PWS

PERFORMANCE WORK STATEMENT (PWS)

Anatomic Pathology Laboratory Information System (APLIS)

1.0 Scope

This is a nonpersonal services contract to provide Anatomic Pathology Laboratory Information System (APLIS)

Integration Services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the

Contractor who, in turn is responsible to the Government.

1.0.1 Description of Services/Introduction

The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform APLIS Integration as defined in this

Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.0.2 Background

The Military Health Service (MHS) consists of a worldwide network of military hospitals, health clinics, the

Department of War’s (DoW) private sector health business partners, and the Uniformed Services University of the

Health Sciences. The primary mission of the MHS is to ensure the Nation always has available a healthy fighting force and the ability to support DoW missions worldwide. The Assistant Secretary of Defense for Health Affairs

(ASD(HA)) oversees the MHS and is responsible for providing cost effective, quality health benefits to 9.6 million active-duty members, retirees, survivors and their families. DHA operates the MHS under the authority, direction, and control of the ASD(HA).

1.0.2.1 Portfolio Acquisition Executive, Medical Devices Systems (PAE MDS)

The mission of PAE MDS is to transform the delivery of health care and advance data sharing through a modernized electronic health record for service members, veterans and their families. PEO DHMS oversees three Program

Management Offices (PMO) as follows:

• DoD Healthcare Management System Modernization (DHMSM)

• Joint Operational Medicine Information Systems (JOMIS)

• Enterprise Intelligence and Data Solutions (EIDS)

1.0.2.2 DoD Healthcare Management System Modernization (DHMSM)

The DHMSM Program Management Office (DHMSM PMO) oversees deployment, operations, and sustainment of

MHS GENESIS®, DoW’s new electronic health record which is a $11B acquisition. DHMSM manages the acquisition, testing, delivery, integration, and successful operation and sustainment of MHS GENESIS, a state-of-the-market electronic health record and health care system solution that transforms the way the DoW and the

Department of Veterans Affairs support military and veteran healthcare missions by creating a single EHR for patients for use by both agencies. When fully deployed, MHS GENESIS will provide the DoW's 9.6 million beneficiaries and 205,000 medical providers with a single, integrated health record across the continuum of care – deployed and at home and eventually, through the transition to the Department of Veterans Affairs.

1.0.2.4 MHS GENESIS

MHS GENESIS is the modernized electronic health record managed by the DHMSM and the PAE MDS.

MHS GENESIS integrates inpatient and outpatient best-of-suite solutions that connect medical and dental information across the continuum of care, from the point of injury to the military treatment facility. This includes

Garrison, operational, and enroute care, increasing efficiencies for beneficiaries and healthcare professionals. MHS

GENESIS will replace selected Department of Defense (DoD) legacy healthcare systems, including but not limited to: MHS GENESIS, inpatient, and components of the Theater Medical Information Program-Joint (TMIP-J).

MHS GENESIS supports the availability of electronic health records for more than 9.6 million DoW beneficiaries and approximately 205,000 Military Health System personnel globally. It enables the application of standardized workflows, integrated healthcare delivery, and data standards for the improved and secure electronic exchange of medical and patient data. MHS GENESIS deployed via a wave model that began in the Pacific Northwest.

1.0.2.5 Anatomic Pathology Laboratory Information System (APLIS)

APLIS (CoPath Plus) is a commercial off-the-shelf product used in a pathological laboratory for advanced data management. The Anatomic Pathology (AP) community utilizes Cerner CoPath M and is transitioning to APLIS

(CoPath Plus). The Government understands that use of APLIS (CoPath Plus), including upgrades and new releases, is subject to Contractor’s end user license agreement. Cerner CoPath M was deployed at 46 sites and APLIS

(CoPath Plus) is deployed at (38) sites. Reporting allows orders to be sent from both legacy CHCS and MHS

GENESIS system to APLIS (CoPath Plus). Upon transition from CHCS to MHS GENESIS, APLIS (CoPath Plus) will directly interface with MHS GENESIS

1.0.3 Objectives

The objective of this contract is to support the minimal sustainment and decommissioning of APLIS at AP laboratory sites as identified in Attachment G. The Contractor shall follow the Code of Federal Regulation (CFR), Title 42, and Part 493, to ensure that APLIS is safe and effective for its intended use.

The Contractor shall perform integrated activities, which includes required testing, quality assurance, customer support and infrastructure maintenance at host MHS Application Access Gateway (MAAG) sites until decommissioning of the solution has been completed.

