required per the DHA CAC request process (Attachment 4a and Attachment 4b), current version 2.1, January 2018, or more recent when updated. A CAC is the standard identification for eligible DoD Contractor personnel.

1.11.1.1 The Contractor shall return sponsored CACs to the COR when Contractor personnel are no longer performing contract-related service or at termination of the contract.

1.11.2 Contractor personnel management onboarding and training (Attachment 1, CDRL A002): the Contractor shall complete all requirements, training, and forms per the DHA’s Onboarding Checklist for Contractor Employees (Attachment 5), current edition February 2018 or more recent when updated.

1.11.3 Physical Security: The Contractor shall be responsible for safeguarding all government equipment, information and property provided for Contractor use. When applicable, at the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4 Key control: All references to keys include key cards. When applicable, the Contractor shall establish and implement methods to ensure Government-issued keys are not lost or misplaced. The Contractor shall not duplicate Government-issued keys.

1.11.4.1 The Contractor shall immediately report any occurrences of lost or duplicate keys to the COR. In the event keys, other than master keys, are lost or duplicated, the Government, will replace the affected lock or locks or perform re-keying. At the discretion of the Contracting Officer (CO), the total cost of re-keying or the replacement of the lock or locks may be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government, and the total cost will be deducted from the monthly payment due the Contractor.

1.11.4.2 The Contractor shall ensure Government-issued keys are not used by unauthorized persons. The Contractor shall not admit unauthorized personnel into restricted access areas.

1.11.5 Lock combinations: When applicable, the Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall notify the COR when personnel no longer have a need to know the lock combinations.

1.12 Key personnel (Contractor): Qualifications for all key personnel are listed below:

1.12.1 Project Manager: The Contractor shall provide a project manager and alternate responsible for the performance of the work, designated in writing to the COR. The project manager or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The task manager or alternate shall be available between 9:00 a.m. to 4:00 p.m. Eastern Time, Monday thru Friday except Federal holidays or

November 16, 2021 when the government facility is closed for administrative reasons. Qualifications for the Project Manager are as follows:

Progressive experience (minimum 5 years; 10 years preferred) in Program Management of Information Technology (IT) projects requiring integration, implementation, and training

Progressive experience (minimum 5 years; 10 years preferred) in schedule management, quality assurance, risk assessment/mitigation, and cost management accounting

1.12.2 Information System Security Officer: The Contractor shall provide an Information System Security Officer (ISSO) and alternate responsible for the Information Assurance and Cybersecurity program for PIAS-E, designated in writing to the COR. The ISSO or alternate shall have full authority to act for the Contractor on all contract matters relating to information security for PIAS-E. The ISSO or alternate shall be available between 9:00 a.m. to 4:00 p.m.

Eastern Time, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for the ISSO are as follows:

Experience with DoD cybersecurity (minimum 5 years) policies, procedures, and regulations

Experience (minimum 5 years) in the DoD Certification and Accreditation (C&A) process

Nationally recognized cyber security certification required [e.g., Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), etc.]

1.12.3 Key Personnel substitution: The proposed substitute shall meet the qualifications above.

The Contractor shall provide the proposed substitute’s resume to the COR within 14 calendar days. Within 7 days of receipt of the resume, the COR will confirm with the Contractor the proposed substitute meets qualifications. No change in fixed unit prices may occur as a result of Key Personnel substitution.

1.13 Data rights: In accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 252.227-7015 (https://www.acquisition.gov/dfars/252.227-7015-technical-data-commercial-products-and-commercial-services.) , 252.227-7025 (https://www.acquisition.gov/dfars/252.227-7025-limitations-use-or-disclosure-government-furnished-information-marked-restrictive-legends.), and 252.227-7037 (https://www.acquisition.gov/dfars/252.227-7037-validation-restrictive-markings-technical-data.), the Government has unlimited rights to all documents/material and data exclusively produced under this contract. All documents and materials produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. All contract exclusive materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

November 16, 2021

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): RESERVED.

