22X-RaySCOPE_OF_WORK.docx

SCOPE OF WORK

3.1Background and Purpose

The Western Maryland Hospital Center, a unit of Maryland Department of Health, is a three-floor chronic care hospital, licensed and accredited, for the treatment of the chronically ill. Most of our patients are non-ambulatory, and cannot easily be transported to outside medical facilities for needed diagnostic imaging and vascular access services. It has been determined to be both better for the patient and less expensive to have required services provided on-site. The State is issuing this solicitation for the purposes of providing professional on-site bedside mobile imaging and vascular access services, diagnostic readings and interpretations of said images to the patients/residents of Western Maryland Hospital Center, located at 1500 Pennsylvania Avenue, Hagerstown, MD 21742. This is a one year contract.

3.2 Scope of Work - Requirements

3.2.1 General Requirements

3.2.1.1 The Contractor shall provide all the necessary current licensed and certified personnel, equipment, and supplies required to deliver on-site bedside mobile imaging(s), including x-ray, ultra sound, echo cardiograms and vascular access services as well as medical diagnostic interpretations of said imaging as directed by WMHC Physicians.

3.2.1.1.1 The Contractor shall provide a Maryland licensed Radiologist who has been certified by the American Board of Radiology. The Contractor shall provide proof of certification and experience.

3.2.1.1.2 The Contractor shall also provide a Maryland certified Radiological Technologist who has been certified by the American Registry of Radiologic Technologists, to perform the task of taking the required images, with a minimum of three (3) years’ experience taking said images with a mobile machine. The Contractor shall provide proof of certification and experience.

3.2.1.1.3 – The Contractor shall also provide Maryland license practitioners with proof of competence and experience in the vascular access devices.

3.2.2 Staffing Requirements

3.2.2. 1 Employees of the Contractor shall remain licensed and/or certified throughout the term of the Contract. The Contractor shall provide the names, position, descriptions and credentials (education, licensure status, competency, and acceptable findings in the National Practitioners Data Bank Inquiry) of each person employed or used by the Contractor in the provision of services under this Contract at least 3 Business Days prior to that person’s performing any services under this Contract.

3.2.2.2 The Contractor’s Certified Radiological Technologist shall administer the Physician required imaging, and the Contractor’s Board Certified Radiologist Physician shall interpret, consult, and write the written reports required by WMHC Physicians.

3.2.2.3 The Contractor shall provide proof to the Contract Monitor that each Contractor personnel performing onsite services at the Western Maryland Hospital under this Contract has current, up-to-date immunizations to include Influenza (seasonal), comply with IC Screening per current facility policy and pneumonia and infection control screenings (annual report), to include, but not limited to an annual tuberculosis screening by at least 3 Business Days before he or she begins provision of services under this Contract.

3.2.2.5 The Contractor shall respond with a written remediation plan within three (3) Business Days and implement the plan immediately upon written acceptance by the Contract Monitor. If performance issues persist, the Contract Monitor will request the immediate removal of the person(s) whose performance is at issue and the Contractor will send another person(s) after prior approval of Contract Monitor.

3.2.3 Schedule Requirements for Services/Reports

3.2.3.1 The Contractor shall schedule "as needed per Physicians orders" imaging services at a scheduled time, Monday through Friday, 8:00 a.m. to 5:00 p.m. and provide imaging results within 24 hours. The Contractor must respond to emergency requests from the Physician within two (2) hours and provide results within two (2) hours after the emergency imaging services and vascular access device services are taken.

3.2.3.2 The Contractor's Radiologist shall telephone verbal reports to WMHC's Physician on duty or nurse supervisor on duty @ 301-992-7543 and shall fax 301-745-4198 complete written report within 24 hours after taking the images. The Radiologist shall be required to telephone the Physician referenced on the orders as soon as possible in the event of a serious-abnormal reading. The Radiologist shall telephone with critical results per WMHC's policy, which will be supplied to the Contractor before the Go-Live date.

3.2.3.3 The Contractor shall provide all imaging reports in typewritten or computerized format. The Contractor shall provide a typed name and an electronic signature on all imaging reports.

3.2.3.4 The Contractor shall have a website available so physicians can view imaging online. The Contractor shall make available any previous imaging required for comparison when previous imagines have been taken. The Contractor shall make imaging available on disk or other media upon request from WMHC's attending Physician.

