Attachment B - Statement of Work.docx

Statement of Work – Digital Pathology System Veterans Integrated Service Network 22 (VISN 22)

1. Introduction

The purpose of this Statement of Work (SOW) is to outline the tasks and responsibilities of the successful offeror in relation to the VISN22, Desert Pacific Healthcare Network for the procurement of a digital pathology system.

2. Background

The Pathology and Laboratory Medicine Service within the VISN22 Desert Pacific Healthcare Network is one of the most diversified tertiary health care providers in the VA. It consists with teaching institutions, providing a full range of patient services, with state-of-the art technology as well as education and research. It also boosts one of the largest and most diverse patient populations within the VA system.

Across the Department of Veterans Affairs (VA), Veterans Health Administration (VHA), several facilities have experienced difficulties in maintaining Pathologists on staff in sufficient numbers to effectively keep up with the patient workload. When this happens, slides must be sent to outside providers for reading and diagnosis, which is less efficient, less timely, and less cost-effective than reading within the VA. Sending slides outside the VA also inserts additional risks to patient care, as slides may be lost or damaged in transit. As an alternative to relaying on outside providers, VISN22 will implement a Telepathology systems that can be used for primary diagnosis and for consultation/ confirmation of diagnosis.

3. Scope

VISN 22 intends to award a single Delivery Order to the overall best-value contractor capable of meeting the requirements and objectives outlined herein for a digital pathology system, the associated installation and configuration services, and the incorporated staff training requirement. This delivery order requirement will consist of software and servers; hardware such as cameras, slide sorters, and diagnostic monitors; the implementation, testing, and training of the new system at all applicable facilities; and the ability to interface and integrate with the existing systems. Offerors must demonstrate the performance capabilities detailed throughout this document

The tissue-slide scanners, image analysis software, storage servers, and compatible operating system permits large scale archived collections of histopathology specimens that require an image library for historical archives, remote consultation, and digital preservation of patient specimens that have been referred for outside consultation. These specimens would be irreplaceable if lost. This system will allow VISN 22 to evaluate specimens and generate data from multiple specimens concurrently. Functionality will include whole slide digital scanning, documentation, remote consultation, specialty consultation, and computer assisted digital image analysis. The quality of the product must be suitable for basic surgical and cytopathology functions including, but not limited to the following: primary diagnosis, consultative services; second review for newly diagnosed malignancies; coverage for pathologist absences; quality assurance review, and support for tumor boards. In addition, the system must comply with the Federal Drug Administration (FDA) guidance, Technical Performance Assessment of Digital Pathology Whole Slide Imaging Devices issued April 20, 2016. Finally, specific facilities as detailed in Table 2 will require a slide scanning system that is FDA certified for use in primary diagnosis and the VISN-wide system must facilitate this capability; i.e. a site that does not require an scanner that is FDA certified for use in primary diagnosis must still be able to read a slide for primary diagnosis that was input by a facilities that is using a scanner that is FDA certified for use in primary diagnosis.

4. Minimum System Requirements: The items in this section are specific requirements that must be met by this acquisition and are not merely acquisition & performance objectives. The offeror shall provide narrative descriptions of how these requirements will be met:

Digital Pathology Scanner

4.1. The Telepathology system shall meet FDA requirements outlined in the "'Technical Performance Assessment of Digital Pathology Whole Slide Imaging Devices” issued on April 20, 2016.

4.2. The digital pathology system shall be certified FDA compliant for primary diagnosis.

4.3. A Telepathology system that can at least scan at 40X magnification (0.25 um/pixel).

4.4. A telepathology system that can at minimum 60 slides per hour at 40X magnification.

4.5. Continuous auto focus performed when scanning.

4.6. A system that allows for continuous loading of slides into the digital pathology scanner.

4.7. Fully automated Load and Walkaway functionality.

4.8. A system that provides Integration with viewer software to allow the scanner operator to assign individual cases to one or more local or remote pathologists for viewing.

4.9. The ability for workstation “image preview” by the scanner operator to assess image quality and accurate identifying information before upload to servers for remote access.