1.14.2 Non-Disclosure Agreement (NDA): All DHA Government Contractor personnel obtaining access to proprietary, classified, confidential, or controlled unclassified information shall be required to complete and sign a DHA Contractor NDA (DHA Form 49) (Attachment 1, CDRL A003) prior to commencing work. The Contractor shall execute an NDA on behalf all its business partners performing activities on this contract.

1.14.3 Contracting Officer Representative (COR): A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the contract. The COR is authorized to perform the following functions:

Monitor and assure that the Contractor performs the technical requirements of the contract

Perform inspections necessary in connection with contract performance Maintain written and oral communications with the Contractor concerning technical aspects of the contract Issue written interpretations of technical requirements, including Government drawings, designs, and specifications Monitor Contractor's performance and notify the CO and Contractor of any deficiencies Coordinate availability of government furnished property Review and process invoices from the Contractor

1.14.4 Post award conference/periodic progress meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5 (https://www.acquisition.gov/far/part-42#FAR_Subpart_42_5). The CO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the CO will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Estimated travel for progress meetings is in (Attachment 6).

1.14.4.1 The Contractor shall provide, at minimum, quarterly business reviews addressing schedule, performance, business roadmap, and status of this contract. The Contractor will note any problems or risks and identify recommended solutions. These meetings shall be at no additional cost to the Government.

1.14.4.2 The Contractor shall provide meeting agendas and materials (Attachment 1, CDRL A004) to all participants prior to the meeting, and the included data is current.

1.14.4.3 The Contractor shall provide meeting minutes (Attachment 1, CDRL A005) to all participants post meeting.

1.15 Contractor Identification

1.15.1 Contractor personnel will wear an identification badge within government facilities displaying their name and company name. Contractor personnel shall identify themselves as contract support personnel in all forms of communication while performing duties on the contract.

1.15.2 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Personnel Security

1.16.1 The contractor shall comply with Department of Defense Directive (DoDD) 8140.01, “Cyberspace Workforce Qualification and Management Program” (https://public.cyber.mil/wid/cwmp/); DoD Instruction (DoDI) 8500.01, “Cybersecurity”, dated March 14, 2014 (https://www.esd.whs.mil/portals/54/documents/dd/issuances/dodi/850001_2014.pdf); DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019 (https://www.esd.whs.mil/portals/54/documents/dd/issuances/dodm/602518m.pdf?ver=2019-03- 13-123513-717); DoDI 6025.18, “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019 (https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/602518p.pdf); and DoDM 5200.02, “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020 (https://public.cyber.mil/policy-guidance/dodm-5200-02/).

Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.16.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.16.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.16.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or CUI. If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

1.17 Section 508 Requirement: The Contractor is hereby waived (Attachment 7) from compliance with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d).

November 16, 2021

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D- Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R- Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.1.7 Deliverable: Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.8 Downtime: That time, during the pharmacy’s normal business hours, when the equipment is not available for production use due to instrument malfunction, ongoing preventive and/or corrective maintenance, or safety concerns.

2.1.9 External Causes: An “External Cause” includes: (i) abuse, misuse, or vandalism; (ii) unauthorized repairs, including modification, alternation, and adjustment; (iii) failure of equipment not supplied by Contractor; (iv) a computer virus or other disabling code introduced by a source other than the Contractor.

2.1.10 Local Site Personnel: any facility staff authorized to coordinate system repairs with the Contractor

2.1.11 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.12 Preventive Maintenance: Those periodic and “as required” services necessary to maintain equipment in an operating condition which minimizes corrective maintenance, including but not limited to calibration, adjustment, lubrication, updating and upgrading software for security, safety, compliance, and compatibility issues, as well as that testing required to maintain a safe environment of care, output testing (non-electrical), replacement of worn components and other components excluding consumables per Original Equipment Manufacturer (OEM) Preventive Maintenance (PM) Schedule basis (which becomes corrective maintenance if the component fails due to lack of preventive maintenance).

