Combined Syn-Sol NIH-CC-20-002472 High Density Storage and IV Workflow Solution.pdf

Combined Synopsis/Solicitation Number NIH-CC-20-002472 Automated Medication Management Solutions

(High Density Pharmacy Storage, IV Workflow, and High Speed Packager)

National Institutes of Health Clinical Center

Pharmacy Department

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for

Evaluation and Solicitation for Commercial Items,” as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested, and a written solicitation document will not be issued. The solicitation is being issued using simplified acquisition procedures under the authority of FAR 13.5 Test Program for Certain

Commercial Items.

The solicitation document and incorporated provisions and clauses are those in effect through

Federal Acquisition Circular (FAC) 2020-06, Effective 05-06-2020.

The associated North American Industrial Classification System (NAICS) code for this procurement is 511210, Software Publishing, with a small business size standard of $38.5 million.

This acquisition is full and open to all business sizes. Responses are due by 10:00 a.m., May 31, 2020.

Questions may be submitted by email to the Contract Specialist (Lisa.Schaupp@nih.gov) through

May 27, 2020 by 9:00 a.m. E.T. Answers will be posted by 5:00 p.m. E.T. May 27, 2020.

The National Institute of Health, Office of Purchasing and Contracts, is seeking to acquire an automated high density pharmacy storage and IV workflow solution that interfaces with the

Automated Dispensing Cabinets (ADCs) and pharmacy inventory management systems in order to increase safety and efficiency. The dispensing software will also communicate with the pharmacy information system to allow first-dose and cart-fill/ADC dispensing requests to be received and then processed and filled by technicians. The solution will provide real time tracking of current inventory and medications to order. Please see the Statement of Work for detail of the requirement.

Contractor must provide pricing for the following Period of Performance summary of products and services with the salient characteristics of the items described in the following Statement of Work:

Line

Item Description Qty U/I Price / Unit Total ($)

Base

Base Period: Estimated to begin in June

Period of Performance est. 6/15/2020 to

5/31/2021

High Density Automated Storage

System Purchase: build, deliver, install to acceptable performance inclusive of training.

1 EA $_______ $_______

High Speed packager – Deliver est July, 1 EA

IV Workflow – Delivery est January

1 EA

0004 Other Support Services Min 0 /

Max 10 Month

Total if all line items fully funded at the maximum quantities $_______

Opt 1

Option Period One: Period of

Performance estimated 6/1/2021 to

5/31/2022

Warranty Services High Density

Automated Storage

Min 0 /

Max 12 Months $_______ $_______

High Speed packager Warranty Service /

Preventive Maintenance

Min 0 /

Max 12 Months

1003 IV Workflow Min 0 /

Max 12 Months $_______ $_______

1004 Other Support Services Min 0 /

Max 12 Months

Total Option Period One if exercised at maximum quantities $_______

OPT 2

Option Period Two: Period of

Performance estimated 6/1/2022 to

5/31/2023

Automated Storage 12 Months $_______ $_______

High Speed packager Warranty Service /

Preventive Maintenance 12 Months $_______ $_______

2003 IV Workflow Min 0 /

Max 12

2004 Support Services Min 0 /

Max 12

Total Option Period Two if exercised at maximum quantities $_______

OPT 3

Option Period Three Period of

Performance estimated 6/1/2023 to

5/31/2024

Automated Storage 12 Months $_______ $_______

High Speed packager Warranty Service /

Preventive Maintenance 12 Months $_______ $_______

3003 IV Workflow Min 0 /

Max 12

3004 Other Support Services Min 0 /

Max 12 Months $_______ $_______

Total Option Period Three if exercised at maximum quantities $_______

OPT 4

Option Period Four Period of

Performance estimated 6/1/2024 to

5/31/2025

Automated Storage 12 Months $_______ $_______

High Speed packager Warranty Service /

Preventive Maintenance 12 Months $_______ $_______

4003 IV Workflow Min 0 /

Max 12

4004 Other Support Services Min 0 /

Max 12

Total Option Period Four if exercised at maximum quantities $_______

TOTAL including all Option Periods $_______

NIH CC Pharmacy

Statement of Work

(High Density Pharmacy Storage, IV Workflow and High Speed Packager)