4.10. Ability to read barcoded slides and interface with the whole slide manager.

4.11. A barcode read accuracy of 99% or greater.

4.12. Satisfactory system level assessments so each imaged scan with less than a 2% failure rate. The image assessment should at minimum review the following criteria:

4.12.1. Color reproducibility

4.12.2. Spatial resolution

4.12.3. Focusing tests

4.12.4. Whole slide tissue coverage

4.12.5. Stitching error

Image Management System

4.13. Digital pathology images when reviewed through an Image Management System will be iSyntax or an equivalent format that meet medical grade image quality standards with the following features:

4.13.1. Greater than 8-bit dynamic range.

4.13.2. Multiple color channels.

4.13.3. Wavelet based compression.

4.13.4. Speed and web readiness similar to JPEG.

4.14. The ability for all facilities in VISN 22 to read Pathology slides for any site in VISN 22 for either primary diagnosis or consult as needed, even when not hosted on the same image management system.

4.15. The ability to save, review, and display multiple file formats to include JPG, iSyntax, TIFF, or JPEG2000 for upload to electronic health record or other applications.

Image Management System Viewer Software

4.16. The Contractor viewer software shall have tools to manage workflow. At minimum the following tools must be required:

4.16.1. Ability to make image annotations.

4.16.2. Ability to take accurate measurements.

4.16.3. Ability to bookmark slides for quick access for tumor board and panel discussions.

4.17. Image Management Viewer accessible through a web browser

4.18. Work list for each pathologist of their assigned case load that can be sorted by patient name, number of slides per case and tissue type.

Medical Grade Image Display

4.19. The FDA approve Barco Monitor PP27QHD (or equivalent) for IVD use with the minimum specifications:

4.19.1. Resolution 2560x1440

4.19.2. Size 27”

4.19.3. Color 10-bit per color

4.19.4. Contrast 1000:1 or higher

Other Support Items (Support Items)

4.20. An uninterruptible power supply (UPS) with line conditioner for each scanner provided. (This includes UPS units for sites with automation lines, specimen management systems, data management systems, refrigerated storage, etc,) Each UPS must provide electrical power for a minimum of 15 minutes after electrical power fails and the system must allow for an automatic controlled shutdown to prevent damage to the instrument and data records.

Additional System Requirements

4.21. The Contractor shall provide necessary equipment and upgradable digital slide image viewing software that gives VISN22 facilities the ability to scan slides into the digital pathology system and view slide images scanned in by other VINS22 facilities.

4.22. The Contractor shall provide the necessary hardware, pathologist workstations (i.e. monitor), operating systems, driver software, appropriately sized servers and storage, and displays required to operate scanners as well as all necessary cables to connect and power unit components. Operating system software shall be currently sold and supported by its original manufacturer.

4.22.1. Operating systems must meet all VA regulations and specifications and must be the current version approved by OIT and provide operating system upgrades with software life cycle. See Section 7 for additional details of VA and OIT regulations and requirements.

4.22.2. The Contractor shall provide new and latest state-of-the-art equipment and software versions for each of the clinical laboratories at the facilities listed. This hardware and software shall not interfere with operations of the laboratory nor with software systems already in place, including, but not limited to VistA/CPRS and Microsoft Office applications.

4.23. A digital pathology system that can support the yearly slide counts from the VISN22 facilities:

4.24. A system that will support 46 pathologists across the VISN22 sites.

4.25. VistA Integration – Proposed solution will have full HL7 integration with VistA. An interface with a bi-directional connection to VistA for patient demographic information (i.e. patient name, patient identification number, case number) to be transmitted/pulled into the Image Management System.

4.26. All facilities shall be able to scan, upload and share images through shared servers for intra-VISN consultations and diagnoses.

4.27. The software shall permit remote viewing by only VA approved users accessing secure network servers by unique password logging. The software shall not be limited to any proprietary image formats but permit viewing of digital slides generated on other platforms. The vendor will provide software updates and upgrades at no additional charge as needed to correct or improve functionality in accordance with warranty and service agreements.

4.28. The system shall have a means of purging stored scanned images at set intervals unless otherwise marked as “keep” or “save”.

4.29. WAN Connection between facilities cannot exceed 300 Mbps per scanner.

Objectives: This section details criteria that VISN 22 seeks to meet with this contract. Offerors shall provide a statement of work (SOW) with their response that addresses qualitatively and/or quantitatively how they will meet these objectives. VISN 22 desires:

5. Connectivity and Conformance

5.1. Contractor must have a Memorandum of Understand/Information Security Agreement (MOU/ISA) with the VA or the capability to obtain an MOU/ISA without impacting installation timeframes in section 4.