2.1.13 Quality Assurance: The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.2 Acronyms:

ADP/IT Automated Data Processing/Information Technology AI Administrative Instruction AIS Automated Information System APL Approved Product List ASD Assistant Secretary of Defense ATO Authority to Operate B2B Business-2-Business Bio-ID Biometrics Identification C&A Certification and Accreditation CAC Common Access Card CAP Contractor Acquired Property

CDRL Contract Data Requirement List CHCS Composite Healthcare System CIO Chief Information Officer CISA Certified Information Systems Auditor CISSP Certified Information Systems Security Professional CJCSM Chairman of the Joint Chiefs of Staff Manual CMMC Cybersecurity Maturity Model Certification CMR Contractor Manpower Reporting CNSSI Committee on National Security Systems Instruction CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative COTS Commercial-Off-the-Shelf

November 16, 2021

CSD Cyber Security Division CUI Controlled Unclassified Information DC3 DoD Cyber Crime Center DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDI Department of Defense Instruction DSAs Data Sharing Agreements DSAA Data Sharing Agreement Application DMZ Demilitarized Zone DoDD Department of Defense Directive DoDM Department of Defense Manual DPCLO DHA Privacy and Civil Liberties Office DUA Data Use Agreement ECN Equipment Control Number EHR Electronic Health Record EMS Enterprise Management Server FAQ Frequently Asked Questions FAR Federal Acquisition Regulation FCI Federal contract information FedRAMP Federal Risk Authorization and Management Program FISMA Federal Information Security Modernization Act FSO Facilities Security Officer GFP Government Furnished Property HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HSL Hot Swappable List HTTP HyperText Transfer (Transport) Protocol HTTPS HyperText Transfer (Transport) Protocol Secure IA Information Assurance IAVA Information Assurance Vulnerability Alert IAVB Information Assurance Vulnerability Bulletin IAVM Information Assurance Vulnerability Management ICD Interface Control Document ID Identification IPSEC Secure Internet Protocol IS Information System ISP Internet Service Provider IT Information Technology ISCM Information Security Continuous Monitoring ISSO Information System Security Officer IS Information System IT Information Technology IV Intravenous LOE Level of Effort

November 16, 2021

MAAG MHS Application Access Gateway MedCOI Medical Community of Interest MHS Military Health System MSR Monthly Status Report NDA Non-Disclosure Agreement NIST National Institute of Standards and Technology OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OEM Original Equipment Manufacturer OPM Office of Personal Management OS Operating System PHI Protected Health Information PII Personally Identifiable Information PIAS-E Pharmacy Inpatient Automated Solution - Enterprise PIEE Procurement Integrated Enterprise PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure PM Preventative Maintenance POA&M Plan of Action and Milestones POC Point of Contact POD Pharmacy Operations Division PoP Period of Performance PPSM Ports, Protocols, and Services Management PSP Personnel Security Program PWS Performance Work Statement QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RMF Risk Management Framework ROM Rough Order of Magnitude SAAR System Authorization Access Request SER Service Event Report SFTPS Secure File Transfer Protocols SP Special Publication SPRS Supplier Performance Risk System SQL Structured Query Language SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides T&E Testing & Evaluation TPN Total Parenteral Nutrition UPS Uninterruptible Power Supply UC Unified Capabilities US United States VPN Virtual Private Network

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.2 Facilities: The Government:

Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.3 Utilities: The Government:

Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.4 Equipment: The Government:

Will provide Equipment in support of this contract/task order. The government provided equipment is described below:

