36C10B20Q0525_1.2.docx

36C10B20Q0525

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

09-09--2020 Tinamarie Giraud, Contract Specialist 732-440-9641 09-15-2020

12 PM EST

Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

X

541519 $30 Million

N/A

See Delivery Schedule

Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

Technology Acquisition Center Financial Services Center PO Box 149971 Austin TX 78714-8971

See CONTINUATION Page Title: Radiation Oncology Peer Review Software Program

The Contract Specialist assigned to this Delivery Order is:

Tinamarie Giraud, Tinamarie.Giraud@va.gov, 732-440-9641.

The Contracting Officer assigned to this Delivery Order is:

Peter Lewandowski, Peter Lewandowski@va.gov, 732-440-9640.

See CONTINUATION Page

Peter Lewandowski Contracting Officer

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 GOVERNING LAW CLAUSE

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrink-wrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. § 3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ) in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by modification (Standard Form 30) and shall only be made by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.2 SOFTWARE LICENSE, MAINTENANCE AND TECHNICAL SUPPORT:

(1). Definitions.

a) Licensee. The term “licensee” shall mean the U.S. Department of Veterans Affairs (“VA”) and is synonymous with “Government.”

b) Licensor. The term “licensor” shall mean the Contractor having the necessary license or ownership rights to deliver license, software maintenance and support of the computer software being acquired. The term “Contractor” is the party identified in Block 17a on the SF1449. If the Contractor is a reseller and not the Licensor, the Contractor remains responsible for performance under this Contract/Order.

c) Software. The term “software” shall mean the licensed computer software product(s) cited in the Schedule of Supplies/Services.

d) Maintenance. The term “maintenance” is the process of enhancing and optimizing software, as well as remedying defects. It shall include all new fixes, patches, releases, updates, versions and upgrades, as further defined below.

e) Technical Support. The term “technical support” refers to the range of services providing assistance for the software via the telephone, email, a website or otherwise.

f) Release or Update. The term “release” or “update” are terms that refer to a revision of software that contains defect corrections, minor enhancements or improvements of the software’s functionality. This is usually designated by a change in the number to the right of the decimal point (e.g., from Version 5.3 to 5.4). An example of an update is the addition of new hardware.

g) Version or Upgrade. The term “version” or “upgrade” are terms that refer to a revision of software that contains new or improved functionality. This is usually designated by a change in the number to the left of the decimal point (e.g., from Version 5.4 to 6).

(2). Software License.

a) Unless otherwise stated in the Schedule of Supplies/Services, the Performance Work Statement or Product Description, the software license provided to the Government is a perpetual, nonexclusive license to use the software.

b) The Government may use the software in a networked environment.

c) Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR 52.212-4(d).

d) All limitations of software usage are expressly stated in the Schedule of Supplies/Services and the Performance Work Statement/Product Description.

(3). Software Maintenance and Technical Support.

a) If the Government desires to continue software maintenance and support beyond the period of performance identified in this Contract/Order, the Government will issue a separate contract or order for maintenance and support. Conversely, if a contract or order for continuing software maintenance and technical support is not received, the Contractor is neither authorized nor permitted to renew any of the previously furnished services.

b) The Contractor shall provide software support services, which includes periodic updates, enhancements and corrections to the software, and reasonable technical support, all of which are customarily provided by the Contractor to its commercial customers so as to cause the software to perform according to its specifications, documentation or demonstrated claims.

c) Any telephone support provided by Contractor shall be at no additional cost.

d) The Contractor shall provide all maintenance services in a timely manner in accordance with the Contractor’s customary practice or as defined in the Performance Work Statement or Product Description. However, prolonged delay (exceeding 2 business days) in resolving software problems will be noted in the Government’s various past performance records on the Contractor (e.g., www.cpars.gov).

e) If the Government allows the maintenance and support to lapse and subsequently wishes to reinstate it, any reinstatement fee charged shall not exceed the amounts that would have been charged if the Government had not allowed the subscription to lapse.

