Att.1- SOW Reagents Chem. Immunoassays.docx

Statement of Work (SOW) Cost-per-kit test contract for Chemistry immunoassays testing reagent kits William Beaumont Army Medical Center (WBAMC) September 2025

1.0. GENERAL INFORMATION

Introduction: William Beaumont Army Medical Center is requesting a cost-per-kit contract for the supply of reagents used in chemistry and immunoassay testing and the lease of two chemistry analyzers and two immunoassay analyzers. This contract should include analyzer leases for the following equipment: two chemistry analyzers and two immunoassay analyzers. Additionally, it should provide a modular, continuous customizable laboratory track line, which includes two onboard centrifuges, one capper, one decapper, one resealer, one recapper, one refrigerated storage and retrieval unit, and one input/output module with STAT priority capabilities. Furthermore, the contract should include one deionized water unit

1.1. The desired analyzers must offer a comprehensive laboratory testing menu that is mirrored between both units along with all necessary hardware, middleware, and software. This redundancy is essential to ensure uninterrupted testing, supporting our mission of providing safe, accurate, and rapid laboratory tests. These analyzers must be able to perform the full range of chemistry and immunoassay testing identified in the table 1 below, including cardiac enzymes, HbA1c, and viral tests such as hepatitis all within a single automated platform.

The period of performance is:

Base Period: 1 September 2025- 30 September 2025 Option Year 1: 1 October 2025- 30 September 2026 Option Year 2: 1 October 2026- 30 September 2027

Table 1- Analyzers

Sources Sought Notice: PANHCA-25-P-0000 007494

CUI

25-HYDROXY VITAMIN D

A-1-FETOPROTEIN

ACETAMINOPHEN

ALT

ALBUMIN

ALP

AMIKACIN

AMMONIA

AMPHETAMINES

AMYLASE

AST

BARBITURATES

BENZODIAZEPINES

B-TYPE NATRIURETIC PEPTIDE

BILIRUBIN DIRECT

BILIRUBIN TOTAL

C-REACTIVE PROTEIN

CALCIUM

CANNABINOIDS

CARBON DIOXIDE

CARBAMAZEPINE

CARCINOEMBRYONIC AG

CHLORIDE

CHOLESTEROL

CK-MB

COMPLEMENT C3

COMPLEMENT C4

CORTISOL

COCAINE

CREATINE KINASE

CREATININE

DIGOXIN

ETHANOL

FERRITIN

FOLATE

FOLLICLE STIMULATING

HORMONE

G-GLUTAMYL TRANSFERASE

GENTAMICIN

GLUCOSE

HAPTOGLOBIN

HCG QN

HDL

HEMOGLOBIN A1C

HEPATITIS B CORE AB TO

HEPATITIS B CORE IGM

HEPATITIS B SURFACE AB

HEPATITIS B SURFACE AG

HEPATITIS C AB

HOMOCYSTEINE

INSULIN

IRON

LACTATE

LACTATE DEHYDROGENASE

LDL DIRECT

LIPASE

LITHIUM

LUTEINIZING HORMONE

MAGNESIUM

MICROALBUMIN

MYOGLOBIN

OPIATES

PARATHYROID HORMONE

PHENOBARBITAL

PHENYTOIN

PHOSPHORUS

POTASSIUM

PREALBUMIN

PROCALCITONIN

PROGESTERONE

PROLACTIN

PROSTATE SPECIFIC AG

PROTEIN Ur/CSF

RHEUMATOID FACTOR, QN

SALICYLATES

SODIUM

STREPTOLYSIN O AB

T4 FREE

TESTOSTERONE

THEOPHYLLINE

THYROXINE, TOTAL

TOBRAMYCIN PEAK

TOTAL PROTEIN

TRANSFERRIN

TRIGLYCERIDE

TRIIODOTHYRONINE

TRIIODOTHYRONINE FREE

TROPONIN I CARDIAC

TSH, SENSITIVE

UREA NITROGEN

URIC ACID

VALPROATE

VANCOMYCIN

VITAMIN B12

1.2. Quality Control Plan (QCP) and Quality Assurance (QA):

The Contractor shall provide a Quality Control Plan (QCP) that is Food and Drug Administration acceptance for compliance to the Contracting Officer (KO) and Contracting Officer’s Representative (COR) for acceptance not later than 10 days after the start of the contract. The KO will notify the Contractor of acceptance of required modifications to the plan. The Contractor shall make appropriate modifications and obtain acceptance of the plan by the KO.