This support also includes the configuration and maintenance activities required to maintain the current version of

APLIS to include interfaces with other clinical systems. All components of the application software, including reports, are required to perform accurately and contain no defects on all versions. All supporting and third-party software shall be tracked to ensure that all versions are current. Tracking expiration dates, licenses, end of life notifications, cybersecurity compliances are some of the attributes to be tracked in addition to others that may be identified during the contract period. A major upgrade such as major software or hardware revision must be reassessed for ATO or in addition to the APL. The system will not require upgrades during this period of performance.

In addition, this support will also include the management of the deployed security system on the APLIS production, training, and testing servers utilized by the DoW to monitor, detect, and counter attacks against DoW computer networks and systems.

1.1 General Information

1.1.1 Hours of Operation

Normal business hours are Monday through Friday 8 AM-5 PM (except Federal holidays); however, unanticipated issues may require the Contractor to work either before or after those hours, and in exceptional cases, on weekends, when directed to do so by the Contracting Officer Representative (COR). However, several tasks, such as Tier III

Support and Remote Monitoring, require evening and weekend hours to be worked. Situations such as unanticipated Incident Responses could require these hours to be worked. Flextime and teleworking are authorized for all tasks at the discretion of the Government.

The contractor must always maintain an adequate workforce for the uninterrupted performance of monitoring the APLIS system as described within this PWS.

The contractor shall not be required to perform work on the following holidays, except at MTFs located around the world when required to do so by the Government.

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day

President’s Day Veteran’s Day

Memorial Day Thanksgiving Day

Independence Day Christmas Day

Juneteenth

1.2 Security Requirements

1.2.1 Cybersecurity Requirements

1.2.1.1 Contractor Employees Who Require Access to Government Information Systems. All contractor employees requiring access to a government information system shall successfully complete the DoW Information Assurance

(Cybersecurity) Awareness training prior to access to the information system. Successful completion of the current version of this training must be accomplished annually thereafter. This training takes approximately 30 – 60 minutes to complete and requires the student to pass a test at the conclusion of the training. DoW IA Awareness

(Cybersecurity) Training can be taken at: Defense Health Agency (DHA) Learning Management System, Joint

Knowledge Online (JKO): http://jko.jten.mil/mhs

1.2.1.2 Contractor Employees Performing Information Assurance (Cybersecurity) / Information Technology

Functions shall comply with the requirements listed below:

1.2.1.2.1 Training. All contractors and associated subcontractor employees working in IA/IT functions must comply with DoW training requirements in DoD 8570.01, and DODM 8140.03. The contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-171.

1.2.1.2.2 Certification. Per DoDM 8140.03, DFARS 252.239.7001, contractor employees’ supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoW

8570.01-M must be completed prior to the beginning of their contract support services. In addition, the contractor shall comply with Computing Environment (CE) certification requirements as specified in the contract. CE certifications shall be obtained within the timelines specified in DODM 8140.03.

1.2.1.2.3 Privileged User’s Requirements. All contractor employees with privileged user status must comply with the requirements of DHA-AI 081, Appendix II.

1.2.2 Personnel Security and Automated Data Processing/Information Technology (ADP/IT) Requirements

1.2.2.1 Formal Designations Required: Contractor personnel requiring access to the following must be in positions designated as ADP/ IT-I (critical sensitive) or ADP/IT-II (non-critical sensitive):

- Access to a secure DoW facility.

- Access to a DoW IS or a DoD Common Access Card (CAC)-enabled network.

- Access to Defense Enrollment Eligibility Reporting System (DEERS) or the Business-to-Business (B2B) Gateway.

1.2.2.1.1 ADP/IT Position Sensitivity Designations: An ADP/IT position category includes access to DoW information systems. It is a designator that indicates the level of IT access required to fulfill the responsibilities of the position, including the potential risk for an individual assigned to the position to adversely impact DoW missions or functions. The PWS specifies the ADP/IT Position Sensitivity Designation(s) for positions on this contract.

Contractor personnel designated for assignment to an ADP/IT position shall undergo a successful background security screening before being granted access to DoW Information Technology (IT) systems and/or any

DoD/Defense Health Agency (DHA) data directly extracted from those contained on any system (e.g., test and /or production) that contains sensitive data.

1.2.2.1.2 ADP/IT I: Critical Sensitive Position - A position where the individual is responsible for the development and administration of MHS IS/network security programs and has the direction and control of risk analysis and/or threat assessment. The required investigation is a Single Scope Background Investigation (SSBI) or equivalent.

Responsibilities include:

- Significant involvement in life-critical or mission-critical systems.

- Responsibility for the preparation or approval of data for input into a system, which does not necessarily http://jko.jten.mil/mhs involve personal access to the system, but with relatively high risk for affecting severe damage to persons, properties or systems, or realizing significant personal gain.

