Chemistry Analyzer - Fort Meade MD.docx

PERFORMANCE BASED WORK STATEMENT

Clinical Chemistry Laboratory Analyzer Non-Personal Services Contract Fort George G. Meade MEDDAC Fort Meade, Maryland

1.0. INTRODUCTION: Vendor shall provide five new Clinical Chemistry analyzers with Laboratory Information System (LIS) connectivity, and equipment maintenance/service for the Department of Laboratory Services at the five (5) Fort George G. Meade MEDDAC locations listed in section 1.0.1. with a base year and four option years cost per reportable rental contract for the medical equipment, reagents, and consumables. All reagents must be Food and Drug Administration (FDA) approved for use in clinical testing with controls and/or calibrators that meet or exceed the College of American Pathologists (CAP) checklist criteria for clinical testing. The reagents must be delivered in the amounts specified within a week of the supply schedule delivery dates, to cover the workload. The reagents must have expiration dates no less than 6 months from the delivery date. The reagents must function properly, passing all lot-to-lot tests. Calibrators and controls must function properly and test within the ranges set by the manufacturer. The analyzer must perform the quoted and contracted workflow. The analyzers must also be able to interface with the hospital information system, Military Health System Genesis (MHSG), to allow for transfer of results. The analyzers will be highly utilized for performing high volume testing of blood and body fluid samples. The automated analyzers will allow for continuous feed of samples during the testing time and will increase efficiency of testing. The analyzers must also provide flagging capability for subsequent and follow-on testing. Vendor must deliver the new analyzer within two months of the governments' delivery of the contract at the quoted cost, and provide support for the calibration and correlation (validation) testing of the analyzers. Vendor will also provide connectivity support ensuring the seamless transition to the MHSG. Vendor shall provide all preventive maintenance with the exception of regular user maintenance. Vendor shall provide at least two (2) preventive maintenance visits per year. Vendor will be responsible for all equipment repairs and provide repair support on-site within 4 hours upon determination has been made that a repair service is needed. Any equipment downtime that exceeds three workdays will require the vendor to provide alternate testing equipment and perform validation if necessary. Contract award may be subject to changes based on facility requirements (water or electrical) needed to support the functionality of the vendor's analyzer and/or any other peripheral equipment prior to installation. Funding will be allocated annually subject to the availability of funds. The Contractor shall provide Chemistry Analyzer support the Fort George G. Meade MEDDAC laboratory testing sites. The equipment will be of a nature and scope described in the following paragraphs.

1.0.1. The following Fort George G. Meade MEDDAC will serve as the five (5) main laboratory sites requesting this requirement:

1.0.1.1. Andrew Rader Army Health Clinic (ARAHC), Fort Myer, VA 22211

1.0.1.2. Barquist Army Health Clinic (BAHC), Fort Detrick, MD 21702

1.0.1.3. Dunham Army Health Clinic (DAHC), Carlisle Barracks, PA 17013

1.0.1.4. Kimbrough Ambulatory Care Center (KACC), Fort George G. Meade, MD 20755

1.0.1.5. Kirk Army Health Clinic (KAHC), Aberdeen Proving Ground, MD 21005

1.0.2. Analyzer Capability Requirements:

1.0.2.1. Must include all peripheral equipment (printer, monitor, and UPS). These items must be covered for repair under service contract.

1.0.2.2. Interfaces with LIS, MHS-Genesis.

1.0.2.3. Must have FDA clearance for resulting all tested assays and controls.

1.0.2.4. Must have advanced software to detect interferences such as hemolysis, lipemia, turbidity, clotting, and short sampling.

1.0.2.5. Must be capable of performing automatic repeat/reflex testing as applicable.

1.0.2.6. Due to facility space constraints, the analyzer footprint must fit the designated Chemistry area and must fit through the laboratory doorways/corridors upon delivery and installation.

1.0.2.7. Vendor must conduct a site visit to assess and determine lab space capabilities and installation requirements.

1.0.2.8. Monday thru Friday, 0630 – 1700; Service contract for all parts and labor must be included but not limited to allow full functionality of analyzer.