Five government laptop computers

3.4.1 Procurement Integrated Enterprise (PIEE), GFP Module Application The Contractor shall be responsible for obtaining and maintaining access, training, and successful operation of the PIEE/GFP Module application for the entirety of the contract/task order PoP. The PIEE GFP Module application is located at the following website:

https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the contractor’s responsibilities regarding GFP can be found at the following website: https://dodprocurementtoolbox.com/.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The CO and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded through DHA, in accordance with applicable FAR Part 45 (https://www.acquisition.gov/far/part- 45), DFARS 245 with respective clauses (https://www.acquisition.gov/dfars/part-245-government-property), DHA-Administrative Instruction (AI) 095 (https://www.health.mil/Reference-Center/DHA-Publications/2018/05/24/DHA-AI-095) and PD

November 16, 2021

45-01 (Attachment 8) following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the Contracting Office and requested within the PIEE/GFP Module system.

Contractor Responsibilities:

A key contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete, and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

The contractor shall report semi-annually 100% inventories, reconciliations, and final disposition of GFP provided by the government. Final invoices will not be paid pending GFP reconciliation.

Contractors shall be aware of and ensure compliance with applicable FAR Part 45 (https://www.acquisition.gov/far/part-45), DFARS 245 (https://www.acquisition.gov/dfarspgi/pgi-part-245-government-property) and 252.245 (https://www.acq.osd.mil/dpap/dars/dfars/html/current/252245.htm), Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA-AI 094 (https://health.mil/Reference-Center/DHA-Publications/2018/06/19/DHA-AI-94) and DHA Guidance.

3.5 Materials: The Government:

Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

November 16, 2021

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

4.2 General: The contractor shall furnish all supplies, equipment, facilities, and services required to perform work listed under Section 5 of this PWS.

4.3 Secret Facility Clearance: RESERVED

4.4 Materials: The contractor shall furnish materials, supplies, and equipment necessary to meet the requirements under this PWS

4.5 Equipment: The Contractor shall provide all equipment necessary to meet the requirements under this PWS.

4.6 Facilities: The Contractor shall furnish all facilitates necessary to meet the requirements under this PWS.

PART 5

5.0 SPECIFIC TASKS

5.1 Basic Services: The Contractor shall comply with and meet the specific PIAS-E requirements defined in this Section for the MHS.

5.2 Functional Requirements

5.2.1 The solution shall store and dispense controlled and non-controlled medications and products in various packaging forms, sizes, and types, including but not limited to:

Ampules Bags (e.g., intravenous (IV) bags, Total Parenteral Nutrition (TPN) bags, IV piggyback, Ready-To-Use IV bags, premixed IV bags) Bottled medications (e.g., oral liquids, spray, canister, droppers) Boxes (e.g., dose packs, inhalers, cream, ointment) Refrigerated medications Syringes up to 60ml (e.g., oral syringes, intravenous (IV) syringe) Unit dose packaged medications (e.g., blister packs, liquid cups) Re-packaged medications Vials (e.g., single-dose, multi-dose) Patient-specific medications

5.2.2 The solution shall support different equipment in clinical settings, including but not limited to clinics, inpatient wards, pharmacies, sterile environments (e.g., operating rooms), deployed military environments, or other ambulatory service areas.

5.2.3 The solution shall provide adjustable configurations to support local sites’ dynamic capacity needs (i.e., minimum storage capacity per equipment in clinical settings of 120 medications and configurable up to 300+ medications).

5.2.4 The solution shall provide adjustable configurations allowing local sites to share common stocks on separate devices (e.g., floor stock from Ward 3A can be used (dispensed) by users from Ward 3B).

5.2.5 The solution shall display and utilize a clinical setting-specific patient list and a global patient list for medication administration.

5.2.6 The solution shall alert the clinical setting user whenever a product is not available (e.g., temporarily out of stock) and direct the user to nearby equipment in clinical settings with available stock.

5.2.7 The solution shall allow physical access to the medications, via manual lock and key, during power failure and device outages.