-Relatively high-risk assignments associated with or directly involving the accounting, disbursement, authorization for disbursement from systems of:

-- Dollar amounts of 10 million dollars per year, or greater; or

-- Lesser amounts if the activities of the individuals are not subject to technical review by higher authority in the

ADP/IT-I category to ensure the integrity of the system.

-Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring, and/or management of systems hardware and software.

-Other positions as designated by the Authorizing Official (AO) that involve a relatively high risk for causing severe damage to persons, property or systems, or potential for realizing a significant personal gain

1.2.2.1.3 ADP/IT II: Non-Critical-Sensitive Position - A position where an individual is responsible for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the ADT/IT I category. The required investigation is a National Agency Check with Local Agency

Checks and Credit Check (NACLC) or equivalent. Responsibilities include, but are not limited to:

-Access to and/or processing of proprietary data, information requiring protection, or government-developed privileged information involving the award of contracts.

-Accounting, disbursement, or authorization for disbursement from systems of dollar amounts less than 10 million dollars per year.

-Other positions as designated by the AO that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in ADP/ITI positions.

1.2.2.2 Employee Prescreening: Contractors shall conduct thorough reviews of information submitted on an individual’s application for employment in a position that requires either an ADP/IT background investigation or involves access via a contractor system to data protected by either the Privacy Act of 1974, as amended, or the

Department of Health and Human Services (HHS) Health Insurance Portability and Accountability Act of 1996

(HIPAA) Privacy and Security Final Rule.

1.2.2.2.1 For contractors working in the United States (U.S.) and the District of Columbia, this prescreening shall include reviews that:

-Verify U.S. citizenship.

-Verify education (degrees and certifications) required for the position in question.

-Screen for negative criminal history at all levels (federal, state, and local).

-Screen for egregious financial history; for example, where adverse actions by creditors over time indicate a pattern of financial irresponsibility or where the applicant has taken on excessive debt or is involved in multiple disputes with creditors.

1.2.2.2.2 The prescreening shall be conducted as part of the pre-employment screening and shall be completed before the assignment of any personnel to a position requiring the aforementioned ADP/IT accesses. The pre-screening can be performed by the contractor’s personnel security specialists, human resource manager, hiring manager, or similar individual.

1.2.3 Processing Personnel Security Requirements and Granting Interim Access to DoD IS

1.2.3.1 Contractor requests for a NACLC/SSBI type of security investigation are submitted to the federal investigating agency, Office of Personnel Management, via the electronic Questionnaires for Investigations

Processing (eQIP) system. Contractor personnel who do not have an investigation or appropriate level of investigation to obtain access to DoD/DHA IT data, systems or networks shall complete the Standard Force

(SF) 86 in eQIP.

1.2.3.1.1 The Personnel Security Branch (PSB) may grant DHA contractors interim ADP/IT II/CAC access to

DoD IT systems and DoD/DHA data upon confirmation of favorable results from the advance National Agency

Check (NAC), Federal Bureau of Investigation (FBI) fingerprint check and a scheduled/open investigation.

Foreign Nationals or non-U.S. Citizen Contractor employees will not be granted interim access to DoD IT systems and DoD/DHA data.

1.2.4 eQIP Training and Access

1.2.4.1 The Contractor Facility Security Officer (FSO) shall complete eQIP training to access and use eQIP.

1.2.4.2 The Contractor FSO shall complete the eQIP Access User Form for eQIP user accounts to be created.

1.2.4.3 FSO Roles and Responsibilities: The contractor FSO shall:

-Be a U.S. citizen

-Have a favorably adjudicated NACLC investigation or equivalent

-Provide list of applicants to PSB for verification of security eligibility.

-Initiate applicant’s security questionnaire in eQIP.

-Select the appropriate Agency Use Block (AUB) template in eQIP.

-Notify the COR by e-mail that an eQIP request has been initiated and requires their approval.

-Inform applicants to complete security questionnaire in eQIP within 10 calendars days.

-Perform initial review of applications for required information.

-Capture and transmit e-fingerprints to OPM via Secure Web Fingerprint Transmission (SWFT) or mail two

FD258 fingerprint cards to PSB.

-Verify applicant’s citizenship and upload proof of citizenship document to investigation request before releasing case to PSB.

-Serve as the main point of contact (POC) for the applicant.

-Monitor the eQIP request, which includes ensuring the applicant completes the eQIP form in designated time period.

-Cancel or delete an eQIP request on an applicant.

-Act as POC if DoD Central Adjudication Facility (DoD CAF) requires additional information on contractor employees.

