Atch D - SOW PIMC MFP Infrastructure Refresh.pdf

11/21/2024

Statement of Work (SOW) Phoenix Indian Medical Center (PIMC) Multifunctional Devices/Copy Centers

Phoenix, Arizona

1. INTRODUCTION:

The Indian Health Services (IHS) Phoenix Indian Medical Center (PIMC) provides direct health care services to over 140,000 patients. Tribal members who receive care at PIMC are often residents of the greater Phoenix area and hail from other Tribes throughout the United States. PIMC also provides specialty care to rural and remote reservation health care facilities in Arizona, Nevada, and Utah. The top five (5) Tribes represented by the PIMC patient population are the Navajo Nation of Arizona, New Mexico and Utah, the Salt River Pima-Maricopa Indian Tribe, the Pascua Yaqui Tribe, the Gila River Pima Maricopa Tribe, and the Tohono O'odham Nation. The Phoenix Indian Medical Center campus is located near the downtown area of Phoenix, Arizona consisting of six (floors), eight (8) Annexes and oversees two-satellite locations - one located in Scottsdale, AZ and the second in Riverside, CA.

2. OBJECTIVE:

PIMC is currently seeking to purchase (64) Ricoh or equal Multifunctional Functional Devices (MFD) and Ricoh or equal Desktop Document Scanners and (6) Ricoh or equal High Volume Production

Scanners or equivalent. MFD’s must have Print, Copy, Scan and Fax, with device management and advance print workflow, maintenance services, Digital Fax Server, Document Signature Routing

Solution, support, and all consumables to support the PIMC campus and Annex buildings. Adopting newer MFDs, scanners and solutions will aide in the increase of production, improve patient business relationship, decrease cost of consumables, reduction in single function desktop printers and the cost of maintaining multiple Personal Print Devices throughout PIMC. Newer technology will provide

Phoenix Indian Medical Center (PIMC) a secured, centralized, print/copy center location in compliance with the Health Insurance Portability and Accountability Act (HIPPA).

3. SCOPE OF WORK:

A. The Indian Health Services (IHS) Phoenix Indian Medical Center (PIMC) in Phoenix, AZ is seeking a contractor to purchase the following Ricoh devices with a delivery and deployment no later than 30 days after the award.

PIMC is currently seeking to purchase (64) Ricoh or equal Multifunctional Functional Devices (MFD) and Ricoh or equal Desktop Document Scanners and (6) Ricoh or equal High Volume Production Scanners and or equivalent devices that meet the specifications and functionality as detailed in this document. MFD’s must have Print, Copy, Scan and Fax, with device management and advance print workflow, maintenance services, Digital Fax Server, Document Signature Routing Solution, support, and all consumables to support the PIMC campus and Annex buildings. However, all substitutions must be stated in the proposal and the new version must be like for like, meaning that an exact newer, model replacement, version of the required specifications may be allowed.

All devices will be purchased under a single contract. The contractor will deliver, stage, configure, deploy and dispose of all packing materials. All Multifunction devices at PIMC must be delivered and deployed no later than 30 days after the award. Adopting newer MFDs will increase production, provide document security for printing and scanning and improve patient business relationships, decrease cost of consumables, and decrease the cost of maintaining multiple Personal Print Devices throughout PIMC. Newer technology will provide Phoenix Indian Medical Center (PIMC), and Annex buildings a secured, centralized, print/copy center location for each department.

All work performed under this solicitation shall be of the highest quality and consistent with best industry practices – to ensure timely provision of services, optimum customer satisfaction and adequate protection of PIMC’s protected information and assets.

All newly acquired MFDs must be PIV enabled and provide a PIV enabled Secure Print Release solution for PIMC print jobs, and other Windows applications. Further requirements of its Secure Print Release solution are provided under the Device Features section. All devices must be Energy Star Compliant.

All newly procured devices and processes must be compliant, as applicable, for the following:

Health Insurance Portability and Accountability Act (HIPAA) compliance Section 508 compliance, Federal Information Processing Standards (FIPS) compliance, Public Key Infrastructure (PKI), Personal Identity Verification (PIV) integration and PIV enabled Secure Print Release that works with Microsoft Windows, VistA and Electronic Health Record jobs.

Contractor shall provide multifunction devices (MFDs), on-site installation, training, maintenance and service (including all repair parts, staples, and toner with the exclusion of paper and other printable media), professional Information Technology (IT) services, and print management services that may be required by PIMC under this Task Order. If work under this contract is subcontracted, the sub-contractor must present to customers as a representative of the prime and any data provided for contract deliverables that includes sub-contractor information must be formatted consistently across the service area to facilitate comparisons.