5.1.1. https://vaww.portal2.va.gov/sites/infosecurity/FY15CRISPAudit/CRISPRemediationContract/WorkSite/SitePages/MOU-ISA_Version2.aspx

5.2. Any software solutions supplied and installed on VA workstations by the contractor must appear as an approved technology on the most current VA Technical Reference Model (TRM) or must be within 2 lifecycles of the most recent TRM approved version. Or the contractor must have the capability obtain a TRM approval without impacting installation timeframes in section 4.

5.2.1. https://www.oit.va.gov/Services/TRM/TRMHomePage.aspx.

5.3. The Contractor supplies responses to required documents in order to add systems to the VA network including but not limited to the VA Form 6550, Access Control List (ACL) Communication Protocol, MSD2, and the Risk Analysis Tool.

5.4. The hardware must meet all VA minimum specifications and the software version must be approved for use on the VA network (Windows 10 and Server 2012/2016).

5.5. Must be capable of connecting to an HL7 interface and must comply with the VHA Lab HL7 Interface Specifications Document.

5.6. The contractor’s performance must be in compliance with all applicable state, federal and local laws and regulations.

5.7. VA hosted servers shall be located in VA GLA, VA San Diego, and VA Tucson Healthcare Systems.

6. Support Features

6.1. Service Maintenance / Warranty

6.1.1. The Contractor shall be able to provide equipment repair and preventative maintenance on all primary instrumentation and ancillary equipment within the provided system.

6.1.2. The contractor provides a technical assistance center shall be available by telephone during normal business hours (7:30AM – 5:00PM), Monday through Friday, with a maximum call back response time of 1 hour.

6.1.3. The contractor will provide remote support when available at no additional charge.

6.1.4. All equipment, including ancillary equipment, repair service shall be provided Monday through Friday from 7:00AM to 4:30PM.

6.1.5. Preventative maintenance will be performed as frequently as published in manufacturer’s operator’s manual and within 2 weeks of the scheduled due date or more frequently based on instruments’ performance.

6.1.6. A malfunction incident report shall be furnished to the Laboratory and BioMed upon completion of each repair call. The report shall include, as a minimum, the following:

6.1.6.1. date and time notified

6.1.6.2. date and time of arrival

6.1.6.3. serial number, type and model number of equipment

6.1.6.4. time spent for repair, and

6.1.6.5. proof of repair that includes documentation of a sample run of quality control verifying acceptable performance.

6.1.6.6. Cause (i.e. user error, part failure, etc…)

6.1.6.7. Each notification for an emergency repair service call shall be treated as a separate and new service call.

7. Training

7.1. The Contractor shall provide an instrument training program that is coordinated with and timely to the equipment installation, sufficient to the size and scope of the facility’s services. Training shall be provided on the operation of the system, data manipulation, and basic trouble shooting and repair. A training program that involves off-site travel shall include the cost of airfare, room and board for each participant.

7.1.1. A comprehensive Contractor provided on-site instrument training program that is coordinated with and timely to the equipment installation and that includes initial on-site training for scanner operators, pathologists, and clinical engineering staff. Supplemental advanced training and continuing educational opportunities provided by the vendor will be considered an additional benefit.

7.1.2. The Contractor shall provide on-site staff training on use and maintenance of digital slide scanner.

7.1.3. The Contractor shall provide on-site provider training of software used for review of digital slides for primary diagnosis, tumor board/conferences and workload management. In addition, operator training shall be provided by Contractor on-site for all operators.

7.1.4. Additional onsite training will be provided 60-90 days after instrumentation’s go live date.

7.1.5. Contractor will provide example policies and procedures such as standard operating procedure templates.

7.1.6. An electronic or hard copy of operation manuals for all hardware procured shall be provided by the contractor.

7.1.7. Go-Live support will be provided from the contractor for the first three days to support staff questions.

7.2. Upgrade/Updates: The Contractor shall provide updates to the software in order to maintain the integrity of the system and the state-of-the-art technology, at no additional charge to the Government. These shall be provided as they become commercially available and at the same time as they are being provided to commercial customers. This requirement only applies to “system updates” that enhance the model of equipment being offered, i.e. new version of software, correction of hardware defect, update offered to commercial customers at no additional charge, upgrade to replace model of equipment no longer Contractor supported, etc. This does not refer to replacing the original piece of equipment provided; however, it does refer to significant changes in the hardware operational capability. Should the VISN decide to upgrade their current equipment ie. - replacement of existing equipment with newer models, the CO and Contractor may do so under a signed supplemental agreement.