3.2.3.5 All imaging disks and reports after development and reading under the terms of this Contract shall be the property of the State of Maryland and considered a part of the patient's health care records, and will be maintained at WMHC.

3.2.3.6 Contractor shall ensure that all images are readable (i.e., clear, not fuzzy or distorted) by the radiologist prior to leaving the facility. If the Radiologist requires additional images to complete the reading, the Contractor shall take the additional images at that time and at no charge to WMHC.

3.2.3.7 Contractor shall provide documentation of the vascular access device inserted and the availability for use of the access device.

3.2.4 Quality Assurance and Performance Improvement

3.2.4.1 It is necessary for the contractor to have and provide a Quality Assurance (QA) plan to the contract monitor within 10 business days of the go-live date. This plan must address how quality assurance and performance improvement is continuously monitored and maintained in relation to national standards, laws and regulations, as well as standards established in accordance with the contractors licensure and certifications.

3.2.4.2 The contractor shall have a peer review program in effect in accordance with the standards required by the American Board of Radiology, to assure good care to the residents and patients, as well as, good quality control. The contractor shall provide the contract monitor with the most recent peer reviews for all radiologists that will be associated with the facility throughout the duration of this contract, in a written format.

3.2.4.3 If a negative peer review or quality assurance issue arises, the contractor shall provide, in written format, the contract monitor with a plan of correction within 10 business days. The contractor shall continuously provide an updated copy of peer reviews and their quality assurance plan to the contract monitor for the duration of this contract.

3.2.5 Education Requirements

3.2.5.1 The Contractor shall provide verification of competence annually and credentialing of Radiologist and Radiologic Technologists and licensed practitioners for vascular device insertion within three (3) Business Days prior to the expiration of the certification.

3.2.6 Requisition

3.2.6.1 Requisitions will be completed by WMHC staff, called into the Contractor, and physically left at the requesting WMHC unit.

3.3 Security Requirements

3.3.1 Employee Identification

(a) Each person who is an employee or agent of the Contractor or subcontractor shall display his or her company ID badge at all times while on State premises. Upon request of authorized State personnel, each such employee or agent shall provide additional photo identification.

(b) At all times at any facility, the Contractor’s personnel shall cooperate with State site requirements that include but are not limited to being prepared to be escorted at all times, providing information for badge issuance, and wearing the badge in a visible location at all times.

3.3.2 Criminal Background Check

The Contractor shall obtain from each prospective employee a signed statement permitting a criminal background check. The Contractor shall secure at its own expense a Maryland State Police and/or FBI background check and shall provide the Contract Monitor with completed checks on all new employees prior to assignment. The Contractor may not assign an employee with a criminal record to work under this Contract unless prior written approval is obtained from the Contract Monitor.

3.3.3 Information Technology

For purposes of this solicitation and the resulting Contract:

(a) "Sensitive Data” means information that is protected against unwarranted disclosure, to include Personally Identifiable Information (PII), Protected Health Information (PHI) or other private/confidential data, as specifically determined by the State. Sensitive Data includes information about an individual that (1) can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; (2) is linked or linkable to an individual, such as medical, educational, financial, and employment information; (3) falls within the definition of “personal information” under Md. Code Ann., State Govt. § 14-3501(d); or (4) falls within the definition of “personal information" under Md. Code Ann., St. Fin. & Proc. § 10-1301(c).

(b) “Relevant subcontractor” includes any subcontractor that assists the Contractor in the critical functions of the Contract, handles Sensitive Data, and/or assists with any related implemented system, excluding subcontractors that provide secondary services that are not pertinent to assisting the Contractor in the critical functions of the Contract, handling Sensitive Data, and/or assisting with any related implemented system.

(c) The Contractor, including any relevant subcontractor(s), shall implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry standards for information security such as those listed below, and shall ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of this solicitation and resulting Contract.

(d) The Contractor, including any and all subcontractor(s), agrees to abide by all applicable federal, State and local laws concerning information security and comply with current State of Maryland Department of Information Technology Security Policy: http://doit.maryland.gov/support/Pages/SecurityPolicies.aspx. The State IT Security Policy may be revised from time to time. The Contractor and all subcontractors shall comply with all such revisions. Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

3.3.3.1 Information Security Requirements

To ensure appropriate data protection safeguards are in place, the Contractor and any relevant subcontractor(s) shall at a minimum implement and maintain the following information technology controls at all times throughout the life of the Contract. The Contractor and any relevant subcontractor(s) may augment this list with additional information technology controls.