All devices shall be at a minimum Common Criteria Certified through either Evaluation Assurance Level (EAL) 2 or NIAP Protection Profile for Hardcopy Devices Version 1.0.

All equipment proposed to be supplied by the Contractor under this solicitation shall be newly manufactured – defined as equipment assembled together for the first time – and currently commercially available. Government will not accept reconditioned, remanufactured, renovated or previously used equipment.

Due to the amount of PII and HIPAA information processed through these devices all MFD’s should include a FIPS 140-2 Certified Self Encrypting Hard Drive.

The awarded contractor will be required to remove current Government Owned HP equipment and dispose of it using current industry practices. PIMC will remove all hard drives from Government Owned Equipment.

Contractor must provide a up to date authorized reseller letter from OEM Contractor must provide copies of VPAT to show conformance with 508 on the MF Contractors must provide copies of Common Criteria Certificates for all MFDs

(64) Multi-Functional Devices and Scanners are as follows:

1) Device 1 – Quantity 45

a) Ricoh IMC4500G or Equal - TAA, Common Criteria Certified and 508 Compliant

b) Minimum 45 ppm color print speed

c) Floor standing 11 x 17-inch print capability.

d) Analog Fax Board

e) Power Filter

f) 5- paper sources (1) bypass tray, (4) 500 sheet paper trays for a total minimum of 2,100 sheets onboard paper storage

g) Internal staple finisher

h) Approved PIV Solution for print and scan

i) FIPS 140-2 Certified Self Encrypting Hard Drive

j) All start up supplies

2) Device 2 – Quantity 17

a) Ricoh IM7000 or Equal - TAA, Common Criteria Certified and 508 Compliant

b) Minimum 70 ppm b/w print speed

c) Floor standing 11 x 17-inch print capability.

d) Analog Fax Board

e) Power Filter

f) 2/3-hole punch

g) 4- paper sources (1) bypass tray, (3) paper trays, for a total minimum of 4,000 sheets onboard letter size paper storage

h) External staple finisher

i) Approved PIV Solution for print and scan

j) FIPS 140-2 Certified Self Encrypting Hard Drive

k) 1 of 15 devices will have a minimum of an 8-bin mailbox added to the finisher.

l) All start up supplies

3) Device 3 – Quantity 2

a) Ricoh Pro 8300s or Equal - TAA, Common Criteria Certified and 508 Compliant

b) Minimum 95 ppm b/w print speed

c) Floor standing 11 x 17-inch print capability.

d) Minimum print resolution 2,400 x 4,800 dpi

e) Power Filter

f) 4- paper sources (1) bypass tray, (3) paper trays, for a total minimum of 3,200 sheets onboard letter size paper storage

g) Minimum 220 sheet ADF with single pass color duplex scanning

h) Ability to OCR documents and be able to delete blank pages to help reduce file size and copy paper usage

i) 2/3-hole punch

j) Must have the ability to skip blank pages in print driver to help reduce paper usage

k) External staple finisher

l) Approved PIV Solution for print and scan

m) FIPS 140-2 Certified Self Encrypting Hard Drive

n) All start up supplies

4) Device 4 – Quantity 50

a) Ricoh fi-8190 Scanner or Equal -TAA Compliant,

b) Minimum scan speed 90 ppm/180 ipm

c) Minimum ADF of 100 pages

d) Minimum Daily Duty Cycle of 13,000 pages per minute

e) Must be FADGI capable using minimum upgrade path

f) Ships with 5-year Advance Exchange Warranty, Next Business Day

5) Device 5 – Quantity 6

a) Ricoh Production Scanner fi-8930 or Equal - TAA Compliant,

b) Minimum scan speed 130 ppm/260 ipm

c) Minimum Daily Duty Cycle of 110,000 pages per minute

d) Minimum ADF of 750 pages for large medical records

e) Must be FADGI capable using minimum upgrade path

f) Ships with 5-year Scan care with 3 PM’s and all consumables, training, parts, labor and travel. Next Business Day

6) Time-block PS Services

a) 200 hours during base year to be used for design, updates, and training for support on digital fax and device management solution.

b) 96 hours per year for the option years.

7) Digital Fax Solution

a) 16 channels, HV

b) Encryption

c) Desktop fax licenses

d) Integration

e) Archiving

f) 5 years support

8) DocuSign Enterprise Pro with FedRAMP Envelopes - or Equal

a) 3 Year Base Fixed price

b) 1,500 envelopes per year

c) Enterprise Premier Support with FedRAMP

d) 60 hours per year for custom engagements

e) Years 4 and 5 Optional

The (64) MFD’s will be delivered, configuring network scanning, configure network printing, installing and deployed on-site to the PIMC. This delivery and deployment date shall be on no later than 30 days after the award. Scanners will be delivered in original packing materials and deployed by IHS IT as time permits.