8. Hours of Operation

8.1. Normal tour-of-duty hours is 7:30AM to 5:00PM, Monday through Friday, excluding Federal holidays. However, the service is operating 24/7 and as such there may be instances in which the vendor’s workday may be outside of this period. The vendor is required to coordinate these times with the designated Program Manager.

8.2. In accordance with 5 U.S.C. 6103, Executive Order 11582 and Public Law 94-97 the following national holidays are observed and for the purpose of this contract are defined as “Legal Federal official holidays”

When a holiday falls on a Sunday, the following Monday will be observed as a National Holiday. When a holiday falls on a Saturday, the preceding Friday is observed as a National Holiday by U.S. Government Agencies.

9. SPECIAL REQUIREMENTS

9.1. Physical Security and Facility Considerations

9.1.1. Identification, Parking, Smoking and VA Regulations (For any onsite services):

9.1.1.1. The Contractor employees and/or Subcontractors approved by the COR shall wear visible identification at all times while on the premises of the facilities within the VISN. Identification shall include but not be limited to a company identification card, which shall include the company name, employee name, title, and a photograph of the employee. Contractor Employees shall maintain a professional appearance commensurate to their industry.

9.1.1.2. It is the responsibility of the Contractor to park in the appropriate designated parking areas. Information on parking is available from the VA Police Section. The VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

9.1.1.3. Any interior or exterior doors that shall be unlocked to gain access shall be kept locked during the performance of work unless it results in the creation of a safety hazard. In those instances, the Contractor is responsible to take necessary actions to maintain the same level of security prior to gaining access/performing work. Should any other devices need to be unlocked like an entry gate, those devices shall be locked immediately upon entry or exit. At no time shall the Contractor allow any person into a locked area or loan keys/access cards to another person. Contractor may be held in default for failure to comply with this requirement and subject the Contractor and its employees to contractual and other legal remedies.

9.1.1.4. Contractor personnel are required to check into the facility Police & Security office at each visit to pick up a “contractor” badge prior to contacting the COR. The Contractor’s staff shall also be required to sign in and out each day at a designated location determined by the COR.

9.1.1.5. The Contractor agrees that none of its officers or employees shall use or reveal any research, statistical, medical, or security information which may be obtained during the performance of the work or as a result their presence on Government premises without the written consent of the Government

9.1.1.6. Smoking is prohibited inside any buildings at facilities within VISN 22.

9.1.1.7. Possession of weapons is prohibited. Enclosed containers, including tool kits, shall be subject to search. Violations of VA regulations may result in citation answerable in the United States (Federal) District Court, not a local district, state, or municipal court.

9.1.1.8. The Contractor shall not allow his/her employees, including Subcontractors’ employees, to open desk drawers, cabinets, or to use office equipment, including the use of non-pay telephones for any purpose other than a local emergency call. The Contractor shall be responsible to provide all necessary equipment, tools, parts, and materials to perform the work. The Government shall not be obligated to provide any equipment, tools, parts, and materials to assist the Contractor in performing the work.

9.2. Insurance Requirements for work performed on Facility Grounds

9.2.1. The Contractor agrees to procure and maintain, while the Contract is in effect, Workers Compensation and Employee’s Public Liability Insurance in accordance with Federal and State of California and/or Nevada laws.

9.2.2. The Government shall be held harmless against any or all loss, cost, damage, claim expense or liability whatsoever, because of accident or injury to persons or property of others occurring in the performance of this Contract.

9.2.3. The Contractor shall be responsible for all damage to property, which may be done by him, or any employee engaged in the performance of this Contract.

9.2.4. Before commencing work under this Contract, the Contracting Officer shall require the Contractor to furnish certification from his/her insurance company indicating that the coverage specified by FAR 52.228-5 and per FAR 28.307-2 has been obtained and that it may not be changed or canceled without guaranteed thirty (30) day notice to the Contracting Officer.