1.2.4.4 Joint Personnel Adjudication System (JPAS). Prior to contract performance start date the Contractor shall have an account in the Joint Personnel Adjudication System (JPAS) with a valid Security Management Office

(SMO) profile. The Facility Security Officer (FSO) must set up a profile in the Joint Personnel Adjudicative System

(JPAS) for each Contractor employee. The Facility Security Officer (FSO) must take an “owning” relationship under the contract’s SMO in JPAS for each Contractor employee. The FSO will input the ADP position sensitivity level and complete a visit request, if required, for that employee NLT 24 hours before their arrival. The visit request must be updated for all employees on the contract at the end of the 364-day original request or as needed. If an interim declination or eligibility denial leads to a Statement of Reason (SOR) the Contractor will be responsible for the cost and any processing needed to complete these actions. The Contactor is also responsible for the cost of JPAS processing, JPAS account creation, visit requests, and SMO processing for their contractors. These actions include but are not limited to the Contractor’s file in JPAS showing a closed adjudication of the background investigation and SMO ownership prior to having access to the Government facility or its information systems. The Contactor is also responsible for the cost of JPAS processing so that the Contractor’s file in JPAS shows US Access for Secret when required. While the Contractor is processing their employees in the JPAS or any other clearance system and while the Suitability Determination is being made by the Government, the Government is not responsible for the

Contractor’s time and attendance cost. If a contractor employee reports for work at the facility and does not have the above actions completed they will be returned to the company for processing. Once the full Suitability Adjudication is complete, if the Contractor employee is found unsuitable for any reason they will be returned to their facility.

1.2.4.5 Additional Investigation Processes: Background Investigation Request for ADP/IT I - Contractors requiring an ADP/IT I investigation for their personnel shall have their FSOs coordinate and submit a written request on company letterhead to the DHA COR for endorsement. The request letter shall be signed by, at a minimum, the FSO or another appropriate executive. It shall include a detailed job description which justifies the requirement for the

ADP/IT I. The letter of justification shall be emailed to a company assigned POC in PSB.

1.2.4.6 Reinvestigation Requirements: Contractor personnel in positions designated as ADP/IT I and ADP/IT II have reinvestigation requirements. ADP/IT I positions are critically sensitive and shall be re-investigated every five years.

ADP/ IT II positions are non-critical sensitive and shall be re-investigated every 10 years. The reinvestigation shall be initiated within 60 days of the closing date of the last investigation. The FSO shall track the reinvestigation requirement for Contractor employees and initiate new investigations, as required above. Fingerprints are not required for re-investigations unless specifically requested.

1.2.4.7 Reciprocal Acceptance of Prior Investigation: An investigation is reciprocated when a new Contractor employee has an existing favorably adjudicated investigation that meets the appropriate level of investigation required; and the break in service has been two years or less. The FSO shall verify prior investigation and if valid, provide PSB with a new employee’s name, social security number and date of birth.

1.2.4.8 Requests for Additional Information: PSB may require additional information while the Contractor employee’s investigation is in progress. The FSO will be notified to provide the information by a specified date, or the investigation may be rejected or returned unacceptable. The FSOs shall review applications for required information prior to release, to reduce case rejections and requests for additional information.

1.2.4.9 Notification of Employee Termination and Unfavorable Personnel Security Determination: The FSO shall notify PSB immediately when a Contractor employee is terminated from a DHA contract. E-mail notification shall include the employee’s name and termination date. See additional information in subparagraph 1.6.7.5.13 below regarding unfavorable personnel security determinations.

1.2.4.10 If a Contractor moves a Contractor employee to another one of its DHA contracts, PSB shall be notified immediately.

1.2.4.10.1 PSB will notify FSOs when a contractor employee has received an unfavorable personnel security determination. Upon receipt of a denial letter from PSB, the FSO shall immediately terminate the employee’s access to DoW IT systems, and they shall be removed from the contract. The return receipt letter included with the denial letter from PSB shall be returned to PSB one week after receipt of the letter to show compliance with terminating employee’s access. Upon removal, the Contractor shall be replaced with qualified non-cleared personnel within 14 calendar days. Qualified key personnel and qualified personnel requiring security clearance shall be replaced within

45 calendar days. The Contractor is responsible to meet contract requirements in the interim unless the Contracting

Officer has agreed to a cost adjustment for work that is not performed.

1.2.4.11 Transfers between Contractors: When Contractor employees transfer employment from one DHA contractor to another DHA contractor while their investigation for ADP/IT trustworthiness determination is in process, the scheduled investigation may be applied to the new employing contractor. It shall be the responsibility of the new employer to provide notification to PSB when this type of transfer occurs. The notification shall contain employee’s name and effective date of transfer.

1.2.4.12 Electronic Fingerprint Capture and Submission: Contractors shall submit fingerprints by mailing two fingerprint cards or by using e- fingerprints and transmitting via SWFT as it improves processing time and securely transmits fingerprints.

1.2.4.12.1 The requirements above must be met by contractors and subcontractors who have access to DoW IS containing information protected by the Privacy Act of 1974 and Protected Health Information (PHl) under

HIPAA. The required investigation must be completed and favorably adjudicated prior to authorizing ADP/IT access to DoW systems/networks. Interim approvals are not authorized to non-US citizen contractor employees for access to DoW systems/networks.

1.2.4.13 Notification and Mailing: The contractor shall use the following information to contact the PSB. The contractor shall handle sensitive information according to applicable laws and DoD policies related to privacy and confidentiality. The Contractor shall transmit personally identifiable information or protected health information via encrypted e-mail or the OPM secure portal.

Mailing Address:

Defense Health Agency

ATTN: Personnel Security Branch 7700 Arlington Blvd., Suite 5101

Falls Church, VA 22042-5101 eQIP Helpdesk: (703) 681-2286

E-mail address: in accordance with government procedures

1.2.5 Processing for a CAC

1.2.5.1 The Common Access Card (CAC) is the standard identification for Service members, DoW civilian employees, and eligible DoW contractor personnel. It is the principal card used to enable both physical access to a DoW facility and access, via logon, to DoW networks on-site or remotely. Access to the DoW network requires the use of a computer with Government-controlled configuration or use of a DoW-approved remote access procedure in accordance with the Defense Information System Agency Security Technical

Implementation Guide.

1.2.5.2 Trust Associated Sponsorship System (TASS) is a web-based system that allows eligible DoW contractors to apply for a CAC through the internet. Government sponsors (also known as Trusted Agent) approve the application to receive government credentials.

1.2.5.3 Roles and Responsibilities

1.2.5.3.1 The contractor FSO shall:

-Identify contractor support personnel who require a CAC for accessing DoW networks and facilities.

-Verify the applicant’s background investigation

-Complete Defense Health Agency (DHA) Form 33, Sections I and III on the applicant’s behalf for an initial or renewal CAC.

-Submit the form to the COR for approval.

-Fax (703-681-5207) or email (dhatass@dha.mil) the completed DHA Form 33 to TASS / Common Access Card

Branch (CACB).

-Coordinate with the Trusted Agent (TA), DEERS record updates (Name, SSN, DOB etc.)

-Set up an out-processing procedure to collect the CAC when an applicant is terminated from the company or when the CAC is no longer required.

-Notify the TA or TASS/CACB to revoke the applicant’s CAC.

-Return CACs to the TA or Defense Health Agency (ATTN: Personnel Security Branch/TASS-CACB), or the nearest Real-Time Automated Personnel Identification Systems (RAPIDS) facility) and follow up via email in accordance with government procedures, providing the name(s) of the CAC(s) that were submitted to the facility.

1.2.5.4 CAC Guidelines and Restrictions

1.2.5.4.1 Any person willfully altering, damaging, lending, counterfeiting, or using these cards in any unauthorized manner is subject to fine or imprisonment or both, as prescribed in sections 499, 506, 509, 701, and

1001 of title 18, United States Code (U.S.C.). Section 701 prohibits photographing or otherwise reproducing or possessing DoW ID cards in an unauthorized manner, under penalty of fine or imprisonment or both.

Unauthorized or fraudulent use of ID cards would exist if bearers used the card to obtain benefits and privileges to which they are not entitled. Examples of authorized photocopying include photocopying of DoW ID cards to facilitate medical care processing, check cashing, voting, tax matters, compliance with appendix 501 of title 50, U.S.C. (also known as “The Service member’s Civil Relief Act”), or administering other military-related benefits to eligible beneficiaries. When possible, the ID card will be electronically authenticated in lieu of photographing the card.

1.2.5.4.2 ID cards shall not be amended, modified, or overprinted by any means. No stickers or other adhesive materials are to be placed on either side of an ID card. Holes shall not be punched into ID cards, except when a

CAC has been requested by the next of kin for an individual who has perished in the line of duty. A CAC provided to next of kin shall have the status of the card revoked in DEERS, have the certificates revoked, and have a hole punched through the integrated circuit chip before it is released to the next of kin.

1.2.5.4.3 Access: The granting of access is determined by the contractor or system owner as prescribed by the

DoD.

1.2.5.4.4 Accountability: CAC holders shall always maintain accountability of their CAC while affiliated with the

DoD.

1.2.5.4.5 Multiple Cards: In instances where an individual has been issued more than one ID card (e.g., an individual that is eligible for an ID card as both a Reservist and as a contractor employee), only the ID card that most accurately depicts the capacity in which the individual is affiliated with the DoD should be utilized at any given time.

1.2.5.4.6 Renewal and Reissuance: The applicant for CAC renewal or reissuance shall be required to surrender the current CAC card that is up for renewal. A CAC card holder may apply for renewal 30 days prior to the expiration date of a valid CAC.

1.2.5.4.7 Replacement: The applicant shall provide a letter from the local security office confirming the CAC has been reported lost, stolen, confiscated or destroyed, and a valid (unexpired) State or Federal Government-issued picture ID.

1.2.5.4.8 Transfers between Contractors: The contractor is authorized to retain the CAC when transferring employment from one DHA contractor to another. It shall be the responsibility of the new employer to provide notification to PSB/TASS when this type of transfer occurs. The notification shall contain employee’s name; new contract number and effective date of transfer.

1.2.5.4.9 Retrieval: The CAC is property of the U.S. Government and shall be retrieved and returned to

TASS/CACB when the card has expired, or it is damaged or compromised, or when the applicant is no longer affiliated with the DoW contractor or no longer meets the eligibility requirements for the card, or upon demand of the Contracting Officer, COR, or other properly authorized Government official.

Defense Health Agency

Mission Assurance Division

Personnel Security Branch

ATTN: TASS/CACB

7700 Arlington Blvd, Suite 5101

Falls Church, VA 22042-5101

TASS/CACB: (703) 681-6777

E-mail address: dha.ncr.security.mbx.personnel-security-tass@health.mil

1.2.5.4.10 Personal Identification Number (PIN) Resets: Should an individual’s CAC become locked after attempting three times to access it, the PIN will have to be reset at a RAPIDS facility.

1.2.5.4.11 Contractors shall ensure that CACs are only used by the individual to whom the CAC was issued.

Individuals must protect their PIN and not allow it to be discovered or allow the use of their CAC by anyone other than him/herself. Contractors are required to ensure access to DoD systems applications and data is only provided to individuals who have been issued a CAC and whose CAC has been validated by the desktop middleware, including use of a card reader. Sharing of CACs, PINs, and other access codes is expressly prohibited.

1.2.6 Special Qualifications

1.2.6.1 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal mailto:dha.ncr.security.mbx.personnel-security-tass@health.mil

Acquisition Regulation Subpart 42.5. The contracting officer, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.2.6.2 Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the

Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the

Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.2.6.3 Key Personnel: The following personnel are considered key personnel by the government:

Program Manager/Task Manager

System Engineer/Information Systems Security Engineer (ISSE)

System Administrator

Information Assurance/Cybersecurity

Database Specialist

Integrator

The contractor shall provide a program manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 0700 – 1800, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

1.2.6.3.1 Qualifications for all key personnel are listed below:

Reserved.

1.2.6.3.2 Substitutions of proposed Key Personnel shall not be allowed for a period of six months after award, except under extreme circumstances. Any substitution or replacement Key Personnel shall have qualifications equal to or greater than the individuals proposed. For temporary and/or permanent replacement of Key Personnel, the

Contractor shall provide a resume for all personnel to the COR. Resumes shall be provided one month (or as mutually agreed upon) prior to making any personnel changes. The Government reserves the right to pre-approve any replacement or substitution of Key Personnel. Contractor personnel must submit necessary information to be issued a clearance prior to reporting for performance.

1.2.6.4 Proper Identification of Contractor Employees:

1.2.6.4.1 Contractors, including subcontractors at all tiers, shall provide for a clear distinction from Government personnel. Contractor employees shall not act, advertise, or presume to be Government employees, agents, or representatives. Contractor employees are required to appropriately identify themselves as contractor employees at all times, including in telephone conversations, formal and informal written correspondence, paper and electronic, and in any other situation where their actions could be construed as acts of Government officials, unless, in the judgment of the Government, no harm can come from failing to identify themselves. Contractor employees shall be introduced as contractor personnel and always display distinguishing visible identification whether in conversations, meetings, or other forms of communication with Government personnel.

1.2.6.4.2 Contractor personnel, while performing in a contractor capacity, shall refrain from using their retired or reserve component military rank or title in written or verbal communications associated with the contracts for which they provide services.

1.2.6.4.3 The Contractor shall incorporate the substance of this requirement in all Subcontracts awarded under this contract.

