Attachment B - Statement of Work.docx

Statement of Work- Greater Los Angeles Healthcare System Digital Pathology System

INTRODUCTION

The purpose of this Statement of Work (SOW) is to outline the tasks and responsibilities of the successful offeror in relation to the VISN22, Desert Pacific Healthcare Network for the procurement of a digital pathology system.

1. Background The Pathology and Laboratory Medicine Service within the VISN22 Desert Pacific Healthcare Network is one of the most diversified tertiary health care providers in the VA. It consists with teaching institutions, providing a full range of patient services, with state-of-the art technology as well as education and research. It also boosts one of the largest and most diverse patient populations within the VA system.

Across the Department of Veterans Affairs (VA), Veterans Health Administration (VHA), several facilities have experienced difficulties in maintaining Pathologists on staff in sufficient numbers to effectively keep up with the patient workload. Staff are required to go to the operating room during oncology cases. A scanner can be used to have the pathologist perform the review in their office vs going to the operating room.

2. Scope VISN 22 intends to award a single contract to the lowest priced contractor capable of meeting the requirements and objectives outlined herein for a Telepathology system that can act as a light microscope, the associated installation and configuration services, and the incorporated staff training requirement. This delivery order requirement will consist of software and workstations; hardware such as cameras, slide sorters, and diagnostic monitors; the implementation, testing, and training of the new system at all applicable facilities; and the ability to interface and integrate with the existing systems. Offerors must demonstrate the performance capabilities detailed throughout this document

MINIMUM SYSTEM REQUIREMENTS AND SALIENT CHARACTERISTICS

4. Minimum System Requirements: The items in this section are specific requirements that must be met by this acquisition and are not merely acquisition & performance objectives. The offeror shall provide narrative descriptions of how these requirements will be met.

4.1. Registered with the FDA as a Light Microscope (Medical Device.)

4.2. Live Telemicroscopy with 5 Olympus objectives: 2x, 4x, 10x, 20x and 40x

4.3. 20 slide autoloader allows a remote pathologist access up to 20 slides

4.4. Whole Slide Imaging (RUO) at .5um/pixel (20x) and .25um/pixel (40x) resolution

4.5. 20x/40x batch scanning for 20 slides

4.6. An uninterruptible power supply (UPS) with line conditioner for each instrument provided. (This includes UPS units for sites with automation lines, specimen management systems, data management systems, refrigerated storage, etc,). Each UPS must provide electrical power for a minimum of 15 minutes after electrical power fails and the system must allow for an automatic controlled shutdown to prevent damage to the instrument and data records.

STATEMENT OF WORK AND PERFORMANCE OBJECTIVES

This section details performance objectives that VISN 22 seeks to meet with this contract. Offerors shall provide a statement of work (SOW) with their response that addresses qualitatively and/or quantitatively how they will meet these objectives. VISN 22 desires:

5. Connectivity and Conformance

5.1. If services involve connection of contractor-owned IT devices (such as a laptop computer or remote connection from a contractor system) to the VA network, contractor must have a Memorandum of Understand/Information Security Agreement (MOU/ISA) with the VA or the capability to obtain an MOU/ISA without impacting installation timeframes.

5.2. Any software solutions supplied and installed on VA workstations by the contractor must appear as an approved technology on the most current VA Technical Reference Model (TRM) or must be within 2 lifecycles of the most recent TRM approved version. Or the contractor must have the capability obtain a TRM approval without impacting installation timeframes.

https://www.oit.va.gov/Services/TRM/TRMHomePage.aspx.

5.3. The Contractor supplies responses to required documents in order to add systems to the VA network including but not limited to the VA Form 6550, Access Control List (ACL) Communication Protocol, MSD2, and the Risk Analysis Tool.

5.4. The hardware must meet all VA minimum specifications and the software version must be approved for use on the VA network (Windows 10 and Server 2012/2016).

5.5. Must be capable of connecting to an HL7 interface and must comply with the VHA Lab HL7 Interface Specifications Document.

5.6. The contractor’s performance must be in compliance with all applicable state, federal and local laws and regulations.

6. Support Features

6.1. Service Maintenance / Warranty

6.1.1. The Contractor shall be able to provide equipment repair and preventative maintenance on all primary instrumentation and ancillary equipment within the provided system.

6.1.2. The contractor provides a technical assistance center shall be available by telephone 24 hours per day, 7 days per week with a maximum call back response time of 1 hour.

6.1.3. The contractor will provide remote support when available.

6.1.4. All equipment, including ancillary equipment, repair service shall be provided Monday through Friday from 7:00AM to 4:30PM.