(a) Establish separate production, test, and training environments for systems supporting the services provided under this Contract and ensure that production data is not replicated in the test and/or training environment unless it has been previously anonymized or otherwise modified to protect the confidentiality of Sensitive Data elements.

(b) Apply hardware and software hardening procedures as recommended by the manufacturer to reduce the Contractor/subcontractor’s systems’ surface of vulnerability. The purpose of system hardening procedures is to eliminate as many security risks as possible. These procedures may include but are not limited to removal of unnecessary software, disabling or removing of unnecessary services, the removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor/subcontractor’s system configuration files.

(c) Establish policies and procedures to implement and maintain mechanisms for regular internal vulnerability testing of operating system, application, and network devices supporting the services provided under this Contract. Such testing is intended to identify outdated software versions; missing software patches; device or software misconfigurations; and to validate compliance with or deviations from the Contractor’s and/or subcontractor’s security policy. The Contractor and any relevant subcontractor(s) shall evaluate all identified vulnerabilities for potential adverse effect on the system’s security and/or integrity and remediate the vulnerability promptly or document why remediation action is unnecessary or unsuitable. The Department shall have the right to inspect these policies and procedures and the performance of vulnerability testing to confirm the effectiveness of these measures for the services being provided under this Contract.

(d) Where website hosting or Internet access is the service provided or part of the service provided, the Contractor and any relevant subcontractor(s) shall conduct regular external vulnerability testing. External vulnerability testing is an assessment designed to examine the Contractor’s and subcontractor’s security profile from the Internet without benefit of access to internal systems and networks behind the external security perimeter. The Contractor and any relevant subcontractor(s) shall evaluate all identified vulnerabilities on Internet-facing devices for potential adverse effect on the system’s security and/or integrity and remediate the vulnerability promptly or document why remediation action is unnecessary or unsuitable. The Department shall have the right to inspect these policies and procedures and the performance of vulnerability testing to confirm the effectiveness of these measures for the services being provided under this Contract.

(e) Ensure that anti-virus and anti-malware software is installed and maintained on all systems supporting the services provided under this Contract; that the anti-virus and anti-malware software is automatically updated; and that the software is configured to actively scan and detect threats to the system for remediation.

(f) Enforce strong user authentication and password control measures over the Contractor/subcontractor’s systems supporting the services provided under this Contract to minimize the opportunity for unauthorized system access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current State of Maryland Department of Information Technology’s Information Security Policy (http://doit.maryland.gov/support/Pages/SecurityPolicies.aspx), including specific requirements for password length, complexity, history, and account lockout.

(g) Ensure State data under this service is not processed, transferred, or stored outside of the United States.

(h) Ensure that State data is not comingled with the Contractor’s and subcontractor’s other clients’ data through the proper application of data compartmentalization security measures. This includes but is not limited to classifying data elements and controlling access to those elements based on the classification and the user’s access or security level.

(i) Apply data encryption to protect State data, especially Sensitive Data, from improper disclosure or alteration. Data encryption should be applied to State data in transit over networks and, where possible, State data at rest within the system, as well as to State data when archived for backup purposes. Encryption algorithms which are utilized for this purpose must comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-2.

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

(j) Enable appropriate logging parameters on systems supporting services provided under this Contract to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers as well as information security standards including the current State of Maryland Department of Information Security Policy: http://doit.maryland.gov/support/Pages/SecurityPolicies.aspx

(k) Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and perform remediation, if required. The Department shall have the right to inspect these policies and procedures and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under this Contract.

(l) Ensure system and network environments are separated by properly configured and updated firewalls to preserve the protection and isolation of Sensitive Data from unauthorized access as well as the separation of production and non-production environments.

(m) Restrict network connections between trusted and untrusted networks by physically and/or logically isolating systems supporting the services being provided under the Contract from unsolicited and unauthenticated network traffic.

(n) Review at regular intervals the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

(o) Ensure that the Contractor’s and any subcontractor’s personnel shall not connect any of their own equipment to a State LAN/WAN without prior written approval by the State. The Contractor/subcontractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor/subcontractor-owned equipment to a State LAN/WAN.