Table of Contents

PART 1 – GENERAL INFORMATION

PART 2 – MINIMUM REQUIREMENTS

PART 3 - GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

PART 4 - CONTRACTOR FURNISHED ITEMS AND SERVICES

PART 5 – OTHER SYSTEM AND TECHNICAL SPECIFICATIONS

PART 6 – PROJECT MANAGEMENT, IMPLEMENTATION, SERVICE

PART 7 - APPLICABLE PUBLICATIONS

PART 8 - DEFINITIONS & ACRONYMS

Technical Exhibit 1 – Deliverables Schedule

Technical Exhibit 2 – Estimated Workload Data

Technical Exhibit 3 – CC Data Center

Technical Exhibit 4 – NIH CC EHR Clinical Research Informatics Information System (CRIS)

Technical Exhibit 5 – NIH CC EHR CRIS ADT Interface

Technical Exhibit 6 – CC Remote Access Options

52.246-4 Inspection of Services-Fixed-Price

4 STEPS TO CREATE THE INVOICE SUBMISSION EMAIL

January 2020

1 CC Remote Access Options

APPENDIX A: NIH Remote Access Standard

APPENDIX B: System Monitoring by External Vendors

PART 1 – GENERAL INFORMATION

The NIH CC Pharmacy department requires a complete inventory management solution for its pharmacy.

The system may be commercially available and will require 24 hour emergency service response capability from the contractor. Non-Developmental items and development items are not anticipated.

This Statement of Work (SOW) issued by National Institute of Health, Clinical Center describes the goals expected to be achieved with regard to executing the transition to a fully automated storage and inventory management system.

1.1 Introduction:

The National Institutes of Health (NIH), Clinical Center Department of Pharmacy is pursuing the acquisition of a fully integrated pharmacy medication management system for the Unit Dose, Intravenous Admixture Unit, Outpatient pharmacy and Investigational Drug Management and Research Section (IDMRS). The primary goal of this acquisition is to provide the solution, services and training necessary for the Department of Pharmacy for ordering, sorting and distributing medications administered to the patients at the National Institutes of Health Clinical Center.

1.2 Background:

The National Institutes of Health (NIH), a part of the U.S. Department of Health and Human Services, is the primary federal agency for conducting and supporting medical research. Helping to lead the way toward important medical discoveries that improve people’s health and save lives, NIH scientists investigate ways to prevent disease as well as the causes, treatments, and even cures for common and rare diseases.

Composed of 27 institutes and centers, the NIH provides leadership and financial support to researches in all fifty states and throughout the world.

The Clinical Center at the NIH in Bethesda, Maryland, is the nation’s largest hospital devoted to clinical research. It is a national resource that makes it possible to rapidly translate scientific observations and laboratory discoveries into new approaches for diagnosing, treating, and preventing disease. Approximately 1,500 studies are in progress at the NIH Clinical Center. About half the studies are the first tests of new medications or medical treatments in patients The CC Pharmacy consists of Inpatient and Outpatient pharmacy. The inpatient section is further divided into Unit Dose (UD) and Intravenous Admixture Unit (IVAU). The inpatient pharmacy is open 24 hours a day, seven days a week. The Unit Dose section of the Pharmacy Department dispenses, on average, 40,000 unit dose medications per month. The IVAU is responsible for the compounding of sterile injectable preparations.

1.3 Current Environment:

The Department of Pharmacy’s primary operating objective is to support and conduct research by providing safe, high quality care – one patient – one medication at a time. The secondary operating objective is standardize, improve effectiveness (service, outcomes), and reduce waste.

The NIH Clinical Center Pharmacy Department is structured around a hybrid medication distribution model including both cart fill and Automated Dispensing Cabinets (ADCs). A 24 hour cart-fill system is used in delivering scheduled medications in patient specific bins to Omnicell ADCs. Patient specific medication drawers are filled by technicians and checked by pharmacists prior to delivery. New and revised medication orders are reviewed and verified by pharmacists either in central pharmacy or by the clinical specialists.

ADCs are located on patient care units and in clinics to facilitate access to as needed medications, stat antibiotics, controlled substances and some routine first doses. The ADC restock prints in central pharmacy and are filled manually from the central unit dose area and the controlled substance safe by a technician, and audited by a pharmacist. Technicians restock each ADC using a bar-coded restocking label.

In fall of 2021, NIH pharmacy will be relocating to a newly designed facility that includes a 7 room Aseptic Facility that will compound both nonhazardous and hazardous medications.

The pharmacy has automated some of the dispensing phase of the medication-use process yet still maintains manual system for restocking ADCs, cart fill and managing medication inventory levels. In an effort to fully automate the dispensing and inventory phase of the Medication Use Process, there is a need to utilize a fully automated high density storage along with IV Workflow software to bridge the gaps identified.