1.2.6.5 Contractor Travel:

Performance under this PWS may require the Contractor to travel, Continental United States (CONUS) and within the National Capitol Region (NCR) to attend meetings, conferences, and training. The Government shall reimburse the Contractor for travel expenses subject to the current Federal Acquisition Regulation (FAR) and

Joint Travel Regulation (JTR). All Contractor travel shall be coordinated with and approved by the COR prior to incurring any travel expenses. The Contractor shall identify personnel who will be traveling in sufficient time to obtain the lowest possible rates for airfare, rental car, and lodging. For long-distance travel, a minimum of 5 business days advance notice from the travel commencement date is required. The travel request shall be in writing (email) and contain the name of the Contractor, reason for travel, dates, location, and estimated travel costs. Contractor invoices (along with associated receipts) shall support all travel reimbursement requests. Actual travel costs shall be reported to the COR by person, by trip, within 5 business days of completion of travel. The

Government shall not reimburse local travel and related expenses to the Contractor for daily travel to or from work (place of performance).

1.2.6.6 Other Direct Costs (ODCs): Not Applicable

2.0 OTHER TERMS, CONDITIONS, AND PROVISIONS

2.1 Non-Disclosure Agreement

The Contractor shall ensure that the Non-Disclosure Agreement (Attachment F) (Deliverable 1) is signed by key personnel assigned to or performing on this PWS before performing any work, including all subcontractors and consultants are subject to confidentiality obligations. The Non-Disclosure Agreement shall be cosigned by a corporate official (Contractor Task Manager or higher). The Contractor shall also ensure that all staff understand and adhere to the terms of the non-disclosure statement, protecting the procurement sensitive information of the

Government and the proprietary information of other Contractors. Assignment of staff who have not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor.

2.2 Information Assurance

2.2.1 General Security Requirements

The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all

Government data within Contractor’s control, to ensure the confidentiality, integrity, and availability of

Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow:

2.2.2 Personnel Security

The Contractor shall comply with DOD Instruction 8500.1, “Cybersecurity, DOD Directive 5400.11, “DOD

Privacy Program,” (or updated/replaced policies for Information Assurance, DODM 6025.18-R, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DOD Health Care Programs,” and DOD 5200.02, “Procedures for the DoD Personnel Security Program (PSP).” The Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

- Follow the Privacy Office guidelines for submittal of Automated Data Processor/Information Technology

(ADP/IT) security clearances and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or

ADP/IT-III where their duties meet the criteria of the position sensitivity designations. Contact the Privacy

Office for guidance on the appropriate ADP/IT levels for personnel on the contract.

- Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to MHS Sensitive Information (SI).

- Immediately report to the Privacy Office and deny access to any automated information system (AIS), network, or MHS SI information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available to do so by the appropriate

Government representative for security reasons.

- Ensure that all contractor personnel receive IA training before being granted access to DoW AISs/networks, and/or MHS SI information.

The Contactor shall ensure that all individuals requiring access to sensitive information are processed for access authorization in accordance with DoW personnel security policies. The Contractor shall ensure that all authorized users maintain the appropriate ADP/IT category classification for a position of public trust specific to their role.

The Contractor shall ensure that only individuals who have a valid need-to-know that is demonstrated by assigned official Government duties and who satisfy all personnel security criteria (e.g., IT position sensitivity background investigation requirements outlined in DODM 5200.02) are granted access to information with special protection measures or restricted distribution as established by DHMS.

Specific to DHMS-owned, Contractor-managed systems, the Contractor shall implement a program to ensure that upon arrival and periodically thereafter, all personnel receive training and familiarization to perform their assigned IA responsibilities, to include familiarization with their prescribed roles in all IA-related plans such as incident response, configuration management and COOP or disaster recovery.

2.3 Non-Personal Services

This award identifies services that are strictly non-personal in nature.

2.4 Severable / Non-Severable Services

This award identifies services that are severable in nature.

2.5 Inherently Governmental Functions

This requirement has been reviewed and contains no services that are inherently governmental functions.

2.6 Acquisition Functions Closely Associated with Inherently Governmental Functions

This award identifies acquisition functions that are closely associated with inherently governmental functions as defined in Section 804 of the FY 2005 National Defense Authorizations Act. Appropriate military or civilian personnel of the Department of War cannot reasonably be made available to perform these functions. However, appropriate military or civilian personnel of the Department of War will: (1) oversee Contractor performance of the contract; and (2) perform all inherently governmental functions associated with the functions to be performed under this contract.

2.7 Organizational Conflict of Interest (OCI) Category

The FAR Part 9.5 provides guidance for Contracting Activities with regards to OCI. OCI is characterized by a) biased judgment on the part of the Contractor or b) unfair competitive advantage in procurement. The FAR encourages mitigation of a conflict if at all possible. The Contracting Officer has significant discretion as to the acceptability of any mitigation plan offered. The work to be performed under this requirement has significant potential for OCI.

a. OCI Mitigation Strategy:

Offerors are encouraged to present their best strategy for mitigation of any potential OCI under this requirement. Offerors shall submit a mitigation plan at the Contract level and update it as often as necessary throughout the life of the Contract.

b. Comparative OCI Analysis:

At the contract level, the Contractor shall perform a comparative analysis of the potential new work against all current and previous work performed in any category other than that of the new work being offered. The comparative analysis must be included in the proposal for each contract and must include a statement certifying whether the Contractor believes that its performance of the proposed contract would create a real or apparent OCI. The Contractor shall sign and submit the OCI certification statement. Failure to adhere to this OCI statement may constitute default on the part of the Contractor.

