36C25918Q9788-001.pdf

STATEMENT OF WORK (SOW)

1 INTRODUCTION

VISN19 is seeking to procure a Dose Monitoring System for all eight (8) VA Medical Centers and one

(1) Community Based Outpatient Clinic (CBOC). The system should be vendor neutral to ensure interoperability with variety of radiation imaging modalities and PACS (Picture Archive Computer

System). These modalities that the dose monitoring system is collecting information from vary in basic criteria such as manufacturer and model but also include higher-level differentiation such as whether they generate a DICOM Dose Structured Report. VISN19 has approximately 9 AGFA Radiology PACS system, 1 Philips Cardiology PACS, 1 AGFA Cardiology PACS, 1 Merge Cardiology PACS, 171 modalities. See “Table 2 – PACS and Disctation System”.

Dose Monitoring systems are software based systems used to track radiation dose information from imaging devices. They store data in a centralized repository and provide tools, report, alerts, and other features that allow Radiologists, Cardiologist and associated staff to monitor and track dose information to ensure patient safety by minimizing radiation exposure.

The offers must include all hardware and software, and labor to fully implement the requirements in this document. The system shall support both physical and virtual server hardware. If the system can be housed on virtual servers, all costs to implement software on virtual environment must be included (See

3.1.3.2 for Network Infrastructure specifics). Server requirements must be included as part of proposals.

Table 1 – Location

Facility (VAMC/HCS) Address

Cheyenne VAMC (CHY) 2360 E. Pershing Blvd, Cheyenne, WY 82001

Eastern Colorado HCS (ECHCS) 1700 N Wheeling St, Aurora CO 80045

Grand Junction VAMC (GRJ) 2121 North Avenue, Grand Junction CO 81505

Montana HCS: Fort Harrison (MT) PO Box 1500, Fort Harrison MT, 59636

Montana HCS: Billing CBOC (MT) 1766 Majestic Lane, Billings, MT 59102

Eastern Oklahoma HCS (MUS) 1011 Honor Heights Drive, Muskogee, OK 74401

Oklahoma City HCS (OKC) 921 NE 13th St, Oklahoma City, OK 73104

Salt Lake City HCS (SLC) 500 Foothill Drive, Salt Lake City, UT 84148

Sheridan VAMC (SHE) 1898 Fort Road Sheridan, WY 82801

2 GENERAL CONDITIONS

2.1 General Operation

2.1.1 On-Site assembly and installation of items, and performance of services identified in this document will take place during normal business hours which are defined as: 8:00am to

04:00PM local time, Monday through Friday, and excluding Federal Holidays.

2.1.2 Vendor shall provide an electronic copy of user/training manual.

2.1.3 Vendor shall be in compliance with VA network security regulation according to VA

Directive 6500 and 6550.

2.2 Drawing Documents and Specifications

2.2.1 Vendor shall provide, with their quote, a high-level network diagram to describe how the Dosemonitor will integrate among the nine (9) sites and various PACS.

2.2.2 Vendor shall provide the fill out VA Pre-assessment 6550 Appendix A form (page A2-

A6)

2.3 Definition

Acceptance Signature – COR or VA designee signature; indicates COR accepts work status as stated in SOW

• ADT – Admissions, Discharges, and Transfers

• AGD – Average Glandular Dose

• API – Application Program Interface

• BMI – Body Mass Index

• CO – Contracting Officer

• COR – Contracting Officer's Representative

• CPMP – Contractor Project Management Plan

• CTDI Phantom (16cm or 32cm)

• CT – Computed Tomography

• CTDI – Computed Tomography Dose Index

• CVIS – Cardiovascular Information Management System

• DAP – Dose Area Product

• DICOM – Digital Imaging and Communications in Medicine

• DLP – Dose Length Product

• DMWL – DICOM Modality Work List

• DRL – Dose Reference Level

• DR/CR – Digital Radiology/Computed Radiology

• EMR – Electronic Medical Record

• ESR – Engineering Service Record/Report

• FSC – Field Service Engineer

• HCS – Health Care System

• HL7 – Health Level 7 Standard

• IHE REM – Radiation Exposure Monitoring

• Kair – Air Kerma at the reference point

• kV – Kilo Volts (Tube Voltage)

• LDAP – Lightweight Directory Access Protocol

• mAs – Milli Ampere Seconds

• MPPS – Modality Performed Procedure Step

• NIC – Network Interface Controller

• OCR – Optical Character Recognition

• OI&T – Office of Information and Technology

• PACS – Picture Archiving and Communication System

• PET – Positron Emission Tomography

• PHI – Protected Health Information

• PIV – Personal Identification Verification

• PMP – Project Management Plan

• SPECT – Single-Photon Emission Computerized Tomography

• SR – Structured Reporting

• SSDE – Size-Specific Dose Estimates

• VA – Department of Veterans Affairs

• VACO – Department of Veterans Affairs Central Office

• VAMC – Department of Veterans Affairs Medical Center

• VHA – Veterans Health Administration

• VISN – Veterans Integrated Service Network

• VistA – Veterans Health Information Systems and Technology Architecture

• VPN – Virtual Private Network

• V&V – Verification & Validation

3 FUNCTIONAL AND TECHNICAL SPECIFICATIONS

3.1 Dose Monitor Software

3.1.1 Application Specific Specifications

3.1.1.1 System shall track a volume of up to 350,000 exams of modalities listed below.

3.1.1.2 System should be able to track dose parameters from the following imaging modalities:

• Computed Tomography

• Interventional Radiology Labs

• Catheterization and Electrophysiology Labs

• Hybrid Operating Room suites

• Mammography

• Fluoroscopy and portable C-arm

• CT used as part of a hybrid imaging system (PET or SPECT)

• Endoscopic Retrograde Cholangiopancreatography (ERCP)

• Direct Radiology and portable

• Contrast Media

3.1.1.3 System shall have the ability to extract, catalogue, and individually store all the dose information from the following sources. The system shall be flexible to use any of these fields to extract dose values and not be limited to just one. Sources must include:

• DICOM header

• DICOM Dose Structured Report

• Dose Screening (Using OCR)

• DICOM MPPS

• PACS. Appendix A List of PACS make/model

• Image headers

3.1.1.4 System shall track and measure all Dose Metrics to include:

• Effective Dose

• CTDI

• CTDI Phantom

• DLP

• SSDE

• Patient Size/Age

• BMI

• kV

• mAs

• DAP

• Patient Skin Dose

• Patient Exposures

• Kair (Air Kerma at the reference point) for Fluoroscopy and Interventional labs

• Average Glandular Dose for Mammography

• Dose level at organ level for Nuclear Medicine studies

3.1.1.5 System shall integrate with the following systems and protocols:

• System shall integrate with Radiology and Cardiology PACS systems.

▪ Resolves patient demographics via DMWL or ADT feed

▪ Adds dose metrics into CVIS report

• System shall integrate with Radiology dictation systems and incorporate all costs.

• System shall support and include integration with HL7 integration with VA EMR

(CPRS/Vista)

• System shall conform to the IHE REM profile.

Table 2 – PACS and Dictation System

Station

Radiology

PACS

Cardiology PACS Dictation System

CHY AGFA Impax Talkstation(TALK)

ECHCS AGFA Impax Philips ISCV 1.2 Talkstation(TALK)

GRJ AGFA Impax Talkstation(TALK)

MT Ft.Harrison AGFA Impax Powerscribe 360

MT Billing AGFA Impax Powerscribe 360

MUS AGFA Impax Talkstation(TALK)

OKC AGFA Impax MERGE Cardio 9 Talkstation(TALK)

SLC AGFA Impax Agfa Impax CV 12.2 Talkstation(TALK)

SHE AGFA Impax Talkstation(TALK)

3.1.1.6 System shall import historical data located in the DICOM Dose Structured

Report and other dose data that is in PACS. Contractor is responsible for importing four (4) years of historical dose SR located in PACS.

3.1.1.7 System shall support an API interface to work with other systems such as

PACS, dictation, and CVIS systems.

3.1.1.8 System shall be flexible and allow each facility to customize the configuration and clinical work flow per facility specific needs

3.1.1.9 System helps compliance with Joint Commission standards for Dose

Monitoring.

• Documents in the patient’s record the radiation dose index (CTDI vol, DLP, or

SSDE) on every study produced during a diagnostic CT examination. The radiation dose index must be exam specific, summarized by series or anatomic area, and documented in a retrievable format.

• Provides reports and data to assist with incidents where the radiation dose index

(CTDI vol, DLP, or SSDE) from diagnostic CT examinations exceeded expected dose index ranges identified in imaging protocols.

3.1.1.10 System shall monitor and track dose metrics per specific patient.

3.1.1.11 System shall track dose metrics over time for specific make and model imaging devices, hospital sites, exam codes, technologists, radiologists, protocols, and other related parameters.

3.1.1.12 System shall have ability to manage protocols for devices in a central repository. Contractor is responsible for uploading protocols into system.

3.1.1.13 System shall calculate automatic CT SSDE.

3.1.1.14 User Management

• System shall provide audit trail capability per username and time stamp.

• System shall work with LDAP for authentication and provide multiple roles for users.

• System shall comply with PHI standards.

• System shall allow for customizable data access restriction.

3.1.2 Reporting and Alerting Features

3.1.2.1 System shall provide a customizable dashboard or banner page for users.

Dashboard or banner page can be configured per user, site, or VISN.

3.1.2.2 System shall create customizable automated reports.

3.1.2.3 System provides real-time notifications if an individual patient’s exposure exceeds dose and/or number of exposures. Notification shall be able to be sent via:

• Modality

• Email

• Text

3.1.2.4 System shall allow for customizable reference levels for dose and exposure.

3.1.2.5 System shall provide customizable level of alerts for notifications.

3.1.2.6 System shall provide total cumulative dose values by either CTDI or DLP.

3.1.2.7 System shall allow for customizable reports, including export of comprehensive data sets, in excel and at least one of the following formats:

• Excel

• PDF

• CSV

• HTML

3.1.2.8 System shall add dose metrics into Radiologist report.

3.1.2.9 System shall support DRLs set locally, by registries, or by regulatory bodies.

3.1.2.10 System shall create customizable utilization reports to provide comparative data from individual devices, technologist, clinician, device type, hospital, and others.

3.1.3 Network Infrastructure

3.1.3.1 System shall support multi-site infrastructure across multiple states, Active

Directory domains, and time zones.

3.1.3.2 System shall support both physical and virtual server hardware.

• ECHCS: virtual through existing AGFA Radiology PACS system

• OKC: virtual through existing AGFA Radiology PACS system

• MUS: virtual through existing AGFA Radiology PACS system

• SLC: virtual through existing Biomedical Engineering Neutral Hyper-v environment

• MT Fort Harrison: virtual through existing Biomedical Engineering neutral vmware environment

• MT Billings: physical server

• CHY: physical server

• GRJ: physical server

• SHE: physical server

3.1.3.3 System shall be designed to communicate with local facility PACS and modality through LAN at a standard 100/1000Mbps bandwidth. VA can’t host system require more than 100/1000 Mbps bandwidth.

3.1.3.4 System shall have a minimal of 1 database to archive all VISN19 data.

3.1.3.5 System shall allow end users to launch the client application via web browser interface (IE) through VA OIT PC environment and/or AGFA Radiology PACS reading workstation.

3.1.3.6 System shall be operating on, at a minimal, Win 2012 OS and MS-SQL 2012, Remote viewing connectivity, and Anti-Virus. Oracle or equivalent database structure is also acceptable.

3.1.3.7 Vendor shall provide all necessary support software license to support the system operation. License include but not limited to Win OS, SQL. VA will provide

McAfee Antivirus license unless the system can’t use McAfee, then vendor shall provide the anti-virus license.

3.1.3.8 System shall allow VA to install host-based security components such as firewall, host-intrusion prevention system (HIPS), anti-malware, and/or any other security suite software required to operate on the VA production network.

3.1.3.9 All data and systems should be owned, managed, and located within VISN19 network environment.

3.1.3.10 System shall have the existing VA Site -to-site national VPN access

3.2 Server Hardware

3.2.1 Vendor shall provide all server hardware necessary to deploy the system.

3.2.2 Server hardware shall be:

• Rack mountable with rail and mounting accessory

• Dual power supplies with standard 120v power cable

• Necessary accessory to allow the software install successfully. For example, DVD drive, USB port.

• RAM, CPU, hard drive, NIC shall meet the minimum requirement of the Dose monitor system from section 3.1

• Dual NIC

3.3 Project Management Plan

3.3.1 The Contractor shall draft a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of the contract. The PMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall include the contractor’s plans for managing all subcontractors. Topic areas to be addressed shall include oversight and communications with subcontractors while onsite at VA locations, as well as executing the timely distribution and delivery of all materials to subcontractor personnel. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified. The initial baseline CPMP shall be concurred upon and updated monthly thereafter. The Contractor shall update and maintain the VA Contracting

Officer’s Representative (COR) approved CPMP throughout the period of performance.