1.0.2.9. Must have ability to interface with MHS Genesis.

1.0.2.10. Reserved

1.0.3. Testing Menu, Volumes & Dimensions:

1.0.3.1. Andrew Rader Army Health Clinic (ARAHC), Fort Myer, VA 22211

Chemistry Analyte Annual Volume Estimate

Total Workload: 75,050 Dimensions: 47” Height, 46” Width, 28” Depth

1.0.3.2. Barquist Army Health Clinic (BAHC), Fort Detrick, MD 21702

Chemistry Analyte Annual Volume Estimate

Total Annual Workload: 60,453 Dimensions: 53” Height, 92” Width, 34” Depth

1.0.3.3. Dunham Army Health Clinic (DAHC), Carlisle Barracks, PA 17013

Chemistry Analyte Annual Volume Estimate

Total Annual Workload: 207,292 Dimensions: 68” Height, 110” Width, 36” Depth

1.0.3.4. Kimbrough Ambulatory Care Center (KACC), Fort George G. Meade, MD 20755

Chemistry Analyte Annual Volume Estimate

Total Annual Workload: 235,495 Dimensions: 65” Height, 112” Width, 42” Depth

1.0.3.5. Kirk Army Health Clinic (KAHC), Aberdeen Proving Ground, MD 21005

Chemistry Analyte Annual Volume Estimate

Total Annual Workload: 66,952 Dimensions: 53” Height, 92” Width, 34” Depth

1.1. GENERAL. This contract is expected to be firm fixed price with one 12 month base year and four 12 month option years. It's for a chemistry analyzer, reagents, supplies and maintenance and repairs as needed. Supplies are to support beneficiaries at the Fort George G. Meade MEDDAC’s five (5) laboratory locations listed in section 1.0.1.

1.2. HOURS OF OPERATION: On-site instrument services shall be provided for critical tests analyzers from Monday through Friday, during laboratory operation hours. The contractor must register their employees at the installation’s respective Visitors Center during regular hours (Monday-Friday, non-holidays) for access at any time thereafter. The contractor must contact the laboratory prior to arrival at the facility. Upon arrival, contractor must report to facility security office and be escorted by laboratory personnel while performing any services.

1.2.1. Normal Hours:

(1) Andrew Rader Army Health Clinic (ARAHC), 0700 – 1600

(2) Barquist Army Health Clinic (BAHC), 0700 – 1600

(3) Dunham Army Health Clinic (DAHC), 0700 – 1700

(4) Kimbrough Ambulatory Care Center (KACC), 0630 – 1630

(5) Kirk Army Health Clinic (KAHC), 0700 – 1600

1.2.2. Federal Holidays: Legal Public Holiday. Holidays in each calendar year identified as follows:

(1) New Year’s Day, January 1

(2) Martin Luther King’s Birthday, 3rd Monday in January

(3) Presidents’ Day, 3rd Monday in February

(4) Memorial Day, last Monday in May

(5) Juneteenth, June 19

(6) Independence Day, July 4

(7) Labor Day, 1st Monday in September

(8) Columbus Day, 2nd Monday in October

(9) Veterans Day, November 11

(10) Thanksgiving Day, 4th Thursday in November

(11) Christmas Day, December 25 Those holidays falling on a Saturday will be observed on the preceding Friday. Those falling on Sunday will be observed on the following Monday.

1.3. SCOPE OF WORK. The contractor shall provide trained experienced personnel, supplies, parts, test equipment, diagnostic software, and equipment necessary to perform Preventive Maintenance for all listed equipment.

1.3.1. PERSONNEL. Services under this contract shall be performed by individuals who have demonstrated knowledge and competence in the servicing and maintaining of the specific instrumentation under the contract. The contractor shall ensure repair technicians have been trained on the specific equipment under this contract. Contractor will be audited by COR/Quality Assurance officer annually, testing center will provide documentation to COR/QA for inspection. Field Service Engineer or Technical Specialist or any other technical resource that works on the instrumentation will be properly trained, tested for competence and fully certified to work on the instrumentation.

1.3.2. PERSONAL APPEARANCE. Contractor personnel working under this contract shall practice high standards of personal hygiene and maintain a clean, neat appearance while on duty.

1.3.3. SECURITY REQUIREMENTS. Contractor personnel or any representative of the contractor entering Meade MEDDAC laboratory location’s associated installations shall abide by all security regulations and shall be subject to security checks.