1.2.1. The QCP Plan shall include:

A description of the testing reagents full FDA accreditation to perform all the hepatitis blood virus, Hemoglobin A1c, Microinfarction, sepsis, hormone therapy on the current instrumentation as well as all other 109 assay that must be available to support mission requirements for patient care. A description of the inspection system to cover all incidental support and maintenance services for Contractor- owned analyzers/equipment under this contract. Description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title and organizational placement of the inspectors. Additionally, control procedures for any Government provided keys or lock combinations shall be included.

A description of the records to be kept to document inspections and corrective or preventive actions taken. NOTE: The records of inspections shall be kept and made available to the government throughout the contract performance period and for the period after contract completion until final settlement of any claims, if any, under this contract.

1.2.2. Quality Assurance (QA).

The COR will follow the methods of surveillance specified in this contract. Government personnel will record surveillance observations, as needed, and provide to the Contractor. The receipt of the observation does not necessarily constitute concurrence with the observation, only acknowledgement that the Contractor has been made aware of the deficiency. Government surveillance may include observations/tasks not listed in the PRS. Such surveillance will be done according to standard inspection procedures or other contract provisions. Any action taken by the KO as a result of surveillance will be according to the terms of this contract.

1.2.3. Performance Evaluation Meetings

The KO may require the Contractor to meet with the KO and/or COR as deemed necessary.

The Contractor may request a meeting with the KO when the Contractor believes such a meeting is necessary. If required, written minutes of any such meetings shall be recorded in the contract and signed by the Contractor and the KO. If the Contractor does not concur with any portion of the minutes such non-concurrence shall be provided in writing to the KO within 10 calendar days following receipt of the minutes.

1.3. HOURS OF OPERATION:

Normal Hours of Operation. WBAMC is open 24/7.

Holidays. Routine equipment servicing and reagent delivery will not be required on standard federal holidays. If an emergency arises, equipment servicing and reagent delivery will be provided in accordance with 24 to 48 hours after requests.

Legal Holidays. The following legal holidays will be observed by the Government:

New Year’s Day (1 January) Martin Luther King’s Birthday (Third Monday in January) President’s Day (Third Monday in February) Memorial Day (Last Monday in May) Juneteenth National Independence Day (19 June) Independence Day (4 July) Labor Day (First Monday in September) Columbus Day (Second Monday in October) Veteran’s Day (11 November) Thanksgiving Day (Fourth Thursday in November) Christmas Day (25 December)

NOTE: Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above.

2.0. CONSERVATION OF UTILITIES. During maintenance, the Contractor shall make sure employees practice utilities conservation. The Contractor shall be responsible for operating under conditions that prevent the waste of utilities to include:

2.1. Lights shall be used only in areas where work is actually performed.

2.2. Employees shall not adjust mechanical equipment controls for heating, ventilation, and air conditioning systems.

2.3. Water faucets or valves shall be turned off when not in use.

2.4. Environmental and Hazardous Materials Handling. If the disposal of any waste or byproduct of the analyzers cannot be safely dumped into each of the facility’s drain system, the Contractor must provide guidelines for safely disposing these wastes or byproducts in accordance with local and national guidelines.

3.0. RECORDS. The Contractor shall maintain all records necessary to comply with regulatory requirements and Food and Drug Administration (FDA) standards. The Contractor shall be responsible for creating, maintaining, and disposing of only those Government required records that are specifically cited in this SOW. If requested by the Government, the Contractor shall provide the original record or a reproducible copy of any such record within 5 working days of receipt of the request.

3.1. Contractor Personnel. The Contractor employees will be registered with the Symplr© system for WBAMC. Contractors must check in with Symplr© and report to PMO to check in. At no time is the Contractor employee to walk about the WBAMC without an escort. PMO will contact the COR to escort the contractor to the laboratory area.

3.2. Contractor employees will not be admitted to the Department of Pathology without a prior scheduled appointment. No walk-ons will be accepted by the COR.