November 16, 2021

5.2.8 The equipment in clinical settings shall allow up to six auxiliary devices to connect with the main unit.

5.2.9 The solution shall allow for the electronic issuance and receipt of controlled medications between different equipment located in separate equipment in clinical settings (e.g., equipment located on Ward 3A can issue and receive controlled substances to and from any equipment located at the local site)

5.2.10 The solution shall be capable of transaction continuity by allowing users to start transactions on equipment in one clinical setting and allow completion of that transaction on equipment in a different clinical setting (e.g., start transaction on equipment located in Ward 3A and complete transaction on equipment located in Ward 3B).

5.2.11 The solution shall be configurable by local sites to log users out of the system automatically (e.g., the session times out after three minutes of inactivity).

5.2.12 The solution shall provide roles-based access to administer the ability for local users to manage temporary accounts (e.g., username/password).

5.2.13 The solution shall provide roles-based access to administer the ability to prompt users, per medication, verification of the inventory during transactions (e.g., loading, refilling, dispensing).

5.2.14 The solution shall provide roles-based access to administer the ability suspension of user credentials due to system access inactivity (e.g., user has not logged-in within the 30 days).

5.2.15 The solution shall allow authorized users to perform system activity functions remotely and locally (e.g., reset drawers on equipment, restart a server).

5.2.16 The solution shall support the importing of external configuration data (e.g., drug files, user database, formulary data, equipment in clinical settings) from an external source file (e.g., database, spreadsheet, text file).

5.2.16.1 The solution shall support the initial and ongoing import and utilization of external source files.

5.2.17 The solution shall provide roles-based access to administer, per medication, the requirement of verification via second authorized user during transactions.

5.2.18 The solution shall provide roles-based access to administer, per user role, the requirement of verification via a second authorized user during transactions (e.g., system administrator assigning to nurse access to controlled medications)

5.2.19 The solution shall provide roles-based access to administer requirement of a review of all medication orders by a pharmacist prior to dispensing (e.g., medication profiling from pharmacy information system).

5.2.20 The solution shall utilize industry 1D and 2D barcode standards for transactions.

5.2.21 The solution shall provide roles-based access to administer the guardrails for the dispensing of medications due to predetermined conditions (e.g., expired medication, incorrectly stocked, user access level).

5.2.22 The solution shall allow authorized users to monitor and perform administrative functionalities. For example:

Managing of medications within clinical settings (e.g., assign medication, modify par level, modify inventory)

Resetting/restarting of equipment in clinical settings Managing database (e.g., users, formulary, drug files)

5.2.23 The solution shall accurately increment and decrement the equipment inventory during user transactions (e.g., dispensing, returning, wasting, refilling).

5.2.24 The solution shall provide unique qualifiers (e.g., high alert, locally controlled, sound-a-like/ look-a-like, Tallman lettering, override medications) within drug properties configurable by roles bases access

5.2.25 The solution shall provide roles-based access to assign program office managed medication label templates on a per medication basis (e.g., IVs, cream/ointment, eye drops, syringes, unit dose, outpatient prescriptions).

5.2.25.1 The solution shall provide roles-based access to design and distribute medication label templates.

5.2.26 The solution shall automatically document transactions including details [(e.g., date, time, drug, patient, dose, quantity, username, witness information (when applicable), user identifications (IDs)].

5.2.27 The solution shall aggregate and display the operational status of locally deployed network connected equipment in clinical settings equipment for local site administrators via dashboard.

5.2.28 The solution shall present a list of medications due for administration for a selected patient.

5.2.29 The solution shall provide roles-based access to administer the ability to withhold medications that are not due for administration based on site-defined time frame.

5.2.30 The solution shall serially dispense medications when multiple medications are selected for removal (e.g., allow users to withdraw one medication at a time).

November 16, 2021

5.2.31 The solution shall allow authorized users to filter the medication pick list.

5.2.31.1 The solution shall cross-reference when performing medication searches within the system (i.e., user search using brand name, while the solution displays the generic name for reference).