9.2.5. Contractor is required to provide copies of proof of Workers Compensation and Employee Public Liability Insurance within fifteen (15) calendar days after notification of Contract award.

9.3. Information Technology Security Requirements

9.3.1. The Contractor shall identify if removable media is required to perform their duties. The Clinical Engineering Department will ensure the removable media is scanned with anti-virus software running current virus definitions prior to connection to any medical device/system. Any Contractor with patient sensitive information that is imported into the removable media device for any reason shall purge all patient sensitive information prior to departure from the facility.

9.3.2. Prior to termination or completion of this contract, Contractor/subcontractor shall not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a Contractor/subcontractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met shall be sent to the VA Contracting Officer within 30 days of termination or completion of the contract.

9.3.3. All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information shall be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the Contractor/subcontractor or any person acting on behalf of the Contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the Contractors/subcontractors that contain VA information shall be returned to the VA for sanitization or destruction or the Contractor/subcontractor shall self-certify that the media has been disposed of per 6500.1 requirements. This shall be completed within 30 days of termination or completion of the contract or disposal or return of the IT equipment, whichever is earlier.

9.3.4. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information shall not be returned to the Contractor at the end of lease, for trade-in, or other purposes. The options are:

9.3.4.1. Contractor shall accept the system without the drive;

9.3.4.2. VA’s initial medical device procurement includes a spare drive which shall be installed in place of the original drive at time of turn-in; or

9.3.4.3. VA shall reimburse the company for media at a reasonable open market replacement cost at time of purchase.

9.3.5. Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

9.3.5.1. The equipment Contractor shall have an existing BAA if the device being traded in has protected health information stored on it and hard drive(s) from the system are being returned physically intact; and

9.3.5.2. Any fixed hard drive on the device shall be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be pre-approved and described in the purchase order or contract.

9.3.5.3. A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed. The Information Security Officer (ISO) needs to maintain the documentation.

9.3.6. See Attachment C - VA Handbook 6500.6, for additional IT terms and conditions that shall apply to this contract.

9.4. Training

9.4.1. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

9.4.1.1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix D relating to access to VA information and information systems;

Please see Attachment C – VA Handbook 6500.6, Appendix D – Contractor Rules of Behavior.

9.4.1.2. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

9.4.1.3. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

9.4.1.4. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

9.4.2. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

9.4.3. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

10. Security

10.1. Information Security

10.1.1. The vendor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard contract language, conditions laws, and regulations. The vendor’s firewall and web server shall meet or exceed the government minimum requirements for security. All government data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Project Manager and the VBA Headquarters Information Security Officer as soon as possible. The vendor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification accreditation.

10.1.2. The contractor shall follow The Veterans Affair Acquisition Regulation (VAAR) security clause VAAR- 852.273-75 “SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES” sited in section C. Contract Clauses

10.1.2.1. The contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA personnel, regarding information and information system security. These include, but are not limited to Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130, and guidance and standards, available from the Department of Commerce's National Institute of Standards and Technology (NIST). This also includes the use of common security configurations available from NIST's Web site at: http://checklists.nist.gov

10.1.2.2. To ensure that appropriate security controls are in place, Contractors must follow the procedures set forth in "VA Information and Information System Security/Privacy Requirements for IT Contracts" located at the following Web site: http://www.iprm.oit.va.gov

10.2. Contract Personnel Security

10.2.1. All contractor employees who require access to the Department of Veterans Affairs' computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Security and Investigations Center (07C). The level of background security investigation will be in accordance with VA Directive 0710 dated September 10, 2004 and is available at: http://www.va.gov/pubs/asp/edsdirec.asp (VA Handbook 0710, Appendix A, Tables 1 - 3). Appropriate Background Investigation (BI) forms will be provided upon contract (or task order) award, and are to be completed and returned to the VA Security and Investigations Center (07C) within 30 days for processing. Contractors will be notified by 07C when the BI has been completed and adjudicated. These requirements are applicable to all subcontractor personnel requiring the same access. If the security clearance investigation is not completed prior to the start date of the contract, the employee may work on the contract while the security clearance is being processed, but the contractor will be responsible for the actions of those individuals they provide to perform work for the VA. In the event that damage arises from work performed by contractor personnel, under the auspices of the contract, the contractor will be responsible for resources necessary to remedy the incident.