The Clinical Center currently utilizes Allscripts Sunrise v16.3 as the primary Electronic Health Record (EHR) for Prescriber Order Entry. The EHR is primarily managed by the Department of Clinical Research Informatics (DCRI).

1.4 Objectives:

The department of pharmacy is seeking an integrated suite of medication management and inventory technologies that improves workflow, reduces waste, increase productivity and medication safety. The systems include: IV Workflow Solution, High Density Storage Robotics System and high speed medication packager. The system will also provide real time tracking of current inventory and medications to order.

1.5 Scope of Work

The contractor shall provide the applicable services in support of the required identified in the SOW. The contractor shall provide the following integrated systems:

a. High Density Robotic Storage Device

b. Carousel medication storage device

c. IV Workflow Solution System

d. High Speed Medication Packager

e. Inventory Management Software

The scope of the solicitation will apply to the following components of Pharmacy Department

1.5.1 The Contractor shall be responsible for planning, installing, training, testing and continuous maintenance support of the automated storage and inventory management system.

1.5.2 The solution provided must be capable of managing all medications stored and dispensed by the department.

1.5.3 Training of pharmacy staff. (See Technical Exhibit 1)

1.5.4 Onsite implementation and support. (See Technical Exhibit 1)

1.5.5 The contractor shall provide a solution that will Interface with the current EHR, ADC and other

COTS pharmacy systems to exchange medication and patient data.

1.6 Contract Type and Period of Performance

A single Firm Fixed Price type contract with options for increased quantities is contemplated for one 12-month base period and four (4) twelve month option periods to extend the effective period of performance.

Options to increase quantities may be exercised by formal modification to the contract should there be a need to provide additional equipment as the Department of Pharmacy Area expands.

The Period of Performance is estimated to begin sometime in June 2020 and run through June, 2025 if all options are exercised.

Estimated Periods of Performance is as follows.

Base Period: June 1, 2020 – May 31, 2021 Option Period One (1): June 1, 2021 through May 31, 2022 Option Period Two (2): June 1, 2022 through May 31, 2023 Option Period Three (3): June 1, 2023 through May 31, 2024 Option Period Four (4): June 1, 2024 through May 31, 2025

1.7 Recognized Holidays: Work may occur on Federal Holidays. Maintenance Support may occur all hours and across all days.

The ten holidays observed by the Federal Government are as follows:

New Year’s Day Memorial Day Columbus Day Christmas Day

Martin Luther King Day

Independence Day Veterans Day

President's Day Labor Day Thanksgiving Day

Also, any other day declared by the President of the United States to be a National or Federal holiday.

1.8 Hours of Operation: The NIH CC operates 365 days per year, 24 hours per day including all holidays.

Maintenance Support must be provided across all days and hours (365x24x7).

1.9 Installation Timing: The Contractor will work with the COR to schedule and perform the installation.

Installation will be performed at the convenience of the location receiving the system. Installation may occur between the hours of 9:00 a.m. and 7:00 p.m., Monday through Sunday, including holidays and any day declared an official Federal Holiday.

1.10 Place of Performance: The work to be performed under this contract will be performed at the NIH Clinical Center Department of Pharmacy, 9000 Rockville Pike, Building 10, Bethesda MD 20892.

1.11 Security Requirements: Contractor personnel performing work under this contract must have a NIH CC Contractor badge which will require fingerprinting and a background check.

a. Physical Security: The Contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

b. Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan.

Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the NIH CC Contracting Officer.

1. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the NIH CC Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

2. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the NIH CC Contracting Officer.

1.12 Special Qualifications: The Contractor must ensure that all staff maintain his/her NIH badge which requires completion of annual training (i.e., security, privacy, first safety, Joint Commission).

1.13 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The NIH CC Contracting Officer, NIH CC Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings, the NIH CC Contracting Officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.14 NIH CC Contracting Officer's Representative: The NIH CC COR is a specialist from the NIH CC Pharmacy Department whose role is to define, plan, track and manage the project.

The following individual is designated as the NIH CC COR:

Project Officer Name: TBD Address: 10 Center Drive, Building #10, Room 1C240. Bethesda, MD 20850 Email: TBD Phone Number: TBD

1.15 NIH CC Automated Storage and Inventory Management Implementation Team: The NIH Technical Implementation Team includes the COR, Pharmacy Project Manager, Pharmacy Management, NIH CC IT staff, NIH CC Security staff.

1.16 Executive Management Oversight: Executive Management oversight for this project is provided by the NIH CC Chief Pharmacy and the NIH CIO.