3.3.2 The CPMP include but not limited to:

• Project Schedule to include Milestones, Deliverables, and Critical Path

• System Design including network infrastructure and clinical workflow

• Verification & Validation (V&V) Plan

• Training Plan

• Operations & Maintenance Plan (See Section 4 for further Detail)

• Project Closeout Activities/Procedures

3.3.3 Reporting Requirements

3.3.3.1 The Contractor shall provide at a minimal monthly progress reports, to include schedule updates, to the VA COR and shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The reports shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation. The

Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will remain in communication with the VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

3.3.3.2 The Contractor shall provide the COR with monthly Installation Progress

Reports in electronic form in Microsoft Word, Project formats or PDF. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding

Month. These reports shall include a summary of the task order deliverables.

3.3.4 Verification and Validation Requirement (Testing)

3.3.4.1 The Contractor shall perform testing following installation to ensure all requirements are met.

3.3.4.2 The Contractor shall discuss and confirm suggested workflow for each facility

3.3.4.3 The Contractor shall provide a final test plan that includes facility test sequent and updates addressing any comments provided by the VA.

3.3.4.4 Contractor shall test the integration requirement in section 3.1.1.5

3.3.5 Project Estimate Timeline

3.3.5.1 Phase I: System Design. Expected Start Date: As soon as contract Award

3.3.5.2 Phase II: Installation start at ECH site. ECH is the selected site to host the primary database for VISN19 Dose monitor system. Estimate start date 9/17/2018

• All Server hardware shall be installed by vendor through onsite. Vendor is responsible for mount, rack, and all software installation activities (including Win

OS and database license registration)

• Virtualization Server: vendor is responsible for installation all software via a pre-approval site-to-site VA VPN.

• In the event vendor doesn’t have an established approved site to site VA VPN and/or VA Active Directory user account, vendor must provide onsite installation service at no additional cost to VISN19.

3.3.5.3 Installation requirement in Phase II applies to Phase III

3.3.5.4 Phase III: Installation of the remaining station at a following sequence:

• CHY

• SLC

• MT Fort Harrison

• MT Billings

• GRJ

• SHE

• OKC: Estimate start date Jan,7, 2019

• MUS: Estimate start date follow OKC

3.3.5.5 Phase IV: Validation, Verification: Expected Start Date: Immediately after each facility installation complete in Phase III.

• V&V testing at each site as it completes installation

• V&V testing for all VISN19 sites interoperation is at the end of MUS testing

3.3.5.6 Phase V: End User Training. Expected Start Date: Immediately after each facility testing complete in Phase IV

3.3.5.7 Phase VI: GO Live: Expected Start Date: Immediately after each facility training complete in Phase V

• Each facility GO LIVE at after facility level training

• A minimum of 12 months warranty and support after VISN19 GO LIVE at all stations and VA accept the system. In the event VISN19 delay the installation and/or GO LIVE, the warranty starts at the last site GO LIVE date.

3.3.6 Training Requirements

3.3.6.1 A comprehensive training shall be provided with information include but not limited to:

• Training Schedule at each facility

• Training course, type, and duration at each facility

• Training course delivery method (Onsite or web base) at each facility

3.3.6.2 Training duration is based on the table 4 Training Type for each facility

3.3.6.3 If Web base training is proposed, vendor has the responsible to ensure trainer has adequate access to VISN19 Dose monitor environment. Training shall be using the production data and configuration from VISN19 Dose monitor environment for Live

Demonstration for each facility

3.3.6.4 User/Training Manual shall be in PDF format with detail addressing each facility work flow.

Table 3 – Training Type

Training Audience Minimum Training Information Training Location

Clinical Users clinical training with facility clinical staff. Web base

Superuser Capable to change local site configuration Web base

Follow-up Clinical User

6 Months after facility GO LIVE, Contractor provide refresh clinical user training.

Web base

Table 4 – Training Facility Detail

Station Training Audience

Anticipate

# Staff

CHY Clinical Users 5

CHY Superuser 2

CHY Follow-up Clinical User 5

ECHCS Clinical Users 7

ECHCS Superuser 3

ECHCS Follow-up Clinical User 7

GRJ Clinical Users 4

GRJ Superuser 1

GRJ Follow-up Clinical User 4

MT Ft. Harrison Clinical Users 3

MT Ft. Harrison Superuser 2

MT Ft. Harrison Follow-up Clinical User 3

MT Billings Clinical Users 5

MT Billings Superuser 2

MT Billings Follow-up Clinical User 5

MUS Clinical Users 5

MUS Superuser 2

MUS Follow-up Clinical User 5

OKC Clinical Users 7

OKC Superuser 3

OKC Follow-up Clinical User 7

SLC Clinical Users 7

SLC Superuser 3

SLC Follow-up Clinical User 7

SHE Clinical Users 4

SHE Superuser 2

SHE Follow-up Clinical User 4

4 OPERATION AND MAINTENANCE

• The vendor shall furnish labor necessary to provide scheduled and unscheduled maintenance and support when approved by the facility COR. Services shall be performed in accordance with terms, conditions, and specifications contained herein. System will be located at the addressed cited in section 1 above.