5.2.31.2 The solution shall provide roles-based access to administer the setting defining the configurable minimum number of characters necessary to activate the search functionality.

5.2.32 The solution shall provide roles-based access to administer the ability to allow the return of unused and sealed controlled medication(s) to a secured integrated bin.

5.2.33 The solution shall allow users to suspend inventory transactions or cancel all other in-progress transactions.

5.2.34 The solution shall provide roles-based access to administer the definition and assignment of local user roles and access to the equipment in clinical settings.

5.2.35 The solution shall display two patient identifiers, one of which is the patient name.

5.2.35.1 The solution shall provide roles-based access to define the unique patient identifier (e.g., DOD Identification number) displayed on the equipment.

5.2.36 The solution shall secure medical refrigerators.

5.2.37 When equipped, the solution shall provide roles-based access to monitor and document the temperature of medical refrigerators.

5.2.37.1 The solution shall provide alerts upon reaching the outer bounds of the local site’s configurable ranges.

5.2.37.2 When equipped, the solution shall provide roles-based access to define audible and visual alerts when the temperature of refrigerator exceeds the parameters of the local site-defined temperature ranges.

5.2.38 The solution shall archive and unarchive data.

5.2.38.1 The solution shall ingest and utilize archived data.

5.2.39 The solution shall provide and maintain integrated Uninterruptible Power Supply (UPS) for deployed Anesthesia clinical equipment with a minimum capacity allowing for the proper shutdown of the equipment.

5.2.40 The solution shall have a minimum underlying Operating System (OS) of Microsoft® Windows™ 11 and Windows™ Server 2019 or as approved by the DHA Cybersecurity Division

November 16, 2021

(CSD) in the current and amended RMF (Risk Management Framework) ATO (Authority-to- Operate) configurations.

5.2.41 The solution shall provide an Enterprise Management Server (EMS) supporting sites with capabilities (e.g., patch management, security monitoring, and reporting functions).

5.2.42 Customer Portal:

5.2.42.1 The solution shall provide authorized users role-based access to an interactive web-based customer portal with graphical representation and drill-down charts capable of supporting both continental United States (CONUS) and OCONUS sites.

5.2.43 Reporting and Data Analysis Tool Requirements:

5.2.43.1 The solution shall provide roles-based access to administer the connection to a network printer (e.g., inkjet, laser, thermal) for printing reports (e.g., user report, inventory, system reports).

5.2.43.2 The solution shall generate and print reports.

5.2.43.3 The solution shall maintain logs (e.g., activity logs, issue logs, technical logs).

5.2.43.3.1 The solution shall utilize log data to generate reports.

5.2.43.4 The solution shall provide roles-based access the ability to schedule the generation of pre-determined and ADHOC reports.

5.2.43.4.1 The pre-determined reports shall include:

5.2.43.4.1.1 User activity reports (e.g., load, refill, unload, remove, return, waste, override, log-in attempts)

5.2.43.4.1.2 Inventory reports (e.g., load list, refill list, expired list, inventory list)

5.2.43.4.1.3 System reports (e.g., user database, formulary, data dictionary, data schema, maintenance report, failed drawer/pocket, system status)

5.2.43.5 The solution shall export reports into multiple file formats (e.g., spreadsheet, database, text file).

5.2.43.6 The solution shall provide descriptive statistical analysis reports (e.g., average usage, frequency distribution, and standard deviations).

5.2.43.7 The solution shall centrally collate data into a single enterprise database, and to create visual representation of descriptive statistical analysis reports (e.g., histograms, bar charts, and frequency tables).

5.2.43.8 The solution shall generate reports in real-time without negatively affecting system performance.

5.2.44 Backup and Recovery Requirements:

5.2.44.1 The solution shall maintain transaction data upon loss of network connectivity.

5.2.44.2 The solution shall automatically reconcile transaction data upon reestablishment of network connectivity.

5.2.44.3 The solution shall utilize the DHA MAAG to back-up and restore transaction data based on Government defined timeframe (e.g., 30 days, 45 days, or 60 days).