3.3.3.2 Contingency / Disaster Recovery Plans

(a) The Contractor and any relevant subcontractor(s) shall have robust contingency and disaster recovery plans in place to ensure that the services provided under this Contract will be maintained in the event of disruption to the Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

(b) The contingency and disaster recovery plans must be designed to ensure that services under this Contract are restored after a disruption within 24 hours in order to avoid unacceptable consequences due to the unavailability of services.

(c) The Contractor and any relevant subcontractor(s) shall test the contingency/disaster recovery plans at least twice annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service. Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one annual test shall include backup media restoration and failover / fallback operations.

(d) Such contingency and disaster recovery plans shall be available for the Department to inspect and to practically test at any reasonable time, and shall be subject to regular updating, revision, and testing throughout the term of the Contract.

3.3.3.3 Incident Response Requirement

(a) The Contractor shall notify the Contract Monitor when any Contractor and/or subcontractor system that may access, process, or store State data or work product is subject to unintended access or attack. Unintended access or attack includes compromise by computer malware, malicious search engine, credential compromise or access by an individual or automated program due to a failure to secure a system or adhere to established security procedures.

(b) The Contractor shall notify the Contract Monitor within one (1) Business Day of the discovery of the unintended access or attack by providing notice via written or electronic correspondence to the Contract Monitor and Procurement Officer.

(c) The Contractor shall notify the Contract Monitor within two (2) hours if there is a threat to the Contractor and/or subcontractor's systems as it pertains to the use, disclosure, and security of the Department’s Sensitive Data.

(d) If an unauthorized use or disclosure of any Sensitive Data occurs, the Contractor must provide written notice to the Contract Monitor within one (1) Business Day after the Contractor's discovery of such use or disclosure and, thereafter, all information the State requests concerning such unauthorized use or disclosure.

(e) The Contractor, within one (1) Business Day of discovery, shall report to the Contract Monitor any improper or non-authorized use or disclosure of Sensitive Data. The Contractor's report shall identify:

1. the nature of the unauthorized use or disclosure;

2. the Sensitive Data used or disclosed;

3. who made the unauthorized use or received the unauthorized disclosure;

4. what the Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and:

5. what corrective action the Contractor has taken or shall take to prevent future similar unauthorized use or disclosure.

6. the Contractor shall provide such other information, including a written report, as reasonably requested by the State.

(f) The Contractor shall comply with all applicable laws that require the notification of individuals in the event of unauthorized release of PII or other event requiring notification. In the event of a breach of any of the Contractor's security obligations or other event requiring notification under applicable law, the Contractor agrees to assume responsibility for informing all such individuals in accordance with applicable law and to indemnify, hold harmless and defend the State and its officials and employees from and against any claims, damages, or other harm related to such security obligation breach or other event requiring the notification.

(g) This Section 3.3.3.3 shall survive expiration or termination of the Contract.

3.4 Insurance Requirements

3.4.1 The Contractor shall maintain Commercial General Liability Insurance to cover losses resulting from, or arising out of, Contractor action or inaction in the performance of the Contract by the Contractor, its agents, servants, employees, or subcontractors, with a limit of $1,000,000 per occurrence and $2,000,000 aggregate.

3.4.2 The Contractor shall maintain Errors and Omissions/Professional Liability insurance with a minimum limit of $5,000,000 per claim and annual aggregate (Professional Liability is typically written on a claims-made form, not on an occurrence form, Consider having cyber liability included in the professional liability if the vendor will have access to Personal Identifiable Information in any medium).

3.4.3 The Contractor shall maintain Automobile and/or Commercial Truck Insurance as appropriate with Liability, Collision, and PIP limits no less than those required by the State where the vehicle(s) is registered, but in no case less than those required by the State of Maryland.

3.4.4 The Contractor shall maintain Crime Insurance to endorsed to cover third party fidelity and with State and Department as loss payees cover employee theft with minimum single loss limit of $1,000,000 per loss, and a single loss retention not to exceed $10,000.

3.4.5 Within five (5) Business Days of recommendation for Contract award, and before any work begins, the Contractor shall provide the Procurement Officer with current certificates of insurance, and shall update such certificates periodically, but no less than annually in multi-year contracts, as directed by the Contract Monitor. Such copy of the Contractor’s current certificate of insurance shall contain at minimum the following:

a. Workers’ Compensation – The Contractor shall maintain such insurance as necessary and/or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’ Compensation Act, and the Federal Employers’ Liability Act.

b. Commercial General Liability as required in Section 3.4.1.

c. Errors and Omissions/Professional Liability as required in Section 3.4.2.

d. Automobile and/or Commercial Truck Insurance as required in Section 3.4.3.

e. Crime Insurance as required in Section 3.4.4.