1.17 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Badges must be worn at all times.

1.18 Data Rights: The Government has unlimited rights to all documents/materials produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the NIH CC Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.19 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the NIH CC Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the NIH CC Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the NIH CC Contracting Officer and in the event the NIH CC Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the NIH CC Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.20 Phase Out Period: To reduce any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on board for 60 days prior to the contract phase out period. During the phase out period, the Contractor shall transfer any system knowledge to the Government.

PART 2 – MINIMUM REQUIREMENTS

2.1 The Contractor shall provide a non-developmental automated robotic and inventory storage

System capable of storing high density medications that will operate as a single integrated solution. The solution shall use a commercial off the shelf software and hardware component that are configurable to the NIH Clinical Center workflow. The solution must have been demonstrated and proven to be in use at another inpatient pharmacy hospital setting.

2.1.1 The solution shall fit into the pharmacy. Any changes needed/required to accommodate the vendors quoted solution such as the relocation of current fixed shelving/furniture in existing space or addition of dedicated power lines, must be quoted as part of vendors solution and will be considered normal installation. Vendors are responsible for verifying all dimensions and other design features necessary for operation and installation of their quoted solution.

2.1.2 The solution shall be a fully automated dispensing and inventory management system utilizing a robotic arm for picking and storage

2.1.3 The system shall interface with Omnicell Automated Dispensing Cabinets (ADCs) and Omnicell Central Pharmacy Manager (CPM).

2.1.4 The system shall be able to dispense medications for verified patient orders including scheduled, STAT/Now and first dose orders.

2.1.5 The solution shall support both non-IV and non-narcotic formulary in variety of form factors such as oral solids in unit dose (manufacturer-packaged blister style or pouch/repackaged), oral solid cards, vials (1-100 mL), liquid dose cups, syringes/capujects, packets, patches, boxes, and IV bags up to 150 mL).

2.1.6 The solution shall be capable of automatically bagging patient specific medications by placing dispensed medications into sealed bags printed with patient or cabinet information with barcode.

2.1.7 The system shall be capable of ensuring that earliest expiring medications are dispensed first.

2.1.8 The system shall have an active storage management system for maximum efficiency and throughput.

2.1.9 The pharmacy automation solution shall interface with the Allscripts EHR, Omnicell ADCs, inventory Management System and other commercial off-the-shelf (COTS) pharmacy systems. Loss of the interface with EHR shall not impede the system from continuing to fill orders until all orders that have already been transferred are completed.

2.1.10 For manually fulfilled orders, the system shall require user to scan the medication package before providing the label.

2.1.11 The system shall allow users to flag an order when there is insufficient quantity to fulfill the entire ordered quantity.

2.1.12 The solution shall have the ability to recognize brand name NDC (National Drug Code) and generic NDC items found on the FDA approved NDC directory.

2.1.13 The inventory management software shall provide “Real-Time” inventory tracking of pharmaceutical products.

2.1.14 The contractor shall be able to provide a dedicated on-site support staff member that will provide service, troubleshooting and training for up to a year post implementation.

2.2 The Contractor shall provide a non-developmental IV Workflow system that will operate as a single integrated all in one system. The solution shall be a commercial off the shelf software and hardware components that are configurable to the NIH Clinical Center workflow. The solution must have been demonstrated and proven to be in use at another inpatient pharmacy hospital setting.

2.2.1 The solution shall be capable of integrating with Omnicell central pharmacy manager inventory management system and carousel technology. Medications to be prepared via the system shall rotate the carousel to the location of the items

2.2.2 The solution shall be capable of utilizing high definition image-based volumetric process to capture images of each process of IV medication compounding. Process of capturing images shall be via a hands free mechanism.

2.2.3 The system shall be an all-in-one system that has an integrated scale for gravimetric analysis of the compounded medications. Use of gravimetrics should be configurable.

For those medications such as investigational agents that may not have data to support gravimetric analysis, volumetric shall be an option.

2.2.4 The IV Workflow Solution shall include a dashboard and data analytics component that will suggest open and available compounding hood based on the user and medication being compounded.

2.2.5 The solution shall have a mechanism of assigning medication directly to a particular workstation for preparation.

2.2.6 The solution shall have capability to be integrated with Simplifi 797 for cleaning documentations.

2.2.7 The solution shall have availability to medication database that is constantly updated.

2.2.8 The IV Workflow Solution shall support an HL7 ADT and medication order

2.2.9 The pharmacy IV workflow solution shall be capable of storing lot numbers, expiration dates and preparation instructions.