5.2.44.4 The solution shall rebuild damaged/lost files during data recovery processes using database back-up data.

5.2.44.5 The solution shall provide roles-based access to administer the parameters for incremental database back-up.

5.2.44.6 The solution shall leverage the DHA MAAG to store, archive, and readily retrieve historical data for a minimum of five years.

5.3 Licensing: The Contractor shall provide upgradeable perpetual licenses as Contractor Acquired Property (CAP). All licenses required for the operations and sustainment of the PIAS-E are CAP. Perpetual licenses shall be upgraded at no additional cost to the government. When subscription-based licensing is required, the Contractor shall acquire the licensing as CAP.

Hardware shall be upgraded to accommodate licensing requirements at no additional cost to the government.

5.3.1 The Contractor shall upgrade licenses when commercial offerings are available.

5.3.2 The Contractor shall acquire licenses to maintain the cybersecurity posture of the solution.

5.4 Maintenance and Support Requirements:

5.4.1 The Contractor shall provide diagnostic and repair services, as well as preventative maintenance via on-site or remote support (e.g., telephone, Business-to-Business (B2B) Gateway, email).

5.4.2 The Contractor shall perform root cause analysis for issues and repairs involving hardware, software, or procedural problems that result in substantial operational difficulty, and prevents a system from dispensing medications and system downtime to include remote connectivity.

5.4.3 The Contractor shall document a Service Event Report (SER) with the following information about each service event:

Name of Contractor Contract Number Name of Field Service Technician performing service Contractor log/Control # (i.e., Work Order #) Date, time (beginning and ending), and hours on-site for service call Description of problem reported by user Equipment identification factors to include: original and replacement o Equipment o Manufacturer o Model o Serial number o Local Equipment Control Number (ECN)

Description of problem identified by the Contractor Description of services and tests performed, parts used, corrective action taken Problem resolution or pending actions Field Service Technician signature Authorized local site personnel signature

5.4.3.1 The Contractor shall provide SERs to authorized local site personnel upon completion of each service event.

5.4.4 The Contractor shall physically check-in and check-out with the authorized local site personnel prior to performing services.

5.4.5 The Contractor shall maintain a Hot Swappable List (HSL) (Attachment 1, CDRL A006) of furnished/forward staged replacement parts required for all repairs performed by Contractor trained authorized local site personnel.

5.4.6 The Contractor shall allow authorized local site personnel to create and manage service events by customer service requests via a web-based customer portal or telephone.

5.4.7 The Contractor shall support the relocation of equipment within the local site in the same building at no cost to the government.

5.4.8 Relocating Equipment

5.4.8.1 When the Government provides 30-days advance notice, the Contractor shall relocate and reconfigure clinical equipment from one facility to another facility within 100-miles.

5.4.8.2 When the Government provides 45-days advanced notice, the Contractor shall relocate and reconfigure clinical equipment from one facility to another facility outside 100-miles.

5.4.8.3 The Government shall request a proposal describing the Rough Order of Magnitude (ROM) and associated costs commiserate of the anticipated Level of Effort (LOE).

5.4.9 Interface Requirements: The PIAS-E shall support interface connections to external systems. The PIAS-E Contractor shall collaborate to update the Interface Control Document (ICD) (Attachment 1, CDRL A007) for each PIAS-E connection.

5.4.9.1 Composite Health Care System (CHCS) / PIAS-E Interface: The Composite Health Care System (CHCS) is a medical/pharmacy information system that automates and integrates clinical and demographic data and facilitates access to and delivery of health care services from a military medical treatment facility, dental treatment facility, or pharmacy.