1.3.4. QUALITY ASSURANCE. Upon completion of work, an acceptance inspection will be conducted by the Government (Medical Maintenance personnel) and by the equipment user to ensure services are completed. The government will evaluate the contractor's performance under this contract using the method of surveillance specified in Quality Assurance Surveillance Plan (QASP) attached. All surveillance observations will be recorded by the government. When an observation indicates defective performance, the contracting officer's representative (COR) will obtain the contractor's representative's initials on the record of the observation. All Material Safety Data Sheets associated with the reagents must be provided to the respective Meade MEDDAC laboratory upon receipt of the reagents or products. If any FDA mandated or company-initiated recall is issued on any kit or kit component in use at any of the five (5) Meade MEDDAC laboratories, the vendor will notify the COR, or some member of the testing lab within 24 hours of the issuance of the recall on reagents needed for patient testing.

1.3.5. QUALITY CONTROL. The contractor shall be responsible to ensure that the quality of service and materials provided under this contract meet or exceed the performance work statement.

1.3.6. COMPLETION OF SERVICE. As needed, upon completion of services, a written service report will be provided to the Medical Maintenance/Clinical Engineering Manager. The service report shall be completely filled out within 24 hours from completion of service, provide detailed information regarding the cause of equipment malfunction and corrective action taken, to include the time required to complete the work, and a list of parts replaced with a price for each part. Contractor shall provide the balance of the required information in writing to the Chief, Medical Maintenance, no later than ten (10) days after services are completed. Upon completion of contractor provided maintenance; the contractor shall sign off on or affix a DD Form 2163 Calibration verification sticker in accordance with instruction provided in TB 38-750-2. This form is provided by the facility for use at the time when contractor renders services. This form is utilized for record keeping of services.

1.3.7. PERFORMANCE MEASURES. The contractor shall perform unlimited emergency service calls on equipment that supports critical testing from Monday through Friday, during hours of operations. Response time for repairs will be within 4 hours once determination of service need is made. Contractor shall be able to provide as emergency support within two (2) hours of telephone request. Success of the Chemistry sections of each laboratory hinges upon the laboratory's ability to provide rapid and accurate results to the providers and patients of the Fort George G. Meade MEDDAC. In the event of prolonged equipment failure, there will be a substantial monetary loss to the government; hence, the government will withhold paying the invoice until the next invoiced date or until the service is completed. As a result of an equipment failure, downtime experienced by the lab will cause an unacceptable delay in patient treatment. If an equipment failure resulting in downtime exceeds 2 working days, the vendor shall provide replacement equipment either as a temporary stop-gap solution (to be re-exchanged for the original equipment once repairs are made), or as a permanent replacement for the failing existing equipment.

1.3.8. EMERGENCY SUPPORT. Contractor must be able to provide emergency telephone support within two (2) hours of request. Instrument must be operational and no downtime will be experienced beyond 3 workdays without a replacement (temporary or otherwise) being provided.

1.3.9. EQUIPMENT. Contractor shall provide initial equipment, at no charge to the Government, as identified in the delivery order within 30 days upon receipt of the delivery order. Place of delivery shall be identified in each delivery order. The 30 days does not apply if subsequent delivery orders are issued for the equipment. However, if no subsequent delivery orders are issued or if the equipment is no longer needed by the Government, the Contractor shall remove the equipment within a reasonable period of time.

1.3.10. UPS. The contractor shall provide an Uninterrupted Power Supply (UPS) per analyzer required for emergency use which must be installed in the appropriate location as determined by the respective Ft. Meade MEDDAC site. This UPS is a self-operated unit that provides enough power, during a commercial power outage, to ensure the Chemistry Analyzer system remains operational.

1.3.11. REAGENTS. Contractor shall deliver all reagents identified in the delivery order within 30-days upon receipt of the delivery order. Place of delivery shall be identified in each delivery order. All reagents delivered to the Government shall have at least 90-days shelf life and utilize the same case LOT number as much as possible in order to minimize calibration of the equipment and ensure accurate test readings. Contractor shall adhere to provisioning of same case LOT number reagents greater than 80% of the time.

1.3.12. CAPABILITY REQUIREMENTS.

(1) Must include all peripheral equipment (printer, monitor, and UPS). These items must be covered for repair under service contract.

(2) Must have autoloader walk away capabilities.

(3) Must have FDA clearance for resulting all tested assays and controls.

(4) Must have advanced software to detect interferences such as hemolysis, lipemia, turbidity, clotting, and short sampling.

(5) Due to facility space constraints, the analyzer footprint must fit the designated Chemistry area and must fit through the laboratory doorways/corridors upon delivery and installation. Vendor must conduct site assessment of laboratory and facility footprint to determine space capabilities and installation requirements.

(6) Must have ability to interface with Military Health System - Genesis (MHS-Genesis).

(7) Must provide a mechanism to sample directly from the tube, without the requirement to aliquot the sample for testing.

(8) Must be able to continuously load samples while running.

(9) Must have the ability to test electrolytes regardless of fluctuations in temperature or humidity.

(10) Maintenance is to be automated.

(11) Six sigma chemistry performance for quality results.

(12) Ability to track stability of reagents on-board.

(13) Clot, Bubble, and Foam detection, which allows for low sample volume.

(14) Minimal hands-on maintenance downtime, daily, weekly, and monthly maintenance should take no longer than: 10 min, 35 min, and 20 minutes respectively.

(15) Training available for five (5) techs – one (1) tech per location.

1.3.13. PREVENTIVE MEASURES. Equipment shall be used daily. Semi-annual inspections are required. Preventive maintenance shall consist of two (2) inspections per delivery order year. Preventive maintenance shall consist of cleaning, adjusting, lubricating, installing parts and keeping the machine in good mechanical working condition.

1.3.14. REMEDIAL MAINTENANCE.

(1) Contractor shall be required to report within 24 hours of initial telephone notification or the next military duty day. If repairs cannot be completed at that time, contractor shall promptly notify the Contracting Officer and/or the Contracting Officer’s Representative (COR).

(2) Service shall not include the cost of consumable parts. The Contractor is not liable for repairs necessitated by fire, water, or the fault/negligence of the Government, nor labor for replacing motors caused by changes in power line specifications. In the event that these occur, the Government shall reimburse the contractor through the use of a Government Purchase Card.

(3) The Government and the Contractor shall exchange communication prior to commencement of any repair.

(4) When required, the Contractor shall comply with OSHA lock-out/tag-out standard while performing maintenance on electrical equipment.

(5) When required, the Contractor shall complete DA Form 2163, with the assistance of the COR, and display form in a prominent place on the equipment.

(6) Upon completion of services, a written service report shall be provided to the COR. The service report shall provide detailed information regarding the cause of equipment malfunction and corrective action taken. Include at a minimum, the time required to complete the work, price of hourly labor rate, and a list of parts to be replaced with prices for each part.

(7) In the event all information is not readily available to the COR when maintenance services are performed, the initial service report shall include all available information. The contractor shall provide the balance of the required information to the COR no later than 10 days after maintenance services are completed.

(8) Disposal of Trash and Defective Parts: The contractor shall be responsible for leaving the work area located in the laboratory in a clean and orderly fashion. All defective parts and trash created by the contractor shall be disposed of appropriately. Contractor shall be responsible for the disposal of all parts.

2.0. DEFINITIONS.

2.1. College of American Pathologist (CAP): Peer review body of the laboratory industry that ensures compliance with Clinical Laboratory Improvement Amendments '88 and Clinical Laboratory Improvement Program for DoD clinical laboratories.

2.2. Contracting Officer Representative (COR): An individual designated by the Contracting Officer to act as his/her representative to assist in administering contract. The source and authority for a COR are contained in the written letter of designation.

2.3. Food and Drug Administration (FDA): Federal regulatory body that has purview of the manufacturer, patient testing and distribution of blood and blood products.

2.4. Preventive Maintenance Checks and Services (PMCS): Maintaining equipment in a "like new" operating condition in accordance with the manufacturer's specifications. PMCS is accomplished by providing systematic inspection, Calibration Certification Verification, detection and correction of incipient failures, before they occur or before they develop into a major defect. Cleaning and lubrication will be included as needed on all internal parts as well as external cleaning after services are performed.

2.5. Quality Assurance (QA): Those actions taken by the government to assure services meet the requirements of the Performance Work Statement (PWS) and all other service outputs.

2.6. Quality Assurance Surveillance Plan (QASP): An organized written document used for quality assurance.

2.7. Quality Control: Those actions taken by a contractor to control the performance of services so that they meet the requirements of the PWS.

2.8. Response Time: The time frame within which the contractor must arrive on-site, measured from the time of verbal notification that service is required. Response time for this contract is 4 hours after service call is confirmed.

3.0. CONTRACTOR FURNISHED ITEMS.

3 .1. Contractor Materials. The contractor shall furnish all materials, manufacturer recommended Preventative Maintenance (PM) visits, Original Equipment Manufacturer (OEM) parts, labor and supplies necessary to perform the services and repairs. Travel expenses will be included in the overall service cost of the contract at no additional cost to the government.

4.0. Specific Tasks:

4.1. The Contractor shall install a Chemistry analyzer at the five (5) Meade MEDDAC laboratory locations and perform installation qualification. The contractor shall be responsible for qualifying new instruments and reagents on the analyzer. All activities performed by the contractor shall be documented with appropriate checklists and forms. This documentation shall be given to the Chemistry supervisor. The contractor shall develop a site-specific implementation plan prior to the delivery of the instrument. The contractor shall provide instrument training of primary operations on-site and will assist with workflow optimization to ensure a smooth transition from our current method to the contractor's platform. The contractor shall validate the new system, providing needed reagents to complete validation. The contractor shall provide the validation guidelines in electronic and hard copy format. These guidelines shall contain but not be limited to test cases from which each facility can select or modify according to their Department of Laboratory Services requirements. This Chemistry analyzer must be able to interface as a bi-directional system with the current MHSG LIS system. The contractor shall provide all necessary communication equipment.

4.2. Contractor's representative shall coordinate with COR and/or laboratory site representative prior to commencing all on-site services and repairs during each locations normal hours of operation, Monday through Friday.

4.3. Upon completion of services, a written service report will be provided to the laboratory site representative The service report shall be completely filled out, provide detailed information regarding the cause of equipment malfunction and corrective action taken, to include the time required to complete the work, price of labor (hourly rate), and a list of parts replaced with. Contractor shall provide the balance of the required information in writing to the laboratory site representative, not later than seven days after services are completed. Contractor shall ensure repair technicians complete close out documentation within 24 hours and issue an interim report within 24 hours to the Department.

4.4. Software Coverage: Contractor shall provide all software updates to the customer. Contractor must notify to the customer when updates are released. This is at no cost to the government. Hardware upgrades that are related to safety concerns or needed to maintain instrument performance specifications will be mandatory and shall be performed by the Field Service personnel at no cost to the customer. All software and hardware upgrades must be performed by trained personnel. The Field Service Engineer shall schedule with the section supervisor of the upgrade.

4.5. Training: Included with the analyzer acquisition is comprehensive training for the employees of Department of Laboratory Services at the five (5) Meade MEDDAC site. Request a Diagnostics Systems Specialist be assigned to facilitate the analyzer implementation. These personnel shall perform the initial instrument qualification testing and provide guidance to each Department of Laboratory Services staff for tasks such as writing standard operating procedures (SOPs) and performing parallel testing. Onsite training is preferred; however, if travel is necessary for training, expenses will be at no cost to the government.

5.0. Payments:

5.1. Contractor shall invoice through Wide Area Work Flow.

6.0. Non-Compliance:

6.1. In the event the contractor fails to accomplish services within the months specified or within the required repair time frame, the entire agreement will be extended 30 days at no charge to the government to allow time for mitigation of the loss of services. An immediate contract termination without alternate resources would cause detrimental impact on patient care services.

7.0. BUSINESS TO BUSINESS (B2B) GENERAL SECURITY REQUIREMENTS

7.1. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

7.2. Personnel Security.

7.2.1. The contractor shall comply with DoD Directive 8500.1, “Information Assurance (IA),” DoD Instruction 8500.2, “Information Assurance (IA) Implementation,” DoD Directive 5400.11, “DoD Privacy Program,” DoD 6025.18-R, “DoD Health Information Privacy Regulation,” DoD 5200.2-R, “Personnel Security Program Requirements.” AR25-1, “Army Knowledge Management and Information Technology”, AR25-2 “Information Assurance.” and local regulations as deemed appropriate by the activity Information Assurance personnel.

7.2.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

7.2.3. Follow the Army guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

7.2.4. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility LAN.

7.2.5. Ensure that all contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

7.3. Electronic Security.

7.3.1. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of (Fort George G. Meade MEDDAC) shall operate in accordance with controlling laws, regulations, DoD, Army, and local policy.

7.3.2. Certification & Accreditation (C&A) requirements apply to all DoD and contractor’s IS/networks that receive, process, display, store or transmit DoD information. The contractor shall comply with the C&A process for safeguarding IS. Certification is the determination of the appropriate level of protection required for IS/networks. Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

7.3.3. Accreditation is the formal approval by the government to operate the contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections, and with appropriate level of protection for the specified period.

7.3.4. The contractor shall comply with C&A requirements, as specified by the government that meet appropriate DoD Information Assurance requirements. The C&A requirements shall be met before the contractor’s system is authorized to access DoD data or interconnect with any DoD IS/network that receives, processes, stores, displays or transmits DoD data. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

(1) Attending and supporting C&A meetings with the government

(2) Supporting/conducting the vulnerability mitigation process

(3) Supporting the C&A Team during system security testing

7.3.5. Contractors must confirm that there is/networks are locked down prior to initiating testing.

7.3.6. Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

7.3.7. Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

7.3.8. Any re-configuration or change in the system during the C&A testing process will require a re-baselining of the system and documentation of system changes.

7.3.9. IA mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the government shall be in compliance with all known applicable Department of Defense Computer Emergency Response Team (DoD-CERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

7.3.10. Disposing of Electronic Media. Vendors shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Vendors are required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

7.3.11. Information Assurance Vulnerability Management (IAVM) The contractor shall implement an information assurance vulnerability management program for all AIS and corresponding subnets that are connected to or intermittently connect to Army networks. The program shall meet the scope and intent of AR25-2 and (Insert MTF Name) IA policies to provide protection against known threats and vulnerabilities. Compliance with Army IAVM alerts and bulleting is required for these systems, and shall be completed within the specified timeframe.

7.4. Information Systems (IS)/Networks Physical Security.

7.4.1. The contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the contractor will support a Physical Security Audit performed by the Government of the contractor's internal information management infrastructure. The MHS Physical Security Audit Matrix is available at: http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls. The contractor shall correct any deficiencies identified by the Government of the contractor's physical security posture.

7.5. Special Requirements for Protected Health Information.

7.5.1. Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the contractors must:

7.5.2. Notify the (Kimbrough Ambulatory Care Center) Ms. Ashley Westerdale-HIPAA Security Manager.

7.5.3. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

8.0. PRIVACY AND SECURITY OF PROTECTED HEALTH INFORMATION (PHI) INTRODUCTION

8.1. IAW DOD 6025.18R “Department of Defense Health Information Privacy Regulation” the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and DOD 6025.18R, as amended. Additional requirements will be addressed when implemented.

8.2. Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DOD 6025.18R.

8.2.1. Individual has the same meaning as the term ``individual'' in 45 CFR 164.501 and 164.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

8.2.2. Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

8.2.3. Protected Health Information has the same meaning as the term ``protected health information'' in 45 CFR 164.501, limited to the information created or received by The Contractor from or on behalf of The Government.

8.2.4. Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

8.2.5. Required by Law has the same meaning as the term ``required by law'' in 45 CFR 164.501 and 164.103.

8.2.6. Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

8.2.7. Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part 164, subpart C.

8.2.8. Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR 160.103, 164.501 and 164.304.

8.3. Contractor’s Responsibilities:

8.3.1. The Contractor agrees to not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

8.3.2. The Contractor agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Contract.

8.3.3. The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

8.3.4. The Contractor agrees to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Contract.

8.3.5. The Contractor agrees to report to the Government any security incident involving protected health information of which it becomes aware.

8.3.6. The Contractor agrees to report to the Government any use or disclosure of the Protected Health Information not provided for by this Contract of which the Contractor becomes aware of.

8.3.7. The Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the Contractor on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

8.3.8. The Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it The Contractor agrees to provide access, at the request of the Government, and in the time and manner designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

8.3.9. The Contractor agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government or an Individual, and in the time and manner designated by the Government.