4.0. DEFINITIONS/ACRONYMS.

4.1. DEFINITIONS. Following is a list of basic definitions.

CONTRACTING OFFICER (KO): The ONLY person with the authority to enter into, administer, change, and/or terminate contracts and make related determinations and findings.

CONTRACTING OFFICER'S REPRESENTATIVE (COR): A government employee selected and designated in writing by the Contracting Officer to act as his/her designated representative in administering a contract. NOTE: The COR is not authorized to make any changes to the terms and conditions of the contract.

QUALITY ASSESSMENT AND IMPROVEMENT. Those actions taken by the Government to check services to determine if they meet the requirements of the CLIA/DoD CLIP ’88 & ’03, CAP, JCAHO, U.S. Army Medical Command and U.S. Navy Bureau of Medicine quality assurance and risk management programs and ensure compliance with the terms and conditions of the contract.

QUALITY CONTROL. Those actions taken by a Contractor to control the performance of services to ensure that they meet the requirements of the contract.

SERVICES: Includes incidental maintenance services and support performed and materials furnished or utilized to maintain the equipment.

QUALITY IMPROVEMENT (QI): Those actions taken by the Government, in accordance with WBAMC DPALS Quality Plan, relevant CSLI standards for quality, AR 40-68, to assure services meet the requirements of the contract.

4.2. ACRONYMS/ABBREVIATIONS. Following is a list of basic acronyms/abbreviations used in the contract.

5.0. GOVERNMENT-FURNISHED FACILITIES, EQUIPMENT, MATERIAL, AND SERVICES. The Government will provide, without additional cost to the Contractor, the facilities, equipment, materials, and services listed below:

5.1. FACILITIES. The government will furnish the facilities for set-up and operation of the Contractor equipment analyzers required in support this contract. The Contractor shall not alter the facilities without written approval of the KO. The Contractor shall return the facilities to the government in the same condition as received, fair wear and tear and approved modifications excepted. These facilities shall be used for performance of this contract only.

5.2. MATERIALS: No materials will be provided.

5.3. SERVICES. The government will provide the following services at no cost to the Contractor.

5.3.1. The government will provide the normal range of facility utilities (e.g. electricity, water, heating, refuse collection, etc.) and other utilities necessary for the full functionality of the equipment/instrumentation.

5.3.2. Security: Police and Fire Protection, as is provided other personnel.

5.3.3. Emergency Healthcare for Contractor employees. The MTF will provide emergency healthcare for injuries or life-threatening medical emergencies occurring while on duty. The Contractor shall reimburse the government for such services as billed by the MTF, unless the Contractor employee is otherwise authorized to receive such services at no cost (e.g., is retired military or is a military dependent).

5.4. NAMETAGS. The Contractor shall furnish a nametag for each contract employee. The nametag shall contain the name of the company and the employee and must be worn at all times when at the government’s facilities.

5.5. Method validation shall be conducted IAW method validation protocols established by the Department of Pathology’s Quality Management Program (these protocols are IAW applicable standards as described by the Clinical Laboratory Standards Institute (CLSI) and/or required by the College of American Pathologists (CAP)). Relevant guidelines listed in Appendix 3 (below) are the minimum guidelines that will be referenced when conducting method validation. Additional guidelines may be required, depending on regulatory requirements.

5.5.1. Method validation shall include, but not be limited to, normal range verification, demonstration of linearity with limit of quantitation verification (LOQ), limit of detection verification (LOD), reportable range, correlation with current methods (comparison of methods study), validation of analytical measurement range (AMR), validation of clinical reportable range (CRR), validation of precision (replication study) and accuracy (recovery study), middleware rule validations, automation validation and establishment of initial control ranges using control materials, to include third party controls, as designated by the Laboratory Director.

5.6. SPECIFIC TASKS

5.6.1. The Contractor shall sequester the required quality control materials and test reagents and ensure that no more than one (1) lot change for QC material and three (3) lot changes for reagents occurs per contract year. The minimum shelf life of the reagents will be three (3) months after the date of delivery. Assays shall be stable enough to maintain a single control run per 24 hours of testing. Calibration shall not be less frequent than once every twenty (20) days under routine operations. This calibration frequency does not include calibrations required following instrument repair or servicing (e.g., field service type maintenance or service, major changed in instrument components that affect readout, QC troubleshooting, etc.) or other instances as described in the Laboratory QA Program or approved by the Laboratory Director.