5.4.9.1.1 The PIAS-E Contractor shall implement, maintain, and update an interface between PIAS-E and each CHCS host.

5.4.9.2 Military Health System (MHS) GENESIS /PIAS-E Interface: The Military Health System GENESIS (MHS GENESIS) Electronic Health Record (EHR) is a commercial off-the-shelf system that consists of an inpatient, outpatient, and dental solution currently being designed to be deployed across the Department of Defense (DOD) enterprise. The MHS GENESIS EHR will replace functionality of core legacy systems (i.e., AHLTA, CHCS, and Essentris, among others), and will be deployed to both fixed medical treatment facilities and operational medicine facilities all over the world. The MHS GENESIS EHR will communicate via existing DOD IT Networks as well as DHA infrastructure to support the solution. The Medical Community of Interest (Med- COI) network provides this infrastructure backbone and supports the legacy EHR capability as well as the new MHS GENESIS EHR. In addition to network infrastructure, the MHS GENESIS EHR solution will have a hosting infrastructure in which to deploy the solution, store data generated by the system, and provide any server-side application processing.

5.4.9.2.1 The PIAS-E Contractor shall implement, maintain, and update an interface between the PIAS–E and MHS GENESIS systems.

5.4.9.2.2 The Contractor shall implement and upgrade the PIAS-E/MHS GENESIS interface to add bi-directional communications, display additional data elements within the solution, as well as support for the associated testing and evaluation (T&E) events.

5.4.9.3 The vendor may interface with other pharmacy and supply solutions. When required, the Contractor may separately price new interface requirements.

5.5 Training Requirements:

5.5.1 The Contractor shall develop a training plan (Attachment 1, CDRL A008) to specify training approaches, methods, schedules, tools, and curricula.

5.5.2 The Contractor shall plan, schedule, and conduct formal training for all levels of users (e.g., system administrators, pharmacy, and nursing).

5.5.3 The Contractor shall train authorized OCONUS site personnel to perform maintenance and repair services, including but not limited to the following:

November 16, 2021

Drawer recoveries Light bulb replacement Button bar replacement Drawer solenoid replacement Biometrics Identification (Bio-ID) reset/replacement Shelf reconfigurations Keyboard replacement CPU fan replacement Ribbon cable replacement

5.5.4 The Contractor shall develop mutually agreed upon training materials (Attachment 1, CDRL A008), (e.g., course objectives, teacher guides, student guides, course materials, training manuals, distance learning tools, and computer-based tools).

5.5.5 The Contractor shall make available to local site users training and implementation materials to include user guides with answers to frequently asked questions (FAQs) via public-facing and/or internal DoD hosted websites.

5.5.6 The Contractor shall plan, schedule, and conduct mutually agreed upon Ongoing Remote Training (Attachment 1, CDRL A008) via the DoD communication tools (e.g., Microsoft® Teams).

5.5.7 The Contractor shall document lessons learned in the Monthly Status Report (MSR) (Attachment 1, CDRL A009) and modify the training plan (Attachment 1, CDRL A008) when appropriate.

5.6 Test Environment Requirements:

5.6.1 The Contractor shall establish and maintain a test environment that is indicative of the deployed solution in support of Cybersecurity including but not limited to, network vulnerability scanning, security patch deployment, and software testing.

5.6.2 The Contractor shall establish and maintain a test environment within the MAAG supporting connectivity with MHS test/certification environments to include Contractor support of testing events as required.

5.7 Program Support Requirements:

5.7.1 Monthly Status Report:

5.7.1.1 The Contractor shall prepare and deliver an MSR (Attachment 1, CDRL A009), in accordance with a mutually agreed upon format between the Government and the Contractor.

The MSR should outline deliverables submitted with problems encountered, and schedule deviations to include but not limited to helpdesk support logs, monthly system availability report, SER (PWS Section 5.4.3), lessons learned from training (Attachment 1, CDRL A009), root cause analysis…