Capabilities for all print devices (1-3) (if not included) Copy Printing Scanning Faxing Duplex Be centrally managed with OEM device management solution

B. Secure Printing

1) The solution shall capture at a centralized queue using a standard print driver all user initiated print jobs from workstations (to include VistA) and allow only the specified user or user group to release the print job from any in-scope MFD device on the network. Queued print jobs will not be held locally at the device.

2) In support of HIPAA compliance, a device shall enable PIV-print release directly from the mainframe to prevent exposure of PHI.

3) The solution shall capture the print job with the necessary user metadata to associate the print job with the authenticated user at the output device.

4) The solution shall support the ability for the user to authenticate at the device with a PIV card to release the held print job.

5) The solution shall be able to be configured where any jobs not retrieved by the user within a set period of time shall be automatically deleted from the secure server.

6) For authentication, the user must be able to authenticate at the device with a domain username/password (Active Directory/LDAP) or PIV card to release the held print job(s).

7) For auditing, the solution must track at a minimum – username, print job name and the date/time stamp for all print jobs.

8) Devices will not show other user’s jobs sitting in the queue. Only the authenticated user’s jobs will be shown as not to present a security vulnerability target.

9) Solution must support print management rules-based routing. Specifically, rules-based logic including at a minimum the enforcement of duplexing, printing in specific toner mode and printing in black and white instead of color. Rules based logic must be systematically applied and controlled by the system administrator or Print Release solution.

C. Scanning Requirements

All devices proposed in this Task Order must have Secure Scanning and support the following capabilities:

1) TWAIN-compliant drivers and device support.

2) The Contractor must provide the ability to scan to user home directories or other personalized destinations to limit Patient Health Information (PHI) exposure.

3) Apart from PIV authentication, routing of documents should not require any additional user identification – such as requiring the user to type in their username or navigating to a folder structure.

4) Will provide the user with a list of frequently selected scan destinations based on authentication.

5) Scan document directly into SharePoint library and enter associated SharePoint indexing values and set SharePoint document permissions at the time of scan.

6) Files scanned to network shared folders should be assigned Windows based ownership policies based on the AD user. User identification should be automatic based on features from the AD profile. Upon delivery of the file to the folder, the system should have the ability to provide a notification to the user that the scan has been successful.

7) Scan conversion to Joint Photographic Experts Group (JPEG), Tag Image File Format (TIFF) and PDF formats.

8) Have network Optical Character Recognition (OCR) capabilities to convert scanned documents to searchable PDF (including PDF/A) or JPEG without the need for specialized user desktop software such as Adobe Acrobat, etc

9) Scans delivered via email, network folders and home directories should have the ability to be

OCR’ed on network servers before arriving to the routing destination, therefore eliminating the need for desktop software.

10) All scanning and faxing activity should be tracked in an ODBC compliant database. Tracked data should include user name, date/time, page count, fax recipient, network destination and all other relevant metadata.

11) Exchange/Active Directory

a) Devices shall be compatible with Microsoft Exchange and compatible with the Messaging

Application Programming Interface (MAPI)/Internet Message Access Protocol (IMAP) Exchange Protocol.

b) Devices shall be capable of Microsoft Active Directory integration for centralized account management using the Lightweight Directory Access Protocol (LDAP).

c) Solution shall be capable of communicating in a Microsoft domain environment using the NTLMv2 protocol (NT LAN Manager) and Kerberos.

12) Image Sizes

a) Scanning should provide the highest level of image compression available while maintaining native compatibility with Microsoft Office 365.

13) Network

a) Traffic will not exit the local area network (LAN).

b) Will support secure encrypted scanning to secure network communications server via secure protocols including HTTPS and/or FTP/S with FIPS 140-2 compliance with automatic logging and audit trail of all file transfers to the network secure scan/fax server.

c) The device shall support network protocols Server Message Block (SMB) and Secure Sockets Layer (SSL).

d) The Simple Network Management Protocol (SNMP Ver 1 and 2), if present, must be capable of being turned off.

e) Solution shall be fully compatible with Transmission Control Protocol/Internet Protocol (TCP/IP) and Domain Name System (DNS).

f) Network line speeds shall be capable of either half or full duplex operating at either 10, 100 or 1000 Mbps.

D. Network Requirements

1) All devices shall be network-ready unless otherwise identified.

2) In recognition of PIMC goals to consolidate, standardize and optimize infrastructure, all device network capabilities will be centrally configured and replicated across all MFDs.