2.2.10 The system shall support a custom unit of measure list for investigational agents.

2.2.11 The IV Workflow system shall have a Production and Test Environment.

2.3 The Contractor shall provide a non-developmental High Speed Medication Packager that will operate as a single integrated all in one system. The solution shall be a commercial off the shelf software and hardware components that are configurable to the NIH Clinical Center workflow.

The solution must have been demonstrated and proven to be in use at another inpatient pharmacy hospital setting.

2.3.1 The system shall have the ability to customize barcode label to meet NIH CC needs

2.3.2 Ability for packager to operate in automatic or semi-automatic mode.

2.3.3 Ability to interface with Omnicell Central Pharmacy Manager (CPM) and Carousel technologies for floorstock and cartfill picks

2.3.4 Cleanable construction such as stainless steel or similar

2.3.5 Label can be configured with different fonts, font sizes. Use of tall man lettering or addition of precautions such as “High Alert” can be obtained.

PART 3 - GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

The government will be responsible for:

A. Rack Space in NIH CC Data Center.

1. Support Operating System of any Required Server.

2. Provide Virtual Server(s) if the system can be virtualized.

3. Perform Monthly OS Patches.

4. Provide 2016 or greater MS SQL Server Enterprise License. MS SQL 2016 preferred. Plan for migration within one year accepted. All databases must be encrypted.

5. Provide Network to the NIH Data Center.

B. Providing necessary network and LAN drops for the equipment in the central pharmacy.

C. Server Maintenance (See paragraph 5.6)

1. NIH CC will manage the OS, Patches, MS SQL 2016 Database or greater for the Physical

Computer.

D. Formulary Size

1. Formulary Items

a) UD Room Temperature – 1200

b) UD Refrigerated – 200

c) UD Frozen – 30

2. Non Formulary Items

a) UD Room Temperature – 100

b) UD Refrigerated – 100

3. Investigational

a) Room Temp Caps/Tabs – 1500

4. Daily Dispensing Volume

a) % Cartfill vs % Cartless – 70% vs 30%

b) Number of cartfill doses dispensed per day – 400

c) Number of first doses/stats dispensed per day – 60

5. Average daily census – 114

6. Wholesaler – Amerisource Bergen

PART 4 - CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

The Contractor shall provide:

A. High density automated robotic storage and retrieval system that can interface with Omnicell ADCs and Central Pharmacy Inventory Management System

B. IV workflow solution capable of integrating with carousel storage device and central pharmacy manager software

C. High speed medication packager capable of integrating with Omnicell Central Pharmacy Manager

D. Servers if the system cannot be virtualized.

E. Master list of all hardware and software components including length of warranty and average life of the solution. See Table 8.3.

F. Master list of Software Maintenance Agreements and License Agreements for all software.

G. Specifications required of the virtualized server, if applicable. The Server/Database/Application Infrastructure must be supported to run on Windows Server 2016 R2, at a minimum.

PART 5 – OTHER SYSTEM AND TECHNICAL SPECIFICATIONS

5.1 Authentication: The solution shall support integration with NIH directory services supporting an integrated authentication and authorization model (single sign on) utilizing the e-Government profile for Security Assertion Markup Language 2.0 (SAML 2.0).

5.2 Confidentiality, Security, and Privacy: All patient data shall be stored on the server hosted on the premises at the National Institute of Health, Clinical Center. Responder personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations. The Contractor will work with NIH CC Security Team for all FISMA/SAA documentation.

5.3 Construction and Wiring of the Solution

5.3.1 All vendor hardware wiring shall abide by the existing NIH/CIT Cable Standards and Guidelines (http://orf.od.nih.gov/PoliciesAndGuidelines/BiomedicalandAnimalResearchFacilit iesDesignPoliciesandGuidelines/Pages/DesignRequirementsManualPDF.aspx ).

This also includes any new infrastructure that is required for this installation.

5.3.2 The Contractor is responsible for reviewing the plans for construction and wiring and must receive approval from the NIH CC COR before any work starts on an area by area basis.

5.3.3 The Contractor must utilize existing pathways (i.e. conduits, cable tray) before installing new pathways between existing individual rooms or between any of the system components.

5.3.4 The Contractor will use green cables for all Network Cables for automated storage networking components.

5.3.5 The Contractor is responsible to ensure that all accountable government property, i.e. computer, computer displays, and servers, shall be delivered to the pharmacy procurement office at NIH Building 10 Room 1C-166.

