ToxDB Solicitation Questions 2022.1.18_Answered.docx

FAA RFP Toxicology Database Software LIMS 6973GH-22-R-00023

1. What is your current standard web browser and operating system? Requirement 2.1, i

Windows 10 is OS, Chrome, MS Edge are the available browsers. Windows IE is also available, but is being phased out.

2. Is the Login Screen requirement for Templates and Branding something that is text only, or does it also require logo branding? Requirement 2.1, iv

Text only, no logo -- this screen can be displayed as text, or as an image of that text, the only requirement is that the text that we provide be visible to, and acknowledged by, users prior to accessing the system.

3. What Operating Systems are in use for desktop, laptop, and tablets (full list)? Requirement 2.1, v

Windows 10

4. Is the Cybersecurity Standard they refer to in sec. 2.2, ii the same one referred to in 2.3 xii?

Role-based security refers to the ability to assign privileges based upon user roles, with users identified through PIV credentials. As for NIST vs cybersecurity standards of FAA, Check with SOC.

5. Requirement 2.2, xi - What resources are implied here? Does availability refer to people? Instruments? Other? What is your current solution for this?

Resources refer to equipment, consumables, reagents, or anything that we want to designate as a ‘resource’. We will not likely place personnel under ‘resources’. Currently we rely on our LIMS system for specimen tracking, and excel sheets for other tracking.

6. What type of control charts are currently in use? How are blind vs. open controls used currently? Requirement 2.2, xxi

Levi Jennings charts, or similar. Blind controls are included with each batch and are blind to analyst, open controls are processed by analyst to ensure casework accuracy. We would like both of these to be tracked.

7. Requirement 2.2, xxix Interfacing with other DBs of what type? (e.g. SQL)

JSON capability will allow us to interface with virtually any database, we interface with SQL, Access, and text databases.

8. What tools are used to monitor/assess compliance with the HIPAA standard, if any? Requirement 2.3, v

We require the product, as implemented, to comply with the current HIPAA technical and cybersecurity standard found at https://www.hhs.gov/hipaa/for-professionals/security/index.html

9. Requirement 2.3, vii Please provide.

This will be handled post-award through continuing cybersecurity assessments. There is a process for bringing the product into compliance during and after these assessments. The vendor must be willing to entertain and consider suggested mitigations or change orders regarding compliance with this order as a result of these cybersecurity assessments.

10. Requirement 2.3, viii What tools are used to monitor/assess compliance?

We ask simply for compliance with Web Content Accessibility Guidelines (WCAG) 2.0 Levels A and AA.

11. Requirement 2.3, ix, Is the standard notice text or does it include other file types?

Text

12. Will a data migration be acceptable if done remotely and not on site as described in Requirement 15 i?

Data is not currently available to non-FAA computing equipment, making data transfer from offsite difficult.

13. Section 2.1, ix states “The vendor must map, migrate, and convert data from the legacy system (Access database based with additional functions written in Visual Basic) into the new system without loss of data integrity.”

In order to properly price this function, will the Government please provide details regarding the data migration requirement? What is the size of the database? How many tables? What type of data is involved? Would the Government entertain an approach that involves querying / reporting against legacy that has been moved to an accessible schema, as opposed to moving all data into the new solution?

Clarification – the data is contained in a MS-SQL database, the applications are MS-Access applications.

DB size - 1.42 TB Number of Tables: MANTRA: 105 TOXFLO: 79 Type of Data: numerical, text, and free text The government prefers to transfer data into the new solution.

14. Section 8 states “The Contractor, unless otherwise specified, must provide the deliverables and perform the services for this Contract in the FAA CAMI (5900 S.W. 66th / Building 13) located on the Mike Monroney Aeronautical Center (MMAC) in Oklahoma City, OK. If the contractor is required to be on-site at either location, the contractor’s representatives will be escorted by Federal Government employees at all times and must report to FAA Security with identification.”

Where is the other location referred to in this section?

The MMAC is a campus of composed of several buildings, and CAMI is located on that campus. It is possible, but unlikely, that the contractor may need to access other buildings on campus. With respect to the language “unless otherwise specified”, does this mean that the contractor can propose that work typically not done at a Government site can be done at the contractor’s facilities? Yes, the contractor may propose that work not typically perform at a government site can be performed offsite.

15. Section 2.2 xxix states “The product must have the ability to interface with other databases on a regular basis and will import desired data.”

This implies that the contractor is not required to perform system integrations, rather, the system must only have the ability to do this. Is our understanding correct, or do you have specific systems in which formal integrations are required? If so, please provide information on what systems need to be integrated and the type of data. Also, will it be a single direction interface or bidirectional?

The contractor is required to perform the work required to allow data import or export to/from those systems as necessary. Data flows between TOXDB and outside databases are unidirectional. Data types to be integrated are text and numerical data; the databases themselves are SQL-based.

16. Similar to the question above, does the Government anticipate instruments to be integrated? If so, how many, and what are the instrument types?

Not at this time.

17. Does the Government require the contractor to provide any reports? If so, could you please provide some examples and numbers of reports? Are management reports required?

Yes, toxicology reports, medical case review reports, autopsy reports. We will provide redacted TOX report, autopsy report, and medical case review report. Other types of reports are case statistics reports, certification reports, and ad-hoc reports. Management reports such as QC reports are also needed.

18. Given the research nature of part of the organization, are any clinical studies or trials performed?

Yes, but we do not intend to use this system in clinical research studies.

19. #12: 2.2.iii…Please clarify what is meant by “sharing case information between user roles”.

Information or data entered into data fields must be visible to, or editable by, other users according to each user’s permissions.

20. 25: 2.2.xviii…Please clarify what is meant by “generate and store specimen inventory templates”.

The system must allow users to create new templates or queries that are performed either at a specified time or after a specified action. In this case, we wish to generate a list of all specimens assigned to a case.