5.6.2. All reagents/reagent packs, calibrators/standards, and quality control materials provided shall be identified to those used in the FDA 510K approval application. All reagents/reagent packs calibrators/standards, and quality control materials shall be provided as follows:

5.6.2.1. Be provided by the manufacturer of the equipment

5.6.2.2. Be marked with the required storage temperature.

5.6.2.3. Be maintained at the proper storage temperature during transportation from the Contractor’s storage facility to the government acceptance site and be delivered on time at the appropriate storage temperature. Any supplies received out of temperature will not be accepted. These will be sequestered, and the Contractor will be contacted to replace before any payment is made on supplies. Payment will not be made for any supplies received outside of temperature requirements.

5.6.2.4. The Contractor shall provide the reagents/reagent packs, calibrators/standards, quality control materials, user-replaceable maintenance items, and analyzer specific tools as outlined in the Schedule of Supplies/Services.

5.7. DELIVERIES

5.7.1. No drop shipments will be accepted. Deliveries and orders will be on an as-needed basis by the COR or Alternate Contracting Officer Representative (ACOR) as identified in the contract.

5.7.2. Orders shall arrive within one week of requested date of delivery. Temperature sensitive items will be shipped as overnight at no additional cost to the government to ensure reagent stability. If overnight cannot be accommodated, then temperature transit/storage requirements halls still be meet for these reagents to be accepted.

5.7.3. Any supplies that are placed on back order shall be clearly identified on the shipping documents and shall be delivered in a timely manner, not to exceed ten (10) working days. In the instance a backorder exceeds 10 working days, the COR will document Contractor’s inability to meet demands of the contract in the monthly COR report.

5.7.4. Emergency orders shall be delivered within 24 hours after the order is placed and be of the same lot number of calibrators/standards, reagents/reagent packs, or quality control materials currently in use for the assay(s) for which supplies are being requested.

5.7.5. Deliveries for WBAMC.

Preservation and packing – Preservations and packing shall be performed IAW the beast commercial practices and in such a manner to afford adequate protections against any damage during shipment from the source destination. All packaging and shipping information shall be clearly marked as to contents on both the shipping documents and the shipping container/box. All deliveries shall be made Tuesday through Thursday, to exclude federal holidays.

5.8. BILLING/INVOICE AND PAYMENTS.

5.8.1. The Contractor shall provide a reagent/test list with each fixed price for the appropriate test upon award of the contract to the COR. This will be the firm, fixed price for the entire term of the contract to include option years.

5.8.2. The Contractor shall invoice in WAWF within 30 days of receiving the billing statement.

5.8.3. The Contractor shall attach an itemized invoicing, breaking down into each individual test type, in WAWF for proper review of fixed test pricing in order for invoices to be paid.

5.8.4. The Contractor shall have an inventory monitoring system in place for each individual test.

5.8.5. If the Contractor is aware that the workload is exceeded for an individual CLIN or item, the Contractor shall not ship and shall contact the COR about the rejected processing .General Use and Disclosure Provisions Except as otherwise limited in this Clause, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the HIPAA Privacy Rule, the HIPAA Security Rule, DoD 6025.18-R or DoD 8580.02-R if done by the Government.

5.8.6. Specific Use and Disclosure Provisions

(a) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(b) Except as otherwise limited in this Clause, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(c) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

(d) Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1)1 Obligations of the Government Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

5.9. SERVICE:

5.9.1. The Contractor shall provide direct customer service and support, 24 hours/7 days a week, to include hotline telephone service (provided in English) and on-call emergency repair service support, to assist operators in correcting equipment operation problems. The analyzer must be operational for 24/7 support for patient support minus Calibration/QC timeframe.

5.9.2. The Contractor shall perform Preventive Maintenance Services (PMS), safety tests, calibrations, and unscheduled repair services in accordance with procedures and practices prescribed by the manufacturer of the equipment.

5.9.3. The Contractor shall provide a full unscheduled and PMS throughout the contract. PMS shall be at no additional cost to the Government inclusive of all costs for the performance of scheduled periodic maintenance (as required by the Contractor’s instrument maintenance manuals), unscheduled maintenance and repair of the analyzers and any associated equipment provided by the Contractor as part of the analyzer system, including replacement parts, replacement part shipment costs, and service technician travel costs for performance of maintenance services.

5.9.4. Scheduled routine services shall be performed between 0730-1630 Monday-Friday, excluding Federal Holidays.

5.9.5. The Contractor’s qualified service technician shall be on site to provide routine services; service requiring immediate repair; and one (1), two (2) or four (4) scheduled services for preventive maintenance (as specified in the Contractor’s instrument maintenance manual), safety and calibration as required by this statement of work. The equipment shall be repaired and operational within 48 hours after initial response by the Contractor.

5.9.6. Upon analyzer failure, the Contractor’s qualified service engineer shall be on-site to provide unlimited emergency service (service requiring immediate repair; an unscheduled maintenance/service requirement). The Contractor’s qualified service engineer shall establish telephonic contact within 60 minutes of the Government notification to the Contractors Customer Service “Hotline” and shall be on-site to provide unlimited emergency service (service requiring immediate repair) within four (4) hours of establishing telephonic contact. The equipment shall be repaired and operational within 48 hours after initial response by the Contractor.

5.9.7. The Contractor shall provide all reagents, calibrators, controls and any other materials necessary to troubleshoot the reasons for the analyzer failure at no additional cost.

5.9.8. The Contractor shall replace all reagents, calibrators, controls and any other materials used by the Government to trouble shoot the instrument failure prior to notification of the Contractor.

5.9.9. The Contractor’s qualified service technician shall ensure all repairs are completed and the analyzer is fully operational prior to departing the lab. In addition, the service technician or Customer Service “Hotline” will verify the repairs corrected the problem and the analyzer is operational in a follow-up call. This call will be made in a timely fashion (not to exceed 24 hours) after the service technician departs the lab.

5.9.10. Emergency Services and unscheduled services outside regular working hours, on weekends, and on Federal Holidays shall be listed as a separate line item. Estimated emergency visits per year are six (6).

5.9.11. Should both analyzers become inoperable, the technical repair specialist shall be on-site as within 48 hours.

5.9.12. The repair of at least one (1) analyzer must be completed within eight (8) hours of initial notification. If deemed necessary after consultation with the COR, if at least one analyzer cannot be repaired within eight (8) hours of the initial notification, the Contractor shall arrange the pickup and delivery of critical specimens to a College of American Pathologists accredited clinical laboratory.

5.9.13. During any period when both analyzers are inoperable, the Contractor shall pay all costs associated with the provision of alternative testing, including those for delivery of hardcopy patient results by express courier, directly to the laboratory, for as long as both analyzers remain inoperable.

5.9.14. Hardcopy patient results shall provide all information as required in the Laboratory QA Plan and approved by the Laboratory Director. This information shall include, but not be limited to positive patient identification, laboratory results and the testing laboratory’s reference range for the test being performed.

5.9.15. If the equipment is out of service for longer than 48 hours (from the time-of-service technician’s arrival on site), the Contractor shall notify the Chief, Clinical Engineering Branch and the COR in writing as to the reason(s) (i.e., non- availability of parts, etc.) for non-compliance.

5.9.16. The Contractor shall provide all necessary user-replaceable maintenance items required to support the analyzer and any analyzer specific tools/supplies necessary to perform operator-level periodic maintenance tasks, at no additional cost to the Government.

5.9.17. The Government will make the equipment available to the Contractor for servicing at such time and duration necessary to perform needed repairs.

5.10. TRAINING:

5.10.1. The Contractor shall provide initial on-site operator training to all technicians assigned to the Government site (i.e., WBAMC Department of Pathology Laboratory staff) prior to initiation of use of the analyzer for patient testing. In addition, the Contractor shall provide two training slots per analyzer , per contract year, at the Contractor’s designated training site, prior to delivery and installation of the analyzer at no cost to the government.

5.10.2. The on-site operator training shall be provided by qualified Contractor trained personnel using Contractor- owned instrumentation in a mobile environment. The training shall encompass basic operation, maintenance and troubleshooting.

5.10.3. The Contractor shall provide two training slots per analyzer, per site, per contract year, at the Contractor’s designated training site, at no additional cost (including transportation airfare, rental car, per diem, etc.) to the Government.

5.10.4. The Contractor shall provide on-site training for 8 technicians annually at no additional cost to the Government or individual trainee.

5.10.5. All training manuals/guides, instructional literature, and any other related written/electronic material shall be in the English language. Training shall include basic operation of the analyzers, troubleshooting procedures, performance of operator-level periodic preventive maintenance procedures, and use of the data management/quality control software.

5.11. INFORMATION MANAGEMENT.

5.11.1. The analyzer system must be capable of interfacing with the military hospital computer system, i.e., the Composite Health Care System (CHCS) and MHS Genesis. The Contractor must have an established driver compatible for interfacing the analyzer with the CHCS. The interface between CHCS and the analyzer shall (must) be bi- directional.

5.11.2. The analyzer system shall (must) include a data management system for control of the operation of the analyzer system, management of the quality control program, management of the on-instrument useful life of the reagents/reagent packs, and management of patient results; and a printer for the production of hard copy patient reports and other reports generated via the analyzers’ data management system. The Data Management system shall have a comprehensive, fully- integrated Quality Control (QC) software module that stores and evaluates quality control results. Results can be viewed in a variety of formats including Levy-Jennings charts, moving patient averages, and statistical summaries. The application shall validate QC results by checking them against user selected rules and automatically alert the operator when a rule violation has occurred.

5.11.3. The QC software shall have a large capacity to store graphics and results, cumulative patient reports and quality control files with statistics - all available to user.

5.11.4. The QC software shall provide the capability to write user defined Westgard QC Rules. In addition, it shall allow viewing and maintaining of QC data across multiple levels and lots for analyzers, provide a mechanism to maintain an action log of comments from QC review, provide real-time access to QC charts, graphs (Levy-Jennings) and provide the ability to add comments, and eliminate data point(s) from statistics. The QC software shall (must) include the ability to apply Westgard quality control result decision rules in real-time, with the ability of the user to individually select the rules to be applied.

5.11.5. Remote diagnostics and troubleshooting shall be available using a maintenance application program that allows technical and service specialists at the Contractors technical support center or a field representative to remotely access the instruments to diagnose a problem.

6.0. INFORMATION SECURITY

6.1. TELECOMMUNICATION

6.1.1. All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software must be approved through the DHA Software and Application Certification Assessment. Submission of DHA Application Request Worksheet must be completed within the six (6) months of contract award.

6.1.2. The Contractor shall follow Army Regulation 25-1, “Army Knowledge Management and Information Technology, AR 25-2, “Cybersecurity,” and DoD 6025.18-R, DoD Health Information Privacy Regulation.

6.1.3. IAW contract requirements, Contractor shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

6.1.4. The Contractor shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies and will provide, maintain and configure VPN concentrator that complies with DoD security standards.

6.1.5. All costs for VPN hardware and software shall be incurred by the Contractor.

6.1.6. The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chief Information Officer.

6.1.7. The Contractor shall validate that systems authenticate users through the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the contractor's technical users will maintain secure logon.

6.2. DEPARTMENT OF RISK MANAGEMENT FRAMEWORK (RMF) IMPLEMENTATION PLAN

6.2.1. The Contractor shall provide information for the Risk Assessment Analysis to the government for all networking IT applicability.

6.2.2. Contractors shall only offer equipment which already have an Authorization to Operate (ATO).

6.2.3. Contractor shall deliver instruments within 60 calendar days after award for instrument validation

6.2.4. Any offered system shall meet DoD Cybersecurity/Risk Management Framework (RMF) and the attached Service Information Assurance (IA) requirements. Contractors are required to provide a statement with their quote that they agree to the Service Cybersecurity/IA Requirements, HIPAA requirements and B2B requirements that are attached to this RFO. Relocation or movement of equipment will not be done without permission of the COR and the Contractor is responsible for replacing the equipment and meeting the standard of conduct of the contract.

6.2.5. Contractors shall provide a completed Joint Medical Device Risk Assessment Questionnaire (v1.1) for the offered system along with their offer. These should be provided by DHA Cyber Logistics or local IMD.

6.2.6. Contractors shall meet all the below RMF minimum requirements along with any additional RMF requirements listed/attached to the RFO.

6.2.7. Submitting a quote for any requirement under this initiative constitutes full agreement to all specific Service IA requirements.

6.2.8. Failure to agree to the attached Service IA requirements and to provide a completed Joint Medical Device Risk Assessment Questionnaire shall result in rejection of the contractor’s quote. Failing to disclose that a system cannot meet IA requirements, failure to meet certification timeframes or failure to receive/maintain ATO may result in termination for cause in accordance with FAR 52.212-4(m). Contractor must stay current with ATO annually and cannot allow it to lapse.

6.3. ESTABLISHING INTERFACE:

6.3.1. The system shall bi-directionally interface with the Composite Health Care System (CHCS), Military Healthcare System (MHS) Genesis and the laboratory information system (LIS), as specified in the contract.

6.3.2. The system shall have the ability to receive HL7 order messages (ORM) and information from the LIS and provide DICOM Modality Worklist to the modalities.

6.3.3. If the Contractor is not already approved to connect to CHCS bi-directionally, the Contractor shall agree to complete any bi-directional interface integration at no additional cost to the government. Interface integration shall be completed prior to final acceptance of the system.

6.4. SECURITY CLEARANCES

6.4.1. Personnel to be assigned to an Automated Data Processing (ADP)/IT position must undergo a successful security screening before being provided access to DoD information technology resources. Prior to an employee being granted interim access to DoD sensitive information, WBAMC must receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement shall (must) be met by Contractors, subcontractors and other who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under HIPPA. Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees shall (must) have at a minimum an ADP Sensitivity Designation of Level II to access the DoD Network.

6.4.2. All Contractors that use the DoD gateways to access Government systems shall submit a DISA Form 41 or equivalent in accordance with COR guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface. Contractors shall complete and submit to TMA one Form 41 for their organization, attached to which shall be a listing of those individuals for whom background checks have been completed, submitted to the OPM, and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request must clearly delineate the ports and protocols used for each Internet Protocol (IP) address. The Contractor shall complete the form and submit to the Government for final processing.

6.4.3. All costs for the Contractors employee background investigations are the responsibility of the Contractor, unless the investigation is completed by the Government, which would be at no cost to the Contractor.

6.4.4. The terms and conditions of this clause must be completed no later than three (3) months post award.

6.5. BUSINESS TO BUSINESS (B2B) PARTNERS AND 3RD PARTY CONTRACTORS

6.5.1. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

6.6. PERSONNEL SECURITY.

6.6.1. The Contractor shall comply with the following:

· DoD Directive 8500.01, “Cybersecurity

· DoD Directive 5400.11, “DoD Privacy Program”

· DoD 6025.18-R, “DoD Health Information Privacy Regulation”

· DoD 5200.2-R, “Personnel Security Program Requirements”

· Local regulations as deemed appropriate by the Information Assurance Officer

· AR 25-1, “Army Knowledge Management and Information Technology”

· AR 25-2 “Cybersecurity”

· AR 525-13 Antiterrorism

· AR 530-1 Operations Security (OPSEC)

· DOD Instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)

6.6.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

6.6.3. Follow the DoD guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

6.6.4. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility local area network (LAN).

6.6.5. Immediately report to the MTFs Security Office and deny access to any automated information system (AIS), network, or information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for any reason.

6.6.6. Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

6.6.7. AT Level 1 Training. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities, and controlled access areas shall complete AT Level 1 training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR, or to the Contracting Officer, if a COR is not assigned, within 10 days after completion of training by all employees and subcontractor personnel. AT Level 1 Awareness Training is available at the following website: https://atlevel1.dtic.mil/at.

6.6.8. Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractors’ employees shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as direct by DOD, HQDA, and or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

6.6.9. OPSEC Training. Per AR 530-1, Operations Security, new contractor employees must complete Level 1 OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete annual OPSEC awareness training.

6.7. ELECTRONIC SECURITY.

6.7.1. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of WBAMC shall operate in accordance with controlling laws, regulations, DoD, and local policy.

6.7.2. Certification & Accreditation (C&A) requirements apply to all DoD and Contractor’s IS/networks that receive, process, display, store or transmit DoD information. The Contractor shall comply with the C&A process for safeguarding IS. Certification is the determination of the appropriate level of protection required for IS/networks. Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

6.7.3. Accreditation is the formal approval by the Government to operate the Contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections, and with appropriate level of protection for the specified period.

6.7.4. The Contractor shall comply with C&A requirements, as specified by the Government that meet appropriate DoD Information Assurance requirements. The C&A requirements shall be met before the Contractor’s system is authorized to access DoD data or interconnect with any DoD IS/network that receives, processes, stores, displays or transmits DoD data. The Contractor shall ensure the proper Contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

· Attending and supporting C&A meetings with the Government

· Supporting/conducting the vulnerability mitigation process

· Supporting the C&A Team during system security testing

6.7.5. Contractors shall (must) confirm that their networks are locked down prior to initiating testing.

6.7.6. Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

6.7.7. Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

6.7.8. Any re-configuration or change in the system during the C&A testing process shall require a re-base lining of the system and documentation of system changes.

6.7.9. Information Assurance (IA) mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the Government shall be in compliance with all known applicable Department of Defense Computer Emergency Response Team (DoD-CERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

6.7.10. Disposing of Electronic Media. Contractor shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Contractor is required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

6.7.11. Information Assurance Vulnerability Management (IAVM). The Contractor shall implement an information assurance vulnerability management program for all AIS and corresponding subnets that are connected to or intermittently connect to DoD networks. The program shall meet the scope and intent of AR25-2 and WBAMC IA policies to provide protection against known threats and vulnerabilities. Compliance with DoD IAVM alerts and bulleting is required for these systems and shall be completed within the specified timeframe.

6.8. INFORMATION SYSTEMS (IS)/NETWORKS PHYSICAL SECURITY.

6.8.1. The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor shall support a Physical Security Audit performed by the Government of the Contractor's internal information management infrastructure.

6.8.2. The MHS Physical Security Audit Matrix is available at: http://iase.disa.mil/stigs/Pages/vendor-process.aspx.

6.8.3. The Contractor shall correct any deficiencies identified by the Government of the Contractor's physical security posture.

6.9. SPECIAL REQUIREMENTS FOR PROTECTED HEALTH INFORMATION.

6.9.1. Whenever a contract is awarded that requires the contractor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the Contractors shall (must):

· Notify the MTF HIPAA Security Manager.

· Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

6.10. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (June 2012)

6.10.1. In accordance with DoD 6025.18-R “Department of Defense Health Information Privacy Regulation,” January 24, 2003, the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and in DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

6.10.2. Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DoD 6025.18-R or DoD 8580.02-R.

· Individual has the same meaning as the term “individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

· Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

· Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 160.103, limited to the information created or received by the Contractor from or on behalf of the Government pursuant to the Contract.

· Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

· Required by Law has the same meaning as the term “required by law” in 45 CFR 164.103. Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

· Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part 164,

· subpart C.

· Terms used, but not otherwise defined, in this Clause shall have the same meaning as those terms in 45 CFR 160.103, 160.502, 164.103, 164.304, and 164.501.

6.10.3. The Contractor shall not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

6.10.4. The Contractor shall use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Contract.

6.10.5. The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

6.10.6. The Contractor shall, at their own expense, take action to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Clause. These mitigation actions will include as a minimum those listed in the TMA Breach Notification Standard Operating Procedure (SOP), which is available at: http://www.tricare.mil/tma/privacy/breach.aspx.

6.10.7. The Contractor shall report to the Government any security incident involving protected health information of which it becomes aware.

6.10.8. The Contractor shall report to the Government any use or disclosure of the Protected Health Information not provided for by this Contract of which the Contractor becomes aware.

6.10.9. The Contractor shall ensure that any agent, including a subcontractor, to whom provides Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

6.10.10. The Contractor shall ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

6.10.11. The Contractor shall provide access, at the request of the Government, and in the time and manner reasonably designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

6.10.12. The Contractor shall make any amendment(s) to Protected Health Information in a Designated Record Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government, and in the time and manner reasonably designated by the Government.

6.10.13.