3) The overall solution must include enterprise management software which allows easy administration and configuration by PIMC of all devices in the fleet.

4) Software for device monitoring (administrator dashboard and/or web based) and printer data collection including user information, print analysis, rules-based routing, audit logs and custom reports shall be customizable to include policy print rules, department and workgroup document accounting, user level billing and integration into the PIMC enterprise system.

5) The device workflow shall encrypt data traveling on the network – ensuring that unauthorized viewers do not have access to documents in route to file servers.

E. Device Management Solution

1) Contractor provided fleet management software must have the ability to:

a) Set up, monitor, and manage your fleet of networked and non-networked devices.

b) Receive alerts when consumables are low.

c) Access real-time information to avoid maintenance delays and downtime.

d) Modify and set print settings instantly.

e) Perform batch configuration, clone templates, remote management, PIV management and firmware upgrades.

f) Track usage data and access reports to make more informed decisions.

g) Monitor and maintain STIG compliance before and after an on-premises audit review.

Simply STIG a device creating a STIG configuration and replicating it across the enterprise.

h) Must provide generate the following reports in excel or PDF:

1. Device Reports

2. Consumable Reports

3. Counter Reports

4. Meter Reports

5. Usage Reports

6. Status Reports

7. Green Reports

i) Check and audit status of Data Overwrite Security System (DOSS) and HDD Encryption as well as:

1) Maintain ISO 15408 Common Criteria Compliance Assurance

2) Identify and remediate DOSS disabled devices.

3) Mitigate risks across the fleet.

4) Execute the audit right from the device management solution.

j) The device management solution must have a certificate enrollment service that supports the following:

1) SSL/TLS

2) IEEE 802.1X

3) S/MIME

4) IPsec

5) PDF Digital Signature

6) PDF/A Digital Signature

k) The tools menu must have device specific and certificate specific options to include:

1) Check: Check will trigger CES to confirm if the device still has valid certificates installed. This can be used if a controller board is replaced, and certificates no longer exist. No popup for confirmation will appear as certificates are only installed or renewed if validation fails.

2) Renew: This will force all certificates on the device to be replaced. No validation happens, it just force renews certificates.

3) Revoke: The revoke button is only visible if the certificate configuration, on which this certificate was deployed, supports revocation. Otherwise, this button is greyed out.

2) The device management software shall provide a self-diagnostic, online system which displays operator messages to authorized users for the following at the minimum, but not limited to:

a) Toner is low

b) Paper is out

c) Staples are out

d) Paper jam or paper miss-feed

3) The software shall provide a dashboard view of all networked devices to display real time device status, provide alerts and error coded when a problem occurs on the device and shall allow the ability to submit service requests online.

F. Digital Fax Solution:

The Solution requires that the proposed fax/communication solution meet the following requirements:

1) Turnkey solution – all hardware, software, installation, training, and support included.

2) Unlimited user license for desktop faxing and alert notification.

3) Unlimited MFD connection licenses with no connection charges required.

4) Must support enterprise network fax capabilities and alert notification capabilities.

5) Must be a proven solution deployed at other federal healthcare locations.

6) Requirement is for a total of 16 channels/ports with HA.

7) Incoming faxes can be converted to searchable PDF and routed to a specific user mailbox/email address depending upon incoming fax number.

8) MFDs acquired under this award shall be connected to the Contractor provided digital fax solution.

9) Fax system integration shall permit users to send and receive faxes to and from desktop computers, fax directly from Microsoft Windows applications, receive faxes to Microsoft Exchange/Outlook inboxes, and route faxes to shared network folders.

10) Faxes shall be fully encrypted with complete audit trail and automatic archiving.

11) Fax solution must interface with the current infrastructure of existing IP PBXs and VoIP systems.

12) Support for automatic Active Directory synchronization with communications system.

13) MFDs provided under this award shall permit users to securely scan from any provided

MFD and fax over IP (FoIP) to email addresses, analog or digital fax devices, home folder, and shared folders with email notifications.

14) Digital fax solution shall provide the ability to securely print-to-fax from user’s computer workstation to email addresses, analog or digital fax devices, home folder, and shared folders with email notifications.

15) Must have automatic confirmation and auditing capabilities along with user ability to view history of all faxes sent and received.

16) Inbound faxes received as .tif or .pdf files. PDF variations include standard, text-searchable and/or encrypted.

17) Must have end-to-end encryption for fax data, both in transit and at rest, safeguarding sensitive information from unauthorized access.