6.1.5. Preventative maintenance will be performed as frequently as published in manufacturer’s operator’s manual and within 2 weeks of the scheduled due date or more frequently based on instruments’ performance.

6.1.6. A malfunction incident report shall be furnished to the Laboratory and BioMed upon completion of each repair call. The report shall include, as a minimum, the following:

6.1.6.1. date and time notified

6.1.6.2. date and time of arrival

6.1.6.3. serial number, type and model number of equipment

6.1.6.4. time spent for repair, and

6.1.6.5. proof of repair that includes documentation of a sample run of quality control verifying acceptable performance.

6.1.6.6. Cause (i.e. user error, part failure, etc…)

6.1.6.7. Each notification for an emergency repair service call shall be treated as a separate and new service call.

7. Training

7.1. The Contractor shall provide an instrument training program that is coordinated with and timely to the equipment installation, sufficient to the size and scope of the facility’s services. Training shall be provided on the operation of the system, data manipulation, and basic trouble shooting and repair. A training program that involves off-site travel shall include the cost of airfare, room and board for each participant.

7.1.1. In addition, operator training shall be provided by Contractor on-site for all operators.

7.1.2. Additional onsite training will be provided 60-90 days after instrumentation’s go live date.

7.1.3. Contractor will provide example policies and procedures such as standard operating procedure templates.

7.2. Upgrade/Updates: The Contractor shall provide updates to both the equipment hardware and software in order to maintain the integrity of the system and the state-of-the-art technology, at no additional charge to the Government. These shall be provided as they become commercially available and at the same time as they are being provided to commercial customers. This requirement only applies to “system updates” that enhance the model of equipment being offered, i.e. new version of software, correction of hardware defect, update offered to commercial customers at no additional charge, upgrade to replace model of equipment no longer Contractor supported, etc. This does not refer to replacing the original piece of equipment provided; however, it does refer to significant changes in the hardware operational capability.

8. Hours of Operation

8.1. Normal tour-of-duty hours is 7:00AM to 4:30PM, Monday through Friday, excluding Federal holidays. However, the service is operating 24/7 and as such there may be instances in which the vendor’s workday may be outside of this period. The vendor is required to coordinate these times with the designated Program Manager.

8.2. In accordance with 5 U.S.C. 6103, Executive Order 11582 and Public Law 94-97 the following national holidays are observed and for the purpose of this contract are defined as “Legal Federal official holidays”

When a holiday falls on a Sunday, the following Monday will be observed as a National Holiday. When a holiday falls on a Saturday, the preceding Friday is observed as a National Holiday by U.S. Government Agencies.

SPECIAL REQUIREMENTS

9. Physical Security and Facility Considerations

9.1. Identification, Parking, Smoking and VA Regulations (For any onsite services):

9.1.1. The Contractor employees and/or Subcontractors approved by the COR shall wear visible identification at all times while on the premises of the facilities within the VISN. Identification shall include but not be limited to a company identification card, which shall include the company name, employee name, title, and a photograph of the employee. Contractor Employees shall maintain a professional appearance commensurate to their industry.

9.1.2. It is the responsibility of the Contractor to park in the appropriate designated parking areas. Information on parking is available from the VA Police Section. The VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

9.1.3. Any interior or exterior doors that shall be unlocked to gain access shall be kept locked during the performance of work unless it results in the creation of a safety hazard. In those instances, the Contractor is responsible to take necessary actions to maintain the same level of security prior to gaining access/performing work. Should any other devices need to be unlocked like an entry gate, those devices shall be locked immediately upon entry or exit. At no time shall the Contractor allow any person into a locked area or loan keys/access cards to another person. Contractor may be held in default for failure to comply with this requirement and subject the Contractor and its employees to contractual and other legal remedies.

9.1.4. Contractor personnel are required to check into the facility Police & Security office at each visit to pick up a “contractor” badge prior to contacting the COR. The Contractor’s staff shall also be required to sign in and out each day at a designated location determined by the COR.

9.1.5. The Contractor agrees that none of its officers or employees shall use or reveal any research, statistical, medical, or security information which may be obtained during the performance of the work or as a result their presence on Government premises without the written consent of the Government

9.1.6. Smoking is prohibited inside any buildings at facilities within VISN 22.

9.1.7. Possession of weapons is prohibited. Enclosed containers, including tool kits, shall be subject to search. Violations of VA regulations may result in citation answerable in the United States (Federal) District Court, not a local district, state, or municipal court.