• When onsite support is required, the vendor shall check in with Biomedical

Engineering prior to performing any services. When the service is completed, the vendor shall document services rendered on a legible Engineering Service

Record/Report (ESR). The vendor shall check out with Biomedical Engineering upon completion of service, and submit the ESRs to the COR.

• Vendor shall maintain site to site VA VPN access through contracting performance period.

4.1 Operation Support Hours:

4.1.1 Telephone Support: Monday through Friday 8am through 8pm Local time

4.1.2 Onsite support: Monday through Friday 8am through 8pm Local time. Onsite respond time is 48 hours from the moment onsite support is confirmed by vendor technical support team.

4.1.3 Exclusion: Federal Holidays

https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/

4.2 Maintenance Report

4.2.1 Each ESR must, at a minimum, document the following data legibly and in complete detail:

• Name of vendor and contract number

• Name of technician (FSE) who performed services

• Vendor service ESR number/log number https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/

• Date, time (starting and ending), equipment downtime and hours on-site for service call

• VA purchase order number(s) covering the call if outside normal working hours

• Description of problems reported by the COR/user (if applicable)

• Identification of equipment to be serviced:

o Manufacturer's name, device name, model number & serial number o Any other manufacturer's identification numbers

• Itemized description of service performed (including, if applicable, costs associated with after normal working hour services) including:

o Labor and Travel o Parts (with part numbers) o Materials and Circuit Location of problem/corrective action o Total Cost to be billed (if applicable - i.e., part(s) not covered or service rendered after normal hours of coverage)

• Signatures:

o FSE performing services described o Authorized VA Employee who witnessed service described

4.2.2 NOTE: - Any additional charges claimed must be approved by the VA CO before service is completed.

4.3 Scheduled Maintenance (As Applicable)

4.3.1 The vendor is required to provide the software maintenance/updates, upgrade. Software maintenance includes periodic updates, enhancements and corrections to the software, and reasonable technical support, all of which are customarily provided by the vendor to its customers, to allow the software to perform according to its specifications, documentation or demonstrated claims.

• Scheduled maintenance shall be scheduled with facility COR in advance to avoid clinical interruption.

• If the schedule maintenance impacting clinical used of the application, vendor shall schedule the application outside of operation hours with no additional charge to

VISN19.

• Scheduled maintenance may be accomplished through site to site VA VPN as applicable.

4.4 Unscheduled Maintenance

4.4.1 There shall be no hourly charge to the Government for unscheduled maintenance performed within normal operating hours. If unscheduled maintenance is required outside of operating hours, the vendor requires VA approval before any work is performed.

• Unscheduled maintenance for software may be accomplished through site to site VA

VPN as applicable.

• Unscheduled maintenance for hardware shall be completed onsite

4.5 Parts

The vendor shall furnish all non-consumable parts required for unscheduled or scheduled maintenance under the terms and pricing of this contract. All parts shall perform identically to the original equipment specifications.

5 INFORMATION SECURITY

5.1 The vendor shall have a current/active Business Associate Agreement

(BAA) with the Department of Veterans Affairs.

5.2 VA Information Custodial Language

5.2.1 Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the

VA. This clause expressly limits the contractor/subcontractor’s rights to use data as described in

Rights in Data – FAR 52.227-14(d)(1).

5.3 Security Incident Investigation

5.3.1 The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures.

5.3.2 The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

5.4 Liquidated Damages for Data Breach

5.4.1 Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information (SPI). If so, the contractor/subcontractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

5.4.2 The contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

• Notification;

• One year of credit monitoring services consisting of automatic daily monitoring of at least three (3) relevant credit bureau reports;

• Data breach analysis;

• Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

• One (1) year of identity theft insurance with $20,00.00 coverage at $0 deductible; &

• Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

5.5 Training

5.5.1 All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

• Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

• Successfully complete the VA Privacy and Information Security Awareness and Rules of Behavior training and annually complete required privacy and security training; and

• Successfully complete any additional information security or privacy training, as required for VA personnel with equivalent information system access.

5.5.2 The contractor shall provide the to the Contracting Officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within one (1) week of the initiation of the contract and annually thereafter, as required.

5.5.3 Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until the training and documents are complete.