8.3.10. The Contractor agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the Contractor on behalf of, the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner designated by the Government or the Secretary, for purposes of the Secretary determining the Government’s compliance with the Privacy Rule.

8.3.11. The Contractor agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

8.3.12. The Contractor agrees to provide to the Government or an Individual, in time and manner designated by the Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

8.4. General Use and Disclosure Provisions Except as otherwise limited in this Agreement, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the Privacy Rule, the Security Rule or DOD 6025.18R if done by the Government.

8.5. Specific Use and Disclosure Provisions

8.5.1. Except as otherwise limited in this Agreement, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

8.5.2. Except as otherwise limited in this Agreement, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

8.5.3. Except as otherwise limited in this Agreement, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

8.5.4. Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1).

8.6. Obligations of the Government

8.6.1. Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

8.6.2. Upon request the Government shall provide the Contractor with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520, as well as any changes to such notice.

8.6.3. The Government shall provide the Contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Contractor's permitted or required uses and disclosures.

8.6.4. The Government shall notify the Contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

8.6.5. Permissible Requests by the Government - The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

8.7. Termination

8.7.1. Termination. A breach by the Contractor of this clause, may subject the Contractor to termination under any applicable default or termination provision of this Contract.

8.7.2. Effect of Termination.

(1) If this contract has records management requirements, the records subject to the Clause should be handled in accordance with the records management requirements. If this contract does not have records management requirements, the records should be handled in accordance with paragraphs (2) and (3) below.

(2) If this contract does not have records management requirements, except as provided in paragraph

(3) of this section, upon termination of this Contract, for any reason, the Contractor shall return or destroy all Protected Health Information received from the Government or created or received by the Contractor on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the Protected Health Information.

8.7.3. If this contract does not have records management provisions and the Contractor determines that returning or destroying the Protected Health Information is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of Protected Health Information is infeasible, the Contractor shall extend the protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such Protected Health Information.

8.8. Miscellaneous

8.8.1. Regulatory References. A reference in this Clause to a section in DOD 6025.18R, Privacy Rule or Security Rule means the section as in effect or as amended, and for which compliance is required.

8.8.2. Survival. The respective rights and obligations of Business Associate under the ``Effect of Termination'' provision of this Clause shall survive the termination of this Contract.

8.8.3. Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with DOD 6025.18R, Privacy Rule or Security Rule.

8.9. Antiterrorism and Operations Security Compliance:

8.9.1. AT Level 1 Training: All contractor employees, including subcontractor employees, requiring access to DHHQ, Direct Reporting Markets (MTFs), Small Markets and Stand Alone (SSO) facilities and controlled access areas, shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable and annually thereafter. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 05 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: http://jko.jten.mil.

8.9.2. Access and General Protection/Security Policy and Procedures: This standard language is for contractor employees with an area of performance within a DHA controlled installation, facility, or area. Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, DHHQ and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

8.9.3. For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

8.9.4. iWatch Training. The contractor and all associated subcontractors shall brief all employees on the local iWatch program (training standards provided by the requiring activity ATO). iWatch training is available on https://www.youtube.com/embed/vlzYhQp7fPw. This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 90 calendar days of contract award, and within 30 days of new employees commencing performance, with the results reported to the COR no later than 60 days after the contract award.

8.9.5. Service Training Certification Tracking System (STCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to government information systems must be registered in the STCTS at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS and then annually thereafter.

8.9.6. OPSEC Training. Per DHA-AI 5200.03, Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. https://securityawareness.usalearning.gov/opsec/index.htm

8.9.7. Information Assurance (IA) Information Technology (IT) Training. All contractor employees and associated subcontractor employees must complete the DoD Cyber Awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD requirements DoD 8570.01 and DoD 8570.01-M within six months of appointment to IA/IT functions. DoD Cyber Awareness Challenge Training is available at the following website:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf?ORG=NAVSEA, DOD Course US1364-22 DOD Cyber Awareness Challenge 2022. Per DoD 8570.01-M , DFARS 252.239.7001, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

END OF STATEMENT OF WORK

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

The following minimum Quality Assurance Plan applies. The Government may modify inspection methods in accordance with site specific requirements.

Performance Objective

Reference

Performance Standard

Method of Assessment