9.1.8. The Contractor shall not allow his/her employees, including Subcontractors’ employees, to open desk drawers, cabinets, or to use office equipment, including the use of non-pay telephones for any purpose other than a local emergency call. The Contractor shall be responsible to provide all necessary equipment, tools, parts, and materials to perform the work. The Government shall not be obligated to provide any equipment, tools, parts, and materials to assist the Contractor in performing the work.

10. Information Technology Security Requirements

10.1. The Contractor shall identify if removable media is required to perform their duties. The Clinical Engineering Department will ensure the removable media is scanned with anti-virus software running current virus definitions prior to connection to any medical device/system. Any Contractor with patient sensitive information that is imported into the removable media device for any reason shall purge all patient sensitive information prior to departure from the facility.

10.2. Prior to termination or completion of this contract, Contractor/subcontractor shall not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a Contractor/subcontractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met shall be sent to the VA Contracting Officer within 30 days of termination or completion of the contract.

10.3. All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information shall be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the Contractor/subcontractor or any person acting on behalf of the Contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the Contractors/subcontractors that contain VA information shall be returned to the VA for sanitization or destruction or the Contractor/subcontractor shall self-certify that the media has been disposed of per 6500.1 requirements. This shall be completed within 30 days of termination or completion of the contract or disposal or return of the IT equipment, whichever is earlier.

10.4. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information shall not be returned to the Contractor at the end of lease, for trade-in, or other purposes. The options are:

10.4.1. Contractor shall accept the system without the drive;

10.4.2. VA’s initial medical device procurement includes a spare drive which shall be installed in place of the original drive at time of turn-in; or

10.4.3. VA shall reimburse the company for media at a reasonable open market replacement cost at time of purchase.

10.5. Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

10.5.1. The equipment Contractor shall have an existing BAA if the device being traded in has protected health information stored on it and hard drive(s) from the system are being returned physically intact; and

10.5.2. Any fixed hard drive on the device shall be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be pre-approved and described in the purchase order or contract.

10.5.3. A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed. The Information Security Officer (ISO) needs to maintain the documentation.

10.6. See Attachment C - VA Handbook 6500.6, for additional IT terms and conditions that shall apply to this contract.

11. Training

11.1.1. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

11.1.1.1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix D relating to access to VA information and information systems;

Please see Attachment C – VA Handbook 6500.6, Appendix D – Contractor Rules of Behavior.

11.1.1.2. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

11.1.1.3. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

11.1.1.4. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

11.1.2. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

11.1.3. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

12. Security

12.1. Information Security

12.1.1. The vendor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard contract language, conditions laws, and regulations. The vendor’s firewall and web server shall meet or exceed the government minimum requirements for security. All government data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Project Manager and the VBA Headquarters Information Security Officer as soon as possible. The vendor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification accreditation.

12.1.2. The contractor shall follow The Veterans Affair Acquisition Regulation (VAAR) security clause VAAR- 852.273-75 “SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES” sited in section C. Contract Clauses

12.1.2.1. The contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA personnel, regarding information and information system security. These include, but are not limited to, Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130, and guidance and standards, available from the Department of Commerce's National Institute of Standards and Technology (NIST). This also includes the use of common security configurations available from NIST's Web site at: http://checklists.nist.gov

12.1.2.2. To ensure that appropriate security controls are in place, Contractors must follow the procedures set forth in "VA Information and Information System Security/Privacy Requirements for IT Contracts" located at the following Web site: http://www.iprm.oit.va.gov

12.2. Contract Personnel Security

12.2.1. All contractor employees who require access to the Department of Veterans Affairs' computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Security and Investigations Center (07C). The level of background security investigation will be in accordance with VA Directive 0710 dated June 4, 2010 and is available at: http://www.va.gov/pubs/asp/edsdirec.asp (VA Handbook 0710, Appendix A, Tables 1 - 3). Appropriate Background Investigation (BI) forms will be provided upon contract (or task order) award and are to be completed and returned to the VA Security and Investigations Center (07C) within 30 days for processing. Contractors will be notified by 07C when the BI has been completed and adjudicated. These requirements are applicable to all subcontractor personnel requiring the same access. If the security clearance investigation is not completed prior to the start date of the contract, the employee may work on the contract while the security clearance is being processed, but the contractor will be responsible for the actions of those individuals they provide to perform work for the VA. In the event that damage arises from work performed by contractor personnel, under the auspices of the contract, the contractor will be responsible for resources necessary to remedy the incident.