(4). Disabling Software Code. The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the Contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the Contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

(5). Manuals and Publications. Upon Government request, the Contractor shall furnish the most current version of the user manual and publications for all products/services provided under this Contract/Order at no cost.

Table of Contents

B.3 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: To be determined.

b. GOVERNMENT: Contracting Officer 36C10B

Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Department of Veterans Affairs Technology Acquisition Center Financial Services Center PO Box 149971 Austin TX 78714-8971

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.4 SCHEDULE OF SUPPLIES/SERVICES

NOTE: Vendors are instructed to complete Section B, Schedule of Supplies/Services to submit with their quote. Vendors are cautioned that alterations to the line items as specified below may render quotes unacceptable. All questions shall be directed to the Contract Specialist, (Tinamarie Giraud, Tinamarie.Giraud@va.gov, 732-440-9641) and Contracting Officer, (Peter Lewandowski, Peter.Lewandowski@va.gov, 732-440-9440), prior to the closing date and time specified on the Contracting Opportunities website.

Non-TAA compliant items may be quoted for this procurement as FAR 25.401 (applicable exemptions) applies.

Base Period Shall not exceed 12 months

In Accordance With (IAW) Product Description (PD) paragraph 1.0 and all applicable sub-paragraphs.

Delivery/Due: Shall be delivered No Later Than (NLT) 12 months after receipt of award.

· 30 days after award: Completed FedRAMP System Security Plan (SSP) and supporting documentation (10% of contract value billable upon receipt)

· 75 days after award: Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) (10% of contract value billable upon receipt)

· 90 days after award: 3PAO Security Assessment Report (SAR) (10% of contract value billable upon receipt)

The remaining 70% will be billable when all Authority to Operate (ATO) work is complete.

IAW PD section 1.1.1.

Delivery/Due: 10 days after contract award.

Electronic submission to: Project Manager (PM), Contracting Officer, Representative (COR), Contract Officer (CO) and Contract Specialist (CS).

IAW PD section 1.2.1.

Electronic submission to: VA PM, COR, CO and CS.

IAW PD section 1.2.1.

Electronic submission to: VA PM, COR, CO and CS..

IAW PD section 1.2.2.

Electronic submission to: VA PM, COR, CO and CS

IAW PD section 1.2.2.

Electronic submission to: VA PM, COR, CO and CS.

IAW PD section 1.2.2.

Electronic submission to: VA PM, COR, CO and CS

IAW PD section 1.2.3.

Electronic submission to: VA PM, COR, CO and CS.

IAW PD section 1.3.

Electronic submission to: VA PM, COR, CO and CS.

IAW PD section 1.3.

Electronic submission to: VA PM, COR, CO and CS.

IAW PD section 1.6.

Electronic submission to: VA PM, COR, CO and CS.

Option Period One This 12-month option period may be exercised IAW FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option shall commence immediately after expiration of the Base Period.

IAW PD paragraph 1.0 and all applicable sub-paragraphs.

Option Period Two This 12-month option period may be exercised IAW FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option shall commence immediately after expiration of Option Period One.

IAW PD paragraph 1.0 and all applicable sub-paragraphs.

Option Period Three This 12-month option period may be exercised IAW FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option shall commence immediately after expiration of Option Period Two.

IAW PD paragraph 1.0 and all applicable sub-paragraphs.

Optional Tasks These Optional Tasks may be exercised IAW FAR 52.217-7, Option for Increased Quantity – Separately Priced Line Item to incorporate additional clinical case review quantities at any time throughout Option Period One through Option Period Three. If exercised, the additional license subscriptions exercised shall end during the period of performance exercised. All items shall be delivered within 30 days after exercise of optional tasks. Formal modification is required to exercise optional tasks.

IAW PD paragraph 1.0 and all applicable sub-paragraphs.

Unit Price shall reflect monthly rate for Option Period One through Option Period Three. The optional task, if exercised, will be prorated based on the date the optional task is exercised.

Unit Price shall reflect monthly rate for Option Period One through Option Period Three. The optional task, if exercised, will be prorated based on the date the optional task is exercised.

Unit Price shall reflect monthly rate for Option Period One through Option Period Three. The optional task, if exercised, will be prorated based on the date the optional task is exercised.

Total Optional Tasks:

Page 1 of

B.5 PRODUCT DESCRIPTION

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Department of Veterans Affairs Veterans Health Administration National Radiation Oncology Program

Radiation Oncology Peer Review Software Program

Date: August 26, 2020

VA-20-00035772

PD Version Number: 7.1

1.0 PRODUCT REQUIREMENTS

High quality patient care is important in any medical discipline but is of particular concern in radiation oncology given the potential for serious harm in the event of a treatment-related error. Radiation treatment planning is a very complicated process with many safety aspects involved and with the increased application of more sophisticated technologies in radiation therapy, concerns have arisen about whether radiation is being used appropriately. Quality-assurance procedures must evolve with complex radiotherapy planning and delivery systems in order to ensure that consistently effective and safe therapy is delivered. The Veterans Health Administration (VHA) concurred with the Office of Inspector General (OIG) Health Inspection report, dated March 10, 2011, that there was a need for a robust physician peer review process related to all VHA radiotherapy programs. The Radiation Oncology Peer Review will give VA centers providing in house radiation oncology care the capability to seek prospective physician peer reviews online. The capability will enable VA radiation oncologists to consider treatment refinements and alternatives prior to radiation delivery for the safety of Veterans.

1.1 SOFTWARE APPLICATION REQUIREMENTS

VA has a requirement for software that shall be provided as part of a Software as a Service (SaaS) subscription which shall include a 12-month license for option period one through option period three based on tiered case quantities as follows for unlimited users, upgrades, technical support, training, and unlimited data storage space requirement per patient case review.

· Base Period: Basic license for the purpose of obtaining FedRAMP Certification with 1 to 20 test case review quantities.

· Option Period 1 through Option Period 3:

· Contractor shall provide Tier 1 level SaaS for 1 to 500 clinical case review quantities.

· Optional Tasks

· If the Government exercises the following optional tasks

· Contractor shall provide Tier 2 level SaaS for 501 to 2000 clinical case review quantities.

· Contractor shall provide Tier 3 level SaaS for 2001 to 5000 clinical case review quantities.

The peer review SaaS shall be accessible to all 40 VA Radiation Oncology clinics via the internet using Internet Explorer or Chrome browsers and shall enable VHA radiation oncologists to seek treatment plan peer reviews on demand from any expert anywhere with Internet web access. The peer review software shall have no dependencies on or interfaces with other VA software systems. The software architecture shall allow prospective peer reviews of radiotherapy treatment plans by VA contracted nationally recognized experts in radiation oncology outside VA. The Contractor Peer Review SaaS product shall be a hosted on the Contractor cloud environment.

1.1.1 THE SaaS SUBSCRIPTION THAT SHALL MEET THE FOLLOWING CRITERIA:

A. Users shall be able to securely upload & download imaging datasets from modalities such as computerized tomography, magnetic resonance, secondary capture, computer radiograph, portal, and digitally-constructed radiograph as well as radiation therapy data objects (Digital Imaging and Communication in Medicine (DICOM) Intranet DICOM Radio Therapy (RT) plans, RT Structure set, RT Dose, RT Images) over the VA’s intranet.

B. Provide tools to anonymize the above-mentioned datasets before the users upload them to the Contractor hosted Radiotherapy - Picture Archiving and Communication System (RT PACS) database. This tool shall have the ability to scrub all the Personal Health Information / Personally Identifiable Information data elements from the DICOM files based on the Health Insurance Portability and Accountability Act (HIPAA) privacy rules safe harbor methods. Section 164.514 of the HIPAA Privacy Rule provides the standard for de-identification of PHI/PII data elements. These anonymization tools shall be deployed on the VA computers where anonymization of the datasets shall be performed. Once the anonymization is complete the users shall be able to upload the anonymized datasets to the Contractor hosted cloud-based RT PACS database.

C. All data communication between the user’s web portal and the Contractor hosted cloud-based RT PACS database shall be secure and follow the industry standard (FEDRAMP) security protocols. The system shall be automated such that the data is automatically registered and entered into the RT PACS database.

D. Patient confidentiality shall be maintained throughout the peer review process and anonymous case datasets and peer reviewers’ observations data cannot be accessed by an unauthorized user within or external to the system.

E. Peer review cases submitted by the VA clinical providers shall be made available immediately (within 1 hour) for rapid review by the VA contracted nationally recognized experts in radiation oncology outside VA.

F. Provide tools to download all clinical data in the Contractor cloud RT-PACS server to a local archive in VA.

G. Data objects shall be editable with the support of data authoring and versioning control.

H. Accessible to multiple simultaneous VA users at any given time. VA estimates approximately 40 software user accounts to be accessed simultaneously.

I. Security shall be implemented by performing lossless compression and encryption on all data before transmission. Data shall also be stored both compressed and encrypted in the database as a further measure of security.

J. The data exchange protocol employed throughout shall be secure hypertext transfer protocol (HTTPS) for all transfers. This enables transfer from most firewall-protected networks which typically allow HTTP and secure hypertext transfer protocol HTTPS data transfers.

K. Provide a software and tools online User Manual detailing all user capabilities and functions with troubleshooting section on the use of software and transmission of planning data files to National Expert and transmission of planning data files to the program office representative. Contractor shall ensure that the most recent version of the Online User Manual is assessable to VA and reflects capabilities of the most recent version of software.

Deliverable:

A. Online User Manual

1.1.2 SOFTWARE COMPONENTS (BASE PERIOD AND OPTIONS)

The Peer Review software application shall satisfy the following software components requirement as illustrated in the figure from Appendix A “Peer Review Infrastructure of VA Radiation Oncology.” All the below mentioned software components are illustrated in the figure from Appendix A.

A. Web-based secure object archiving system (Web based RT-PACS): The software shall support all Digital Imaging and Communications in Medicine (DICOM) Message Service Elements (DIMSE) listed in the table below and can read, write and analyze DICOM (including all radiotherapy information object definitions (IOD)) and flat files (Part 10 Format). The software application shall be able to accept data over secure HTTPS web services protocol

DIMSE Services:

B. DICOM RT data viewer: The software shall have the infrastructure of comprehensive tools required for preparation, submission, auto-archiving, Web-based review, and retrieval of diagnostic images, treatment-planning images, and radiation therapy objects. The software shall have the features of auto anonymizing datasets before they are submitted for peer review. The software shall have tools for calculating Dose Value Histograms (DVH) and compositing doses from different trials of the patient. In addition to DICOM RT data the software shall have the ability to handle PDF attachments with the clinical cases for review.

C. Data analytics: The Contractor shall provide data analytic tools and dashboards to quantitatively evaluate the quality of treatment plans. The data analytics tool shall have interactive dashboards to view aggregated data from peer review results and treatment plans over time.

D. Data anonymizer: Template based anonymization tools shall be provided by the Contractor to remove any PHI/PII from the DICOM/DICOM-RT datasets before they are uploaded to the Contractor hosted cloud RT-PACS. The template-based anonymization shall have custom anonymization schemes to be applied automatically to the incoming treatment plan data. Upon anonymization the DICOM and clinical data shall be encrypted using Federal Information Processing Standards (FIPS) -140/2 supported encryption protocols. The anonymization tools will be deployed on the users VA computers where anonymization and encryption of the abovementioned DICOM datasets will be performed before they are securely uploaded to the contractor hosted cloud RT-PACS.

E. The Peer review software application shall be seamlessly interoperable with radiotherapy planning (TPS) and oncology information systems that are utilized in the VA Radiation Oncology clinics such as Varian Eclipse/Aria, Phillips Pinnacle, Elekta XiO, Elekta Mosaiq, Raysearch RayStation, Accuray Cyberknife and Accuray Tomotherapy TPS.

1.2 SOFTWARE APPLICATION DATA SECURITY REQUIREMENTS (BASE PERIOD AND OPTION PERIOD)

1.2.1 DATA SECURITY

The software shall meet the following data security criteria:

A. The software capability shall include a secure (access to patient data) and unsecure (access to general information regarding the functionalities of software) section. Access to secure section shall be divided into multiple levels, based on the privilege level assigned to a user. The privilege level shall be assigned based on the need of a user to view clinical data submitted to the RT servers. Each expert reviewing cases will have access to data submitted for his/her domain only. The software shall ensure end-users have access to only their data. Each user will have to register once with the software server and get a username and user password. Before an account is activated, the software shall send a notification to a VA system administration requesting user credentials verification. Access to data shall be hierarchical. Browsers and Web services shall use a Secure Socket Layer for secure communication. The RT servers shall exchange a public key certificate with client applications. The key certificate shall be published for the domain and signed by a certificate authority; the client application (browser) establishes an encrypted connection between itself and the RT servers.

B. Once a user logs in, a unique session shall be created on the server memory. This session shall expire after 30 minutes if there is no activity on the software. Thus, if the user computer is left unattended, the session data cannot be accessed after the expired time by others. In addition, presentation of each dynamic page depends on this unique session.

C. The Contractor shall coordinate with applicable VA stakeholders to obtain an Authority to Operate (ATO) to interface the hosted environments to the VA Network. The Contractor shall provide all Assessment and Authorization (A&A) support and documentation required to achieve and maintain full A&A certification using the process specified in the FedRAMP Program Requirements in accordance with section 1.2.2 and 1.2.3.

D. Contractor shall be fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST), FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, continuous monitoring, system patching and change management procedures and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent, to those procedures used to secure VA systems.

E. Ensure adequate security controls for collecting, processing, transmitting, and storage and removal of PII and PHI, as determined by the VA Privacy Service, must be in place, tested and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA.

F. Ensure these security controls are to be assessed and stated within the Privacy Impact Assessment (PIA) and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) shall be submitted and approved prior to the collection of PII and PHI.

1. Risk Assessment (RA),

2. Incident Response Plan (IRP),

3. Information Security Contingency Plan (ISCP),

4. Disaster Recovery Plan (DRP),

5. Configuration Management Plan (CMP),

6. Interconnection Security Agreement/Memorandum of Understanding (ISA/MOU),

7. Additional system description/and diagrams required by VA to gain access to VA network and receive an ATO.

Deliverables:

A. ATO Package B. Plan of Action and Milestones

1.2.2 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the FISMA.

2. The Contractor shall comply with FedRAMP (https://www.fedramp.gov/agency-authorization/) requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. Following guidance from the Federal Chief Information Officer, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements in accordance with the Office of Information Security Authorization requirements as outlined in Attachment 1. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 30 days after contract award.

6. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 75 days after contract award.

7. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 days after contract award.

8. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

9. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

10. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

11. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

Deliverables:

A. FedRAMP System Security Plan and supporting documentation B. 3PAO Security Assessment Plan C. 3PAO Security Assessment Report

1.2.3 PEER REVIEW APPLICATION - FEDRAMP REQUIREMENT

The Peer Review application shall be hosted on a FedRAMP-Low certified cloud solution. The Contractor shall provide a copy of the certificate issued granting ATO the cloud provider that is hosting the Peer Review application. The Contractor shall maintain its security authorization throughout the contract period of performance.

Deliverable:

A. FEDRAMP Low Certification

1.3 TRAINING AND TRAINING DOCUMENTS/MATERIALS

The Contractor shall provide two virtual, Instructor led training sessions (on Skype or Webex) for approximately 200 users on the operations and functionality of the software, including an online troubleshooting / Frequently Asked Questions. The training shall also include procedures to submit radiotherapy treatment plans to the Contractor cloud RT-PACS server. The Contractor shall deliver the PowerPoint Training Slide Deck. The Contractor shall record the training session and provide online access to the recorded training session playable on MS Windows10 environment. The Contractor shall coordinate with the COR to schedule the training sessions to be completed prior to software going operational.

The Contractor shall conduct quarterly virtual software update webinar sessions (via Skype or Webex) for approximately 100 users in the VA. The Contractor shall deliver the Quarterly webinar PowerPoint Training Slide Deck. The Contractor shall record the Quarterly webinar training session and provide online access to the recorded training session playable on MS Windows10 environment. The Contractor shall coordinate with the COR to schedule the Quarterly webinar training sessions with the VA end users.

Deliverables:

A. PowerPoint Training Slide Deck and Video.

B. Quarterly Webinar PowerPoint Training Slide Deck and Video.

1.4 HELP DESK SUPPORT

The Contractor shall provide Help Desk support to Users to have the ability to operate and resolve problems encountered while using the Radiation Oncology Peer Review software. The Help Desk support shall include users access to live chat, email and toll free telephonic support. The support shall be available Monday through Friday 8 AM to 8 PM Eastern Time.

The Contractor shall maintain a Help Desk trouble ticket log. The trouble ticket log shall log the date and time of each original help desk request, date and time of initial response, detailed description of action(s) taken, including date and time of each action, name of technician, and date and time of final resolution. This information shall be incorporated into the Quarterly Status Report.

1.5 CONTRACT AWARD MEETING

The Contractor shall hold a contract award meeting within 10 days after TO award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least two calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three (3) calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and the VA PM. The Contractor shall not commence performance on the tasks in this Product Description until the contractor has conducted a kickoff meeting.

1.6 QUARTERLY STATUS REPORTS

The Contractor shall submit quarterly status reports to the COR and Project Manager for the present and previous quarter’s activities, open issues, risk and mitigation actions, issues closed, and Help Desk activities from the trouble ticket log. The Contractor status report should include any action items from the previous quarter’s status report.

Deliverable:

A. Quarterly Status Reports

1.7 ACCEPTANCE TESTING

Prior to system “go-live” in a real-world environment, the Contractor shall undergo VA testing review and approval. The Contractor shall support VA conduct Acceptance Testing for the SaaS product based the American Association of Medical Physics recommendations in American Association of Physicist in Medicine medical physics practice guideline 5.a.: commissioning and of treatment planning dose calculations — megavoltage photon and electron beams (https://aapm.onlinelibrary.wiley.com/doi/full/10.1120/jacmp.v16i5.5768). The plan should test the functionality of the software, connectivity and operational readiness of users. VA will provide test cases designed to stress the system capabilities. Any problems must be identified and be corrected by Contractor before the system can be re-tested. The system must pass the testing and be accepted prior to commencement of services and invoicing.

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

3.0 GENERAL REQUIREMENTS

3.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OI&T Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OI&T. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

4.0 POINTS OF CONTACT

VA Program Manager / Contracting Officer’s Representative:

Contracting Officer:

Contracting Officer:

5.0 SCHEDULE OF DELIVERY

The base period shall not exceed 12 months for the contractor to install software application as outlined in section 1.1 including applicable sub-paragraph requirements and meets requirements outlined in section 1.2 including applicable sub-paragraph requirements.

The licenses subscription shall meet requirements as outlined in 1.1.1 for 12-months of services throughout Option Period One through Option Period Three.

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For: All delivery will be electronic delivery of software and software licenses to:

Primary

Richmond, VA 23249

5.1 SPECIAL SHIPPING INSTRUCTIONS

Prior to shipping, Contractor shall notify Site POCs, by phone followed by email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of Site POC.

Contractors shall coordinate deliveries with Site POCs before sending SaaS access to ensure sites have adequate log in information to SaaS subscription services.

All shipments, either single or multiple container deliveries, shall bear the VA IFCAP Purchase Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA IFCAP PO number shall indicate total number of containers for the complete shipment (e.g. “Package 1 of 2”), clearly readable on manifests and external shipping labels.

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

APPLICABLE PARAGRAPHS TAILORED FROM: THE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6, APPENDIX C, MARCH 12, 2010

GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program.