The Contractor shall also obtain a similar certification of OCI status from all subcontractors, team partners or consultants prior to tasking any such party under this contract. The Contractor shall appropriately modify and include this Paragraph, in all consulting agreements and subcontracts of any tier to preserve the rights of the Government.

For breach of any of the above restrictions or for nondisclosure or misrepresentation of any relevant facts required to be disclosed concerning this contract, the Government may terminate this contract, disqualify the Contractor from subsequent related contractual efforts, and pursue any remedies as may be permitted by law or this contract.

3.0 Protection of Information

3.0.1 Public Key Infrastructure Authentication and Encryption

Contractors shall follow the DoW standards, policies, and procedures related to the use of Public Key Infrastructure

(PKI) certificates and biometrics for positive authentication including authentication to DoW private web servers or applications. Where interoperable PKI is required for the exchange of unclassified information, including the encryption of e-mail containing sensitive information, between DoW and its Contractors, industry partners shall obtain all necessary certificates if they are not eligible for a DoW Common Access Card. (refer to https://cyber.mil/pki-pke// and http://www.cac.mil/)

3.1 Access Requirements

3.1.1 Contractor access to HA/DHA Network/DoW Systems

The Contractor will require access to the HA/DHA Network/DoW Systems to perform work under this task.

See Attachment I.

3.2 Data Rights

DFARS 227.7203-3 Early identification of computer software or computer software documentation to be furnished to the Government with restrictions on use, reproduction or disclosure.

(a) Use the provision at 252.227-7017, Identification and Assertion of Use, Release, or Disclosure Restrictions, in all solicitations that include the clause at 252.227-7014, Rights in Noncommercial Computer Software and

Noncommercial Computer Software Documentation. The provision requires offerors to identify any computer software or computer software documentation for which restrictions, other than copyright, on use, modification, reproduction, release, performance, display, or disclosure are asserted and attach the identification and assertion to the offer.

3.3 Contractor Employees

3.3.1 Contractor Identification

The Contractor shall ensure that Contractor personnel identify themselves as Contractors when attending meetings, answering Government telephones, providing any type of written correspondence, or working in situations where their actions could be construed as official Government acts.

3.3.2 Attendance at Meetings

Contractor personnel may be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel make their contractor status known during introductions.

3.3.3 Use of Military Rank by Contractor Personnel

Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in all written or verbal communications associated with the contract under which they provide services.

3.4 Personally Identifiable Information (PII) and Protected Health Information (PHI)

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom http://iase.disa.mil/pki/eca/ http://www.cac.mil/) of Information Act (FOIA), DHA Administrative Instruction-110, and The Health Insurance Privacy and

Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations, and DoW issuances. In general, the Contractor shall comply with the specific requirements set forth in this section and elsewhere in this

Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoW issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where federal regulation and any DoW issuance govern the same subject matter, the

Contractor shall first follow the more specific DoW implementation unless the DoW issuance does not address or is unclear on that matter. DoW issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

• Health Insurance Portability and Accountability Act (HIPAA) Rules means, collectively, the HIPAA

Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human

Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, 78 FR 5566-5702 (January, 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013).

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

• Health Insurance Portability and Accountability Act (HIPAA): The Contractor shall comply with the

Health Insurance Portability and Accountability Act of 1996 (HIPAA) (P.L. 104-191) requirements, as well as the Department of Defense Instruction (DoDI) 6025.18, "Health Insurance Portability and

Accountability Act (HIPAA) Privacy Rule Compliance in DOD Health Care Programs," March 13, 2019.

This includes the Standards for Electronic Transactions, the Standards for Privacy of Individually

Identifiable Health Information and the Security Standards. The Contractor shall also comply with all

Applicable HIPAA-related rules and regulations as they are published and as Government requirements are defined (Including identifiers for providers, employers, health plans, and individuals, and standards for claims Appendix transactions). Any rules and regulations that are published and/or requirements that are defined after the award date of this contract, that require expenditure of additional Contractor resources for compliance may be considered "changes" and will be subject to the changes clause under the contract.

• DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office

Chief is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region

Medical Directorate (NCRMD).

• Breach means actual or…