3.4.6 The “State of Maryland, its officers, employees and agents” shall be listed as an additional insured on any Commercial General Liability, Auto Liability, Professional/Cyber Liability, and excess liability or umbrella policies with the exception of Worker’s Compensation Insurance, which is currently handled by the Chesapeake Employer’s Insurance Company (formerly Injured Worker’s Insurance Fund). All insurance policies shall be endorsed to include a clause that requires that the insurance carrier provide the Contract Monitor, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration. In the event the Contract Monitor receives a notice of non-renewal, the Contractor shall provide the Contract Monitor with an insurance policy from another carrier at least 15 days prior to the expiration of the insurance policy then in effect. All insurance policies shall be with a company licensed by the State to do business and to provide such policies.

3.4.7 The Contractor shall require that any subcontractors providing primary services (as opposed to non-critical, ancillary services) under this Contract obtain and maintain the same levels of insurance and shall provide the Contract Monitor with the same documentation as is required of the Contractor.

3.5 Problem Escalation Procedure

3.5.1 The Contractor must provide and maintain a Problem Escalation Procedure (PEP) for both routine and emergency situations. The PEP must state how the Contractor will address problem situations as they occur during the performance of the Contract, especially problems that are not resolved to the satisfaction of the State within appropriate timeframes.

The Contractor shall provide contact information to the Contract Monitor, as well as to other State personnel, as directed should the Contract Monitor not be available.

3.5.2 The Contractor must provide the PEP no later than ten (10) Business Days after Contract Commencement. The PEP, including any revisions thereto, must also be provided within ten (10) Business Days after the start of each Contract year and within ten (10) Business Days after any change in circumstance which changes the PEP. The PEP shall detail how problems with work under the Contract will be escalated in order to resolve any issues in a timely manner. The PEP shall include:

· The process for establishing the existence of a problem;

· Names, titles, and contact information for progressively higher levels of personnel in the Contractor’s organization who would become involved in resolving a problem;

· For each individual listed in the Contractor’s PEP, the maximum amount of time a problem will remain unresolved with that individual before the problem escalates to the next contact person listed in the Contractor’s PEP;

· Expedited escalation procedures and any circumstances that would trigger expedited escalation procedures;

· The method of providing feedback on resolution progress, including the frequency of feedback to be provided to the State;

· Contact information for persons responsible for resolving issues after normal business hours (e.g., evenings, weekends, holidays, etc.) and on an emergency basis; and

· A process for updating and notifying the Contract Monitor of any changes to the PEP.

Nothing in this section shall be construed to limit any rights of the Contract Monitor or the State which may be allowed by the Contract or applicable law.

3.6 Invoicing

3.6.1 General

(a) All invoices for services shall be signed by the Contractor and submitted to the Contract Monitor. All invoices shall include the following information:

· Contractor name and address;

· Remittance address;

· Federal taxpayer identification number (or if sole proprietorship, the individual’s social security number);

· Invoice period (i.e. time period during which services covered by invoice were performed);

· Invoice date;

· Invoice number;

· State assigned Contract number;

· State assigned (Blanket) Purchase Order number(s);

· Goods or services provided; type of image, # of images and region of body taken, and when interpretation was provided to WMHC. Amount due.

Invoices submitted without the required information cannot be processed for payment until the Contractor provides the required information.

(b) The Department reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide the Department with all required deliverables within the time frame specified in the Contract or in the event that the Contractor otherwise materially breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract. Also see the “Living Wage” provision of the Contract, if applicable, which allows for withholding of payment under certain circumstances. Any action on the part of the Department, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15-215 through 15-223 and with COMAR 21.10.02.

3.6.2 Invoice Submission Schedule

The Contractor shall submit invoices by the 15th of the month following the month in which services were performed.”

3.7 End of Contract Transition

The Contractor shall cooperate in the orderly transition of services from the Contract awarded under this solicitation to any subsequent contract for similar services. The transition period shall begin ninety (90) days before the Contract end date, or the end date of any final exercised option or contract extension. The Contractor shall work toward a prompt and timely transition, proceeding in accordance with the directions of the Contract Monitor. The Contract Monitor may provide the Contractor with additional instructions to meet specific transition requirements prior to the end of Contract.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK