Attachment A - Chemistry and Immunoassay Testing SOW 04-06-23.pdf

Statement of Work - Chemistry and Immunoassay Testing

1. General Requirements:

1.1 Description of Work: The Contractor shall provide Chemistry /Immunoassay Testing under a Cost Per Reportable Result (CPRR) agreement to include equipment, reagents, tools, materials, training, and water purification system, Uninterruptable Power Supply (UPS) and services necessary to meet the Chemistry and Immunochemistry testing and analysis requirements for Brooke Army Medical Center, JBSA, Fort Sam Houston, TX and its outlying clinics. The analyzers shall be in four separate locations, one location in the Main Core Lab, one location in Reference Lab, one location in the Emergency Department STAT Lab, each located at Brooke Army Medical Center proper, and one location at the CPT Jennifer M.

Moreno Primary Care Clinic Lab in Fort Sam Houston. Contractor shall include delivery, installation, all calibrators/standards, reagents/reagent packs, and quality control materials necessary to perform the specified assays as well as any application or software licenses necessary to run the testing/analyzer.

Initial Method Validations per CLIA/NCCLS/DPALS QM guidelines, to include method correlation, linearity verification to maximum dilution, precision, carry-over, normal reference range validation, serum/plasma and blood collection tube validation, initially and with each new assay and/or conversion and for trouble-shooting purposes. Validation Study criteria to be established by Director. Vendor to provide review to Director for acceptability and approval of all assays prior to proceeding with Clinical Testing. To include analyzer decontamination when necessary and removal of all instruments at the termination of the contract. The analyzer systems shall provide users with rapid, reliable test results that are critical for patient care. The Contractor shall be responsible for maintenance service, on-site repair and parts as required in order to maintain a minimum 98% uptime for all instrumentation. All testing materials to include reagents, equipment, etc., must be FDA approved platforms. All costs will be calculated on a cost per reportable result based on estimated patient volume and test type listed in Appendix A.

1.2 Chemistry and Immunochemistry Analyzer Equipment – The contractor shall provide a Chemistry and Immunochemistry System that is fully automated capable of linear integration and have discrete random-access capabilities for chemistry, immunometric, potentiometric, and colorimetric assays within the same instrument. The system shall be capable of performing all the required tests and assays listed in Appendix A, pre-analytical processing and sorting, post-analytical storage, and must allow connection of the automation line to the existing hematology system (Sysmex) and coagulation systems. The Chemistry / Immunochemistry analyzer and refrigeration system must be provided by and managed by a single Contractor/manufacturer. The system shall provide triple redundancy (to ensure continuous operations), training, supplies, reagents, unscheduled maintenance, and preventive maintenance for the equipment. Contractor will provide all printers and printer toner or ink for all printers associated with the chemistry analyzer. All equipment displays and supporting literature shall be in the English language. Contractor shall include delivery, installation, all calibrators/standards, reagents/reagent packs, and quality control materials necessary to perform the specified assays, initial Method Validations per CLIA/NCCLS/DPALS QM guidelines and analyzer removal at the termination of the contract.

1.3 For the purposes of these performance requirements, the Chemistry analyzer system includes at a minimum:

- Peripherals (e.g., instrument specific computer terminals and CPUs, printers, toner etc.)

- Uninterruptable Power Sources (UPS)

- Water purification system

- Robotic Automation Systems

- Automated Pre-analytical Processing Systems

- Bidirectional Track

- Automated Post-analytical system

1.4 The total number of analyzers shall be determined by the minimum throughput, available menu requirements, patient acuity, ability to continually operate for 12-hrs without having to stop to load reagents or consumables, and must fit within existing space of 1035.25(ft2)-Main Core Lab, 173.5(ft2)- Reference Lab, 90.5(ft2)-Emergency Department STAT Lab, and 30(ft2)-CPT Jennifer M. Moreno Primary Care Clinic Lab, each allowing for existing benches, half-wall(s), offices, and minimal to no renovations.

Single-day Site evaluation to be provided.

1.5 Minimum actual through-put shall be: 600 tests per hour for immunometric assays, 1600 tests per hour for enzymatic/rate and colorimetric/photometric assays and 2000 tests per hour for ISE assays.

1.6 Each analyzer shall be a random access, discrete analyzer system with STAT interrupt capability and a primary tube sampling system capable of handling 100mm x 16mm, 100mm x 13mm, 75mm x 13mm, 64mm x 10.25 and 46mm x 10mm (microtainer) test tubes with standard or Hemogard caps and screw caps. The analyzer will be capable of accommodating both Becton-Dickinson and Greiner tubes.

1.7 These analyzer systems shall be capable of performing in low, medium, and high-volume work periods to produce results that are accurate and precise.

1.8 Analyzer throughput shall be measured as a function of number of STAT panels (see Table 1) fully completed in 30-minutes.

1.9 The test types and annual estimated volumes for each area are illustrated in the Tables 1 through 5 of Appendix A. Cystatin C is a new test estimated volumes are not known yet and will be determined after one year of testing is complete.

1.10 An explanation and illustration for Performance/Quality Standards for the chemistry/immunoassay analytes are in table 6 of Appendix A.

1.11 The 30-min STAT panel includes the assays listed in Table 1. These assays shall be analyzed from the same specimen with a maximum turn-around-time (automated pre-analytical processing to certification) of 30 minutes.

Table 1 – Assays that must be completed from the same specimen within 30 minutes as a STAT panel

Acetaminophen

Alanine Amino Transferase (ALT)

Albumin

Creatinine Kinase, Total (CK)

Glucose

Ammonia (NH3)

Amylase

Aspartate Amino Transferase (AST)

Bilirubin (Direct/Conjugated)

Bilirubin (Total)

NTproBNP or BNP

Chorionic Gonadotropin (hCG)

Methotrexate

Myoglobin

Potassium

Protein, Total

Salicylate

Calcium (Total) Sodium

Carbon Dioxide (CO2) Theophylline

Chloride Troponin-T or high sensitive Troponin

Creatinine, enzymatic

Digoxin

Parathyroid Hormone

Phenytoin

Phenobarbital

Phosphorous

Procalcitonin

Urea Nitrogen

Magnesium

Lactate

Lipase

Thyroid Stimulating Hormone

Vancomycin

2. Performance Requirements – Automation

2.1 Pre-analytic System

2.1.1 The contractor will provide a fully integrated, bi-directional automation line that has the ability to turn 90 degrees and includes: 1) pre-analytical sample preparation; 2) discrete random access analyzer connections for chemistry and immunochemistry; 3) post-analytical storage; and, 4) connection to existing Hematology (Sysmex) system; 5) as well as identifying which contractor specific equipment or third party vendor’s equipment that can be connected to the automation line for coagulation testing.

2.1.2 The Contractor shall provide a fully automated pre-analytical system that has the ability to centrifuge, de-cap (screw cap, Hemogard cap), aliquot, label aliquot tubes, recap, sort to user definable locations, and workflow management for connected analyzers. The pre-analytical system shall have independently programmable self-balancing centrifuges (rpm and times) and shall be able to provide platelet-poor plasma for coagulation tests and the capability, based on user defined requirements, to centrifuge aliquots a second time for special coagulation tests.

2.1.3 The pre-analytical system shall provide single point of specimen entry for the routine analysis of all required tests, to include but not limited to chemistry, immunochemistry, hematology, coagulation, and urinalysis. There shall be an optional separate specimen point of entry for STAT specimens with STAT Prioritization throughput the workflow from automation through Chemistry/Immunoassay systems. The system shall have ability to perform sample integrity check in pre-analytic process to detect potential problems early on.

2.1.4 The pre-analytical system shall be capable of handling, at minimum, specimen tubes in 100mm x 16mm, 100mm x 13mm, 75mm x 13mm and 64mm x 10.25mm. The ability to process and sort Microtainer sized tubes would also be preferred. Must have ability to de-cap (hemogard/twist off caps) without standardizing to single cap type. Must have ability to recap each tube size stated.

2.1.5 The pre-analytical system shall be capable of aliquoting into user defined tubes (both push cap and screw cap and of varying sizes), labeling based on user defined requirements and sorting to user defined output locations to facility reference or send out testing. The system must have the ability to aliquot to preserve primary sample integrity.

2.1.6 The pre-analytical system shall have a minimum throughput of 1,000 samples per hour.

2.1.7 Secondary/external equipment that is not a component of primary testing, processing, or storage, such as compressors or ventilation systems to drive pre-analytical processes, may not be accommodated due to laboratory space and/or contributory distractors to patient testing/care such as heat and/or noise. Alternate accommodations may require approval from facilities to use spaces outside of the laboratory testing environment. Expenses to accommodate such ancillary equipment are not included in the cost estimates for this contracting action.

2.2 Post Analytical System

2.2.1 Post-analytical storage – The contractor shall provide a post-analytical bi-directional storage refrigeration unit connected to the automation line that can store at least 20,000 specimens at 2-8 degrees C and automatically discard specimens at a user specified time depending on sample type or test. The unit should have the capability of capping tubes of the following dimensions: 100mm x 16mm, 100mm x 13mm, 75mm x 13mm and 64mm x 10.25mm. Ceiling clearance of 18” or more is required and modification of the ceiling height in the Laboratory is not possible.

2.2.2 The post-analytical storage unit shall have the capability to batch specific analytes (e.g. Vitamin D, Hepatitis) and automatically recall all pending specimens upon request and send samples via the automation line to specified analyzer(s).

2.2.3 The post-analytical storage unit shall provide a specimen recall function able to indicate whether the specimen goes to an output location or will be sent via the automation line to the testing analyzer(s) for additional testing. Retrieval times must be short for Stat retrieval of samples.

2.2.4 The post-analytical storage unit shall be always accessible, to include time of power outage.

3. Reagents and Inventory Management

3.1 The analyzer shall have the on-board ability to maintain reagents at the proper storage temperatures for the assays listed in Performance Requirements. On-board stability for chemistry and immunochemistry assays should provide for minimal reagent changes. On-board stability to be evaluated per assay. All assays shall be FDA approved.

3.2 The analyzer shall be capable of maintaining calibration curves for all the assays listed in Performance Requirements simultaneously. Assays must have a minimum calibration stability of greater than 10 days for Chemistry and Immuno-chemistries. Calibration stability to be evaluated per assay.

3.3 The assays listed in Table 2 below shall be approved by the FDA for plasma as well as serum samples. In addition, the Contractor shall clearly demonstrate an acceptable correlation between plasma and serum values during the initial set up and validation studies. Whole blood HbA1c without pretreatment must be available for random access testing. Serum indices required for all testing.

3.4 The contractor shall provide minimum specimen volume requirements. Minimum specimen volume requirements to be evaluated per assay and panel, with and without dead-space requirements.

3.5 The contractor shall sequester the required calibrator, quality control material, and reagents to ensure no more than (2) lot changes per contract year.

3.6 The analyzers provided shall have the capability to add/change out reagents/reagent packs with only a minimal operational interruption/minimal calibration requirements/minimal quality control requirements (i.e., shall allow the user to calibrate any assay, remove the assay reagents/reagent packs for a period of undetermined time, and then reload the reagents/reagent packs during operation to run the assay without the need for recalibration. The analyzer must allow for loading of reagent packs during operation, intermittently and unscheduled.

3.6.1 The analyzer systems shall provide open channels to accommodate third party assays, e.g., Glucose-6-phosphate Dehydrogenase (G6PD). The Contractor shall provide consumables, reagent containers, etc. in sufficient quantities and quality to perform these assays. Volume listed in Table 3 Reference Lab.

3.6.2 The contractor shall deliver reagents no later than one (1) week following request for products/supplies. Standing Order schedules for routine delivery of supplies to be defined by Laboratory with no additional charges for revisions.

3.6.3 The contractor shall provide Inventory Program or System for continuous monitoring and management of all reagents, consumables and necessary supplies and their utilization.

Table 2 - Assays That Must be Approved for Use with Plasma Samples

Acetaminophen

Alanine Amino Transferase (SGPT)

Albumin

Alcohol (Ethanol)

Alkaline Phosphatase

Amylase

Aspartate Amino Transferase (SGOT)

Bilirubin (Direct)

Bilirubin (Total)

Calcium (Total)

Carbamazepine

Carbon Dioxide (CO2)

Chloride

Cholesterol

Cortisol, Total

C-Reactive Protein (CRP)

C-Reactive Protein, High Sensitivity (HS-CRP)

Creatinine

Creatinine Kinase (CK) Total

Creatinine Kinase MB Fraction (CK-MB)

Digoxin

Estradiol fT4

Gentamicin

Glucose

Glutamyl transferase, Gamma (GGT)

Gonadotropin, Chorionic (hCG) BhCG and Intact

High Density Lipoprotein (HDL)

Homocysteine

Iron

Lactate (Lactic Acid)

Lactate (Dehydrogenase) (LDH)

Lipase Magnesium Methotrexate

Myoglobin

NT proBNP or BNP

Phosphorus Inorganic (Phosphate)

Potassium

Procalcitonin

Progesterone

Prolactin

Protein, Total

PTH (must be validated for Intra-operative use)

Salicylate

Sodium

Theophylline

Thyroid Specific Hormone (TSH)

Transferrin

Troponin I or T; High Sensitivity Troponin I or T

Urea Nitrogen

Uric Acid

Vancomycin

The assays listed in Table 3 shall be approved by the FDA for urine samples.

Table 3 – Listing of Assays That Must be Approved for Use with Urine Samples

Amylase

Calcium (Total)

Potassium

Protein, Total

Chloride

Creatinine

Phosphorus Inorganic (Phosphate)

Glucose

Magnesium

Microalbumin (Quantitative)

Sodium

Urea Nitrogen

Uric acid

The assays listed in Table 4 shall be approved by the FDA for CSF and Body Fluid samples.

Table 4 – Listing of Assays That Must be Approved for Use with CSF and Body Fluid Samples

Glucose Protein

Lactate

3.7 Emergency Department STAT Lab, CPT Jennifer M. Moreno Primary Care Clinic Lab

(Mid-Low Patient Testing Volume Analytical Systems)

3.7.1 Chemistry System should have ability to perform >= 300 tests per hour depending on method mix. Provide STAT testing capabilities. Allow for multiple tube sizes on same rack without use of adaptors. Provide clot, liquid level detection. Low specimen carryover with minimal requirements for reagents, calibrations and quality control.

3.7.2 Chemistry Instrument Reagents should allow for transference of Reference Ranges from main core lab to all satellite labs, same specimen types for testing in Main Core lab and all satellite Labs.

Provide ability to program open channels. >=3 ISEs available on-board instrument.

3.7.3 Immunoassay System shall perform 60-100 tests per hour, allow loading of 20-40 patient samples with STAT capabilities.

3.7.4 Immunoassay System Reagents shall allow for transference of Reference Ranges and same specimen types for testing for Main core lab to all satellite labs. Provide Liquid ready to use reagents – that do not require pretreatment. Provide large menu for Immunoassay reagents to be tested.

3.7.5 Reagent assays must have valid biotin tolerance threshold of 30 nanograms per ml or higher.

4. Maintenance and Service

4.1 ANCILLARY MAINTENANCE. The Contractor shall be responsible for furnishing maintenance, services, repairs, and parts as required in order to maintain the systems at all locations at a 98% uptime guaranteed. The Contractor shall provide all reagents, calibrators, controls and any other materials necessary to troubleshoot and remedy the reasons for the analyzer failure or malfunction at no additional cost.

4.2 The Contractor shall provide direct customer service and support, 24 hours/7 days a week, to include hotline telephone service (provided in English) and on-call emergency repair service support, to assist operators in correcting equipment operation and IT issues.

4.3 The Contractor shall provide repair service response within 1 hour and technician arrives within

12 hours after notification for routine/ and 4 hours after emergency failures. The Contractor’s qualified service technician shall be on site to provide routine services; service requiring immediate repair; and scheduled services for preventive maintenance, as specified in the Contractor’s instrument maintenance manual and as determined by Laboratory Director. Performance of Safety checks and calibration included as required by this statement of work. The equipment shall be repaired and operational within

24 hours after initial response by the Contractor.

4.4 Contractor shall provide two (2) paper and two (2) electronic (CD) copies of the Operator’s and

Maintenance manuals and a statement of the warranty terms in the English language per location. The level of detail required of appropriate instrument maintenance manuals extends only to routine maintenance procedures performed by the user. All instrumentation specified is non-Government owned equipment that is provided, serviced, and maintained by the Contractor.

4.5 Contractor shall provide adequate service support for the following areas: decontamination, relocation, installation management, Lab Process consultants for pre and post workflow analysis, IT

Project management for IT implementations and on-going initiatives.

4.6 Periodic Advanced Operator Training/Education must be offered for all levels of staffing (i.e., Manager/Supervisor, Operations-Technical, and Information Systems). The contractor shall provide

PACE accredited continuing education to all personnel on relevant Laboratory related topics at minimum bi-annually on-site or via online courses.

4.7 Contractor must provide access to dedicated Sales Specialist for support with establishing standing order schedules for routine delivery of supplies and for managing stat orders.

5. Training

5.1 The Contractor shall provide training for two (2) primary operators per analyzer at the

Contractor’s training site, prior to delivery and installation of the analyzer and annually thereafter with each option year. The Contractor shall provide initial on-site operator training to all technicians assigned to the Government site (i.e., BAMC Department of Pathology Laboratory Staff) prior to initiation of use of the analyzer for patient testing. On-site analyzer training shall be provided for up to 8 technicians annually at no additional cost to the Government or individual trainee.

5.2 Contractor shall provide Information Technology type training (e.g. Rules Writing) for two (2) operators per year starting with Base Year and annually thereafter with each option year.

5.3 Periodic Advanced Operator Training/Education must be offered for all levels of staffing (i.e.

Manager/Supervisor, Operations-Technical, and Information Systems).

6. Information Technology Management Requirements

6.1 The analyzer system shall be capable of interfacing with the military hospital computer system, i.e., the Military Health System Genesis. The Contractor shall have a driver compatible for interfacing the analyzer with MHS Genesis. The interface between MHS Genesis and the analyzer shall be bi-directional.

The contractor shall identify the contractor specific equipment or third-party vendor’s equipment including hematology and coagulation that is able to connect via driver to IT (Middleware) interface;

vendor to include two (2) third party licenses for additional connectivity.

6.2 The analyzer system shall include a data management system for control of the operation of the analyzer system, management of the quality control program, management of the on-instrument useful life of the reagents/reagent packs, and management of patient results; and a printer for the production of hard copy patient reports and other reports generated via the analyzer system’s data management system. The Data Management system shall have a comprehensive, fully integrated Quality Control (QC) software module that stores and evaluates quality control results. Results can be viewed in a variety of formats including Levy-Jennings charts, moving patient averages, CAP connectivity, EP Evaluator, and statistical summaries. The application shall validate QC results by checking them against user selected rules and automatically alert the operator when a rule violation has occurred. The software program shall have the capability to incorporate Bio-Rad’s online/onboard Quality Control analysis package, Unity

Interlaboratory Program and Unity QC Data Management Solutions.

6.3 Data Management system shall have a user friendly " 64bit Microsoft Windows interface or a web browser based interface. The interface shall include a data management system for operational control of the analyzer system, management of the QC program, on-instrument useful life of the reagents/reagent packs, and management of patient results.

6.4 The software shall provide a single operator interface for workload management, data management, and instrument operational status monitoring. The software controls the operations of the analyzer, monitors the lot number expiration date of on-board reagents and control materials. This shall be accomplished via communication connections between the automation, analyzers, and hospital

Laboratory Information System (LIS).

6.5 Remote diagnostics and troubleshooting shall be available using a maintenance application program that allows technical and service specialists at the Contractors technical support center or a field representative to remotely access the instruments to diagnose a problem. When remote diagnostics not available, vendor shall provide quarterly onsite support and as needed. Quarterly onsite support to consist of 2 days/6 shift minimum or until current IT issue resolved.

6.6 The Contractor will provide a middleware solution and full IT support as defined below at no addition cost to the Government throughout the life of the contract including Consulting and Services required in developing, validating, and implementing features listed below. Middleware capabilities shall include, at a minimum, the following features:

6.6.1 The capability to write user defined auto-verification/auto-result validation rules that can hold transmission of results for review by the user.

6.6.2 The capability to validate user defined auto-verification/result validation rules.

6.6.3 Support patient delta checks as part of the auto-verification process.

6.6.4 Establish Moving Averages (Average of Normals) protocols to identify trends that may affect patient results.

6.6.5 Store patient results for a minimum of 12-months to facilitate auto-verification/auto-result.

6.6.6 Ability to utilize CAP Proficiency Driver for direct connection to College of American Pathology.

6.6.7 Provide patient result management system for statistical analysis to include metrics such as

Time to Result; percent Auto-verification; percent of samples affected by Hemolysis, Lipemia, and

Icterus with ability to drill down to level of blood collector.

6.7 TELECOMMUNICATION - Systems that provide the ability to control instrument software from remote locations are required. All Contractor systems that communicate with Department of Defense

(DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual

Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software must be able to pass MITC testing and review and be awarded a Certificate of Net worthiness

(CoN) shall be submitted to the contracting officer six (6) months of contract award.

6.7.1 The Contractor shall follow Army Regulation 25-1, “Army Knowledge Management and

Information Technology, AR 25-2, “Information Assurance (IA)”, and DoD 6025.18-R, DoD Health

Information Privacy Regulation.

6.7.2 In accordance with contract requirements, Contractors shall connect to the B2B gateway via a

Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

6.7.3 All costs for VPN hardware and software shall be incurred by the Contractor.

6.7.4 The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM

Sensitive Information (SI) as determined by the site Chief Information Officer.

6.7.5 The Contractor shall validate that systems authenticate users through the use of the Common

Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the vendor's technical users will maintain secure logon.

6.8 DEPARTMENT OF DEFENSE INFORMATION ASSURANCE CERTIFICATION AND ACCREDITATION

PROCESS (DIACAP) IMPLEMENTATION PLAN

6.8.1 The Contractor shall provide all required information to support and initiate the DIACAP

Implementation Plan. This shall include the required information for the System Identification profile.

6.8.2 The Contractor shall provide information for the Risk Assessment Analysis to the Government for all networking IT applicability.

6.9 SECURITY CLEARANCES

6.9.1 Personnel to be assigned to an Automated Data Processing (ADP)/IT position shall undergo a successful security screening before being provided access to DoD information technology resources.

Prior to an employee being granted interim access to DoD sensitive information, BAMC shall receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement shall be met by Contractors, subcontractors and other who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under HIPPA. Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees shall have at a minimum an ADP Sensitivity

Designation of Level II to access the DoD Network.

6.9.2 All Contractors that use the DoD gateways to access Government systems shall submit a DISA

Form 41 or equivalent in accordance with COR guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface. Contractors shall complete and submit to TMA one Form 41 for their organization, attached to which shall be a listing of those individuals for whom background checks have been completed, submitted to the OPM, and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request shall clearly delineate the ports and protocols used for each Internet Protocol (IP) address. The

Contractor shall complete the form and submit to the Government for final processing.

6.9.3 All costs for the Contractors employee background investigations are the responsibility of the

Contractor, unless the investigation is completed by the Government, which would be at no cost to the

Contractor.

6.9.4 The terms and conditions of this clause shall be completed no later than three (3) months post award.

7. BUSINESS TO BUSINESS (B2B) PARTNERS AND 3rd PARTY VENDORS

7.1 General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow. Vendors must ensure ability to conform to all standards set forth by Department of Defense Risk Management Framework.

7.1.2 PERSONNEL SECURITY.

7.1.2.1 The Contractor shall comply with the following:

• DoD Directive 8500.1, “Information Assurance (IA)”

• DoD Instruction 8500.2, “Information Assurance (IA) Implementation”

• DoD Directive 5400.11, “DoD Privacy Program”

• DoD 6025.18-R, “DoD Health Information Privacy Regulation”

• DoD 5200.2-R, “Personnel Security Program Requirements”

• Local regulations as deemed appropriate by the Information Assurance Officer

• AR 25-1, “Army Knowledge Management and Information Technology”

• AR 25-2 “Information Assurance”

• AR 525-13 Antiterrorism

• AR 530-1 Operations Security (OPSEC)

7.1.2.2 Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

7.1.2.2.1 Follow the DoD guidelines for submittal of Automated Data Processor/Information Technology

(ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT- III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

7.1.2.2.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility local area network (LAN).

7.1.2.2.3 Immediately report to the MTFs Security Office and deny access to any automated information system (AIS), network, or information if a Contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for any reason.

7.1.2.2.4 Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

7.1.2.3 AT Level 1 Training. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities, and controlled access areas shall complete AT Level 1 training within

30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR, or to the Contracting Officer, if a COR is not assigned, within 10 days after completion of training by all employees and subcontractor personnel. AT Level 1 Awareness Training is available at the following website:

https://atlevel1.dtic.mil/at.

7.1.2.4 Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractor employees shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce shall comply with all personal identity verification requirements as direct by DOD, HQDA, and or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection

Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

7.1.2.5 OPSEC Training. Per AR 530-1, Operations Security, new contractor employees shall complete

Level 1 OPSEC training within 30 calendar days of their reporting for duty. All contractor employees shall complete annual OPSEC awareness training.

7.2. ELECTRONIC SECURITY

7.2.1 Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of BAMC shall operate in accordance with controlling laws, regulations, DoD, and local policy.

7.2.2 Certification & Accreditation (C&A) requirements apply to all DoD and Contractor’s IS/networks that receive, process, display, store or transmit DoD information. The Contractor shall comply with the

C&A process for safeguarding IS. Certification is the determination of the appropriate level of protection required for IS/networks. Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

7.2.3 Accreditation is the formal approval by the Government to operate the Contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections, and with appropriate level of protection for the specified period.

7.2.4 The contractor shall comply with C&A requirements, as specified by the Army that meet appropriate Army Information Assurance requirements. The C&A requirements shall be met before the contractor's system is authorized to access Army data or interconnect with any Army IS/network that receives, processes, stores, displays or transmits Army data. The contractor shall initiate the C&A process by providing the Contracting Officer Representative, within 60 days following contract award, the required documentation necessary to receive an Approval to Operate (ATO). The contractor shall make their IS/networks available for the testing, and initiate the C&A testing four months (120 days) in advance of accessing Army data or interconnecting with Army IS/networks. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

• Attending and supporting C&A meetings with the Government

• Supporting/conducting the vulnerability mitigation process https://atlevel1.dtic.mil/at

• Supporting the C&A Team during system security testing

7.2.5 Contractors shall confirm that their networks are locked down prior to initiating testing.

7.2.5.1 Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement

(SSAA).

7.2.5.2 Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

7.2.6 Any re-configuration or change in the system during the C&A testing process shall require a re-base lining of the system and documentation of system changes. Some changes will necessitate a pause in work depending on the severity and impact of change and determined by the COR in conjunction with the IA representative. Vulnerabilities that have been identified by the Army as “must fix” issues during

C&A process must be mitigated according to the timeline identified by the Army Representative. C&A checklists are provided for complying Army C&A requirements. A request for a waiver to the C&A requirements may be submitted for temporary testing and other unusual circumstances. A waiver request must be submitted, in writing, to the Designated Approving Authority. The request must include mitigation strategies that ensure adequate protection measures and security controls are in place.

7.2.7 Disposing of Electronic Media. Contractor shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance Army Regulation 25-2, “Information Assurance” and Army Best Business Practices (BBP), “Reuse of Computer Hard Drives.”

7.2.8 Information Assurance Vulnerability Management (IAVM). The Contractor shall implement an information assurance vulnerability management program. The Army IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to MEDCOM systems. As part of the program, the contractor shall provide a primary and secondary point of contact for IAVM compliance reporting. The contractor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance to the MEDCOM IA Operations point of contact. Receipt and compliance messages to MEDCOM shall occur within the stipulated window, as stated in the vulnerability message. Guidance regarding the requirement for IAVM is contained in the Army Regulation 25-2, “Information Assurance” and Army

Regulation 25-1, “Army Knowledge Management and Information Technology.” An asset is defined as any hardware devise, such as a router, firewall, server, or an operating system image accessed by more than one user. The MEDCOM IASO list servicer is the primary means to disseminate IAVAs, Information

Assurance Vulnerability Bulletins (IAVBs), and Information Assurance Technical Advisories down to the

System Administrator (SA) and applicable personnel throughout the chain of command. Requests to be added to the IASO list server should be sent to medcom.ia@amedd.army.mil.

7.2.8.1 The contractor shall maintain any development environments in accordance with MEDCOM

Information Assurance (IA) best practices and operational requirements. During product development mailto:medcom.ia@amedd.army.mil for the Army, the contractor shall ensure that all IA mitigation strategies have been applied to the development environment prior to any Army data being loaded onto any assets or software for testing or delivery. IA mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the Army shall be in compliance with all known applicable Army Computer Emergency Response Team (ACERT) Alert, Bulletin, and Technical

Advisory Notices published during the past 36 months.

7.2.8.2 Ports Protocols and Services. Contractors shall follow all current Army standards and requirements for acceptable Ports, Protocols, and Services. Any requests for exception to using the current Army Ports, Protocols, and Services standards requires a request for exception sent through the

Program Manager at the DAA.

7.2.8.3 Public Key Infrastructure and Encryption. Contractors shall follow the Army standards, policies, and procedures related to the use of the Public Key Infrastructure (PKI) certificates and biometrics for positive authentication. Where interoperable PKI is required for the exchange of unclassified information between the Army and its contractors and contractors, industry partners shall obtain all necessary certificates. Contractors must turn over to the Army all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support. The Contractor must provide a written report detailing all of the above, prior to task order expiration regardless of modifications or extensions.

7.3 INFORMATION SYSTEMS (IS)/NETWORKS PHYSICAL SECURITY.

7.3.1 The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor shall support a Physical Security Audit performed by the

Government of the Contractor's internal information management infrastructure.

7.3.2 The MHS Physical Security Audit Matrix is available at:

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls.

7.3.3 The Contractor shall correct any deficiencies identified by the Government of the Contractor's physical security posture. New Army policies will be posted to the following website:

http://www.apd.army.mil.

7.4 SPECIAL REQUIREMENTS FOR PROTECTED HEALTH INFORMATION.

7.4.1 The contractor shall ensure that data which contains PHI is continuously protected from unauthorized access, use, modification, or disclosure. The contractor shall comply with all previously stated requirements for HIPAA, Personnel Security, Electronic Security, and Physical Security.

7.4.2 Notify the MTF HIPAA Security Manager.

7.4.3 Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

http://www.apd.army.mil/

8. PROGRAM MANAGEMENT

8.1 GENERAL. The Contractor shall provide comprehensive Program/Project Management services.

8.2 Program Manager (PM). The Contractor shall provide a dedicated PM, who shall be responsible for the initial instrument implementation, instrument upgrades, implementation of new methods or procedures and optimization of workflow processes and procedures.

8.2.1 The PM, and an alternate who shall act for the Contractor when the PM is absent, shall be designated in writing to the Contracting Officer and Contracting Officer Representative (COR) within 10 days of contract award.

8.2.2 The PM and alternate PM shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract.

8.2.3 The PM and/or alternate shall be actively engaged in all aspects of this SOW.

8.2.4 The Contractor shall provide an Information Technology Project Manager for implementation of the instrument interface and middleware.

8.2.4.1 The IT PM shall have demonstrated working knowledge of Information Security Requirements specific to DoD installations as detailed in Section 6 of this SOW.

8.2.4.2 The IT PM shall have a demonstrated working knowledge and competency in the installation, troubleshooting and development of the instrument interface requirements as they relate to MHS

Genesis.

8.2.5 The PM or alternate PM shall be available during normal duty hours to meet on the installation with Government personnel (designated by the Contracting Officer) to discuss problem areas. After normal duty hours, the manager or alternate shall be available within 48 hours.

8.2.6 The PMs (both PM and IT PM) shall hold current certification as a Project Management

Professional (PMP) through a nationally recognized accrediting agency (e.g. The Project Management

Institute). Certificates shall be provided to the Government upon appointment to this contract.

8.2.7 The PMs shall have a working knowledge of the Government Extension to the PMBOK® (Project

Management Body of Knowledge) Guide-Third Edition, as it applies to the Government sector.

8.2.8 The PM and IT PM shall not have other assigned Sales, Field Services or Technical Service responsibilities.

8.3 Specific instrument layout and selection of pre-analytic, post-analytic and track delivery systems will be determined by a detailed, comprehensive workflow analysis.

8.3.1 The workflow analysis shall be conducted IAW commonly accepted industry standards for maximizing efficiency as outlined in the PMBOK® Guide 3rd Ed, and Lean/Six Sigma principles.

8.3.2 The workflow analysis shall focus on maximizing efficiency, menu and throughput, and minimizing turn- around-times.

9. Administrative Requirements

9.1 Within 10 working days after contract award, Contractor shall coordinate and conduct a post award site visit for the purpose of coordinating schedule for equipment installation. Additionally, the installation of equipment may need to be performed in a phase process at no additional cost to the government.

9.2 The Contractor shall provide safety data sheets (SDS) for each item delivered under this contract considered to be HAZARDOUS MATERIAL by the Government. The SDS shall contain information on the hazards associated with each specific chemical or material. The SDS shall be printed in the English language and shall contain at minimum the following information: identification of specific hazard, the required practice for safe use of the product, first aid procedures, and what to do in the event of a spill or other mishap or accident.

10. Delivery and Installation of Equipment:

10.1 The Analyzers shall (must) be delivered to the location(s) as indicated below and match renovation timeframes as indicated during post-award site-visit. Equipment setup, on-site training, review and set up of initial Method Validations per CLIA/NCCLS/DPALS QM guidelines, to include method correlation, linearity verification to maximum dilution, precision, carry-over, normal reference range validation, serum/plasma and blood collection tube validation, shall be started by

Contractor personnel within 30 days of contract award to ensure that equipment is fully operational within determined timeline. During the initial implementation, a dedicated technical representative must be available onsite throughout the entire implementation period and during go-live. Expected completion of installation and implementation is 90 days. Extensions to be considered and/or granted based on review of detailed implementation plan with Department of Pathology.

10.2 PRIMARY LOCATIONS OF COMPLETE SYSTEMS: System(s) shall be delivered and installed at the four (4) locations listed below:

Brooke Army Medical Center

Department of Pathology and Area Laboratory Services

Core Chemistry Laboratory – 4th Floor

3551 Roger Brooke Drive

Fort Sam Houston, TX 78234

Brooke Army Medical Center Department of Pathology and Area Laboratory Services

Emergency Department STAT Laboratory – 1st Floor

Reference Chemistry Laboratory – 4th Floor

CPT Jennifer M. Moreno Primary Care Clinic

3100 Schofield RD BLDG 1179

The Point of Contact (POC) for all deliveries: SFC Nydia Wickenden, Email:

Nydia.r.wickenden.mil@health.mil.

10.3 Exact installation locations at the primary locations shall be coordinated by the Contractor with the point of contacts listed below. A memorandum on Contractor’s letter head will also be provided to the individual below at the time of installation that includes all serial numbers, names, Government

Contract Number and any additional information identified for each piece of equipment.

DPALS Core Lab NCOIC

Department of Pathology and Area Laboratory Services

Brooke Army Medical Center

Tel: 210-916-4845

10.4 Hours of Operation

10.4.1 Normal Hours of Operation for the Core are Monday through Sunday from 0000 – 2400 Central time. Normal ED laboratory hours are M-F 1100-2230 and excludes holidays. Normal Hours of Operation for Reference Chemistry Laboratory are Monday through Friday 0600-1600 and excludes holidays.

Normal Hours of Operation for the CPT Jennifer M. Moreno Primary Care Clinic are Monday through

Friday 0600-1900 and excludes holidays.

11. Performance Requirements Summary

11.1 The Contractor’s performance will be assessed in accordance with the terms and conditions of the agreement. A summary of the performance requirements to be assessed is illustrated in Table 5.

Table 5: Performance Requirements Summary

Performance Requirement

Performance Standard Performance Requirement Document Reference

Quality Threshold Method of Assessment

1. Contractor shall provide necessary maintenance

Maintain all Chemistry Analyzer, pre & post analytic Equipment at all locations applicable

Performance Requirements par. 1.1

98% uptime for all analyzer equipment at all locations

Continuous monitoring

2. Contractor shall provide necessary repairs to all chemistry analyzer, pre & post analytic equipment at all locations applicable

Maintain all Chemistry Analyzer, pre & post analytic Equipment at all locations applicable

Performance Requirements par. 1.1

98% uptime for all analyzer equipment at all locations

Continuous monitoring

Requirement

Performance Standard Performance Requirement Document Reference

Quality Threshold Method of Assessment

3. Contractor shall provide remote diagnostics and troubleshooting capable of remotely accessing the instruments to diagnose an equipment malfunction or failure

Remote diagnostics is fully operational and capable of providing remote diagnostics and troubleshooting for all instruments.

When remote diagnostics not available, vendor shall provide quarterly onsite support consisting of 2 days and/or 6 shifts and as needed

Performance Requirements par. 6.5 & 6.7

98% based on the number of remotely diagnosed and identifiable instrument failures resulting in a work stoppage

Event Oriented

4. The Contractor shall provide Method Validation for new assays to be conducted in accordance with method validation protocols established by the Department of Pathology’s Quality Management Program

Metho…