18) Ability to send standard or custom cover pages

G. DocuSign Enterprise Pro with FedRAMP Envelopes

a) 3 Year Base Fixed price

b) 1,500 envelopes are "use or lose" over a period of 12 months and cannot be carried over into the next year

c) Enterprise Premier Support with FedRAMP

d) 60 hours of professional services that can be used on an ad hoc basis for product implementation and configuration assistance

e) Years 4 and 5 Optional

H. Support and Maintenance Services:

1) The contractor shall provide 24 x7, 365 days, next business day support for all covered

Multifunction Devices and Consumables.

2) All work performed on-site during normal business hours 8:00 a.m to 4:30 p.m., Monday through Friday, excluding holidays.

3) Repairs provided in accordance with manufacturer’s specifications to ensure continued operation of equipment to include but not limited to diagnostics, providing and installing replacement parts, clearing persistent or severe paper jams and correction cause of error messages.

4) Provide any necessary parts to include parts, toner, maintenance, labor and other associated costs for all copiers.

5) Maintain printers/copiers in accordance with manufacturer’s recommendations using factory-recommended replacement of worn parts includes vacuuming inside as needed.

6) Provide annual scheduled maintenance and periodic maintenance plan for equipment.

7) Provide on-site service calls with qualified technicians within 2-4 working hours after service reported, Business hours 8:00 am to 4:30 pm, Monday through Friday, excluding holidays.

8) Provide installation and training.

9) Provide a service report each time the Contractor accomplishes an inspection, which includes both the Contract Number and the Purchase Order Number.

10) Copies in excess of these amounts included in the service agreement must be billed at the rate accepted by the Government at the time of contract award as incorporated into the contract.

Meter readings and overages should be accomplished and calculated monthly.

11) Contractor shall provide a fixed flat rate service pricing that includes all parts, labor, toner and staples for all multi-function devices. (no overages)

I. Consumable Supplies:

1) Contractor shall provide all supplies and consumables (excluding paper), parts, labor, and maintenance. Provide consumable supplies to include but not limited to toner, staples, waste toner bottles.

2) All parts and supplies must be OEM.

J. Meter Readings:

Provide an approach for tracking number of pages and for providing meter readings.

K. Responsibilities and Tasks:

The awarded Contractor will be fully responsible for, and not limited to – assessing requirements, complete onsite delivery deployment, configuring network scanning, configure network printing, configure Ricoh Secure Print and Scan, configure fax settings, deploying devices to their respective locations, provide support, maintenance services, and provide Ricoh OEM Consumables.

Contractor will also provide training to the Information Technology (I.T.) Support Personnel with configuration and troubleshooting throughout the Phoenix Indian Medical Center campus.

L. Support and Maintenance Services:

The contractor shall provide next business day support for all covered Multifunction Devices.

Consumables shall be received within 72 hours of being ordered. All Consumables (excluding paper) and Parts provided on this contract must be Ricoh branded and/or Ricoh Certified.

M. Training:

The contractor shall provide administrative training for up to 10 Information Technology staff during normal business hours (Monday – Friday, 8am-4:30pm). This training shall encompass configuring each device, configuring Ricoh Access Control Secure Follow Me prints, PIV Card configuration, Digital Fax Training and all aspects of the management, setup and configuration of the devices.

N. Web Requirements:

The contractor shall provide a website that provides 24x7 online searchable knowledgebase, support, and software & drivers. This The contractor will also have a 1-800 number and website that will allow submission of work requests, tracking of work and supply order requests and review of historical work requests.

4. PERIOD OF PERFORMANCE:

Period-of-Performance of the contract shall be for a Base Year with four (4) Option Years. POP date will be re-adjusted based on install date.

5. SITE LOCATION:

Phoenix Indian Medical Center (PIMC) 4212 N. 16th Street Phoenix, AZ 85016-5319

6. ARIZONA STATE TAXES:

The Department of Health and Human Services, Phoenix Indian Medical Center, is Tax Exempt under A.R.S.42-5063(C)(3)(a), A.R.S.42-5067(B)(1), A.R.S.42-5065(B)(2)(a), A.R.S.42-5066(B)(3) (a), A.R.S.42-5074(B)(8), A.R.S.42-5071(B)(2)(a), A.R.S.42-5061(A)(25)(a), and A.R.S.42- 5159(A)(13)(a),(b),(c), State of Arizona Department of Revenue. (Copy of Certificate available upon request).

7. CONTRACTING OFFICER:

The Contracting Officer is the only person with authority to act as the agent of the Government under this contract. Only the Contracting Officer has authority to: (1) Direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the contractor for any costs incurred during the performance of this contract; or (5) otherwise changes any Terms and Conditions of this contract.

The Government my unilaterally change its COR designation.