5.3.6 The Contractor shall report all discrepancies noted that are not within the scope of this agreement to the NIH CC COR and the NIH CC Contracting Officer.

5.3.7 The Contractor is responsible to get any repair or replacement of components not within the scope of this agreement, which will result in additional cost approved by the NIH CC Contracting Officer prior to procurement of the component and installation.

5.3.8 NIH ORF policies and guidelines for pathway and infrastructure requirements must be followed and can be found at:

http://orf.od.nih.gov/PoliciesAndGuidelines/BiomedicalandAnimalResearc hFacilitiesDesignPoliciesandGuidelines/Pages/DesignRequirementsManual PDF.aspx

5.3.9 The Contractor shall provide and install all necessary wiring cables, conduit and backboxes.

5.3.10 The Contractor shall maintain record drawings of all installed components and associated wiring on building plans and provide these drawing on the completion of each unit to the NIH CC COR.

5.4 EHR ADT Interface

5.4.1 The automated storage system shall support an HL7 ADT from the NIH CC Clinical Research Information System (CRIS).

http://orf.od.nih.gov/PoliciesAndGuidelines/BiomedicalandAnimalResearchFacilitiesDesignPoliciesandGuidelines/Pages/DesignRequirementsManualPDF.aspx http://orf.od.nih.gov/PoliciesAndGuidelines/BiomedicalandAnimalResearchFacilitiesDesignPoliciesandGuidelines/Pages/DesignRequirementsManualPDF.aspx http://orf.od.nih.gov/PoliciesAndGuidelines/BiomedicalandAnimalResearchFacilitiesDesignPoliciesandGuidelines/Pages/DesignRequirementsManualPDF.aspx http://orf.od.nih.gov/PoliciesAndGuidelines/BiomedicalandAnimalResearchFacilitiesDesignPoliciesandGuidelines/Pages/DesignRequirementsManualPDF.aspx http://orf.od.nih.gov/PoliciesAndGuidelines/BiomedicalandAnimalResearchFacilitiesDesignPoliciesandGuidelines/Pages/DesignRequirementsManualPDF.aspx

5.4.2 The automated storage shall include an HL7 compliant interface (V2.2 – 2.5) to receive relevant patient information from the ADT system with the following functionality:

A. Ability for the data to be unidirectional from CRIS.

B. Ability to handle location updates and patient merges.

C. Mapping of standard ADT segment field components and subcomponents fields to be determined.

D. All updates shall be real time, but the automated storage Interface Engine shall buffer data for any interruption of service.

E. The automated storage system interface will send a positive or negative message acknowledgement for each received message.

5.4.3 The automated storage system shall store and display patient demographics.

5.4.4 The automated storage system shall store and display the visit reason which is the protocol study number as part of patient demographics. The format for the field is ##-[A-Z][A-Z]-####. Examples are 17-C-0234, 99-AG-0024.

5.5 EHR Order Interface

5.5.1 The automated storage system shall support an HL7 Medication Order Management Interface from the NIH CC Clinical Research Information System

(CRIS).

5.5.2 The automated storage system shall include an HL7 compliant interface (V2.2 – 2.5) to receive relevant order information from the EHR system with the following functionality:

A. Ability for the data to be unidirectional from CRIS.

B. Mapping of standard ORM/RDE segment field components and subcomponents fields to be determined.

C. All updates shall be real time, but the automated storage system Interface Engine shall buffer data for any interruption of service.

D. The System will send a positive or negative message acknowledgement for each received message.

5.5.3 The automated storage system shall store and display order information by patient, priority and dispense date/time.

5.5.4 The automated storage system shall store and display the protocol study number of the order as part of order information received in the order interface. The format of the field is ##-[A-Z][A-Z]-####. Examples are 17-C-0234, 99-AG-0024.

5.6 Server Specifications. These requirements are for any workstation or hardware provided to support the automated storage and inventory management system, such as the Data Analytics Component.

5.6.1 The Contractor shall provide detailed specifications for installation and configuration of all hardware components including virtualization, web services and database requirements. Actual installation and configuration of servers in government furnished computer racks will be performed by Contractor.

5.6.2 The Contractor will identify any and all licensing requirements for hardware, software, number of users, number of concurrent users, etc.

5.6.3 The Server/Database/Application Infrastructure must be supported to run on Windows Server 2016 R2, at a minimum. Windows Server 2016 is preferred but a plan to migrate to Windows Server 2016 within one year is acceptable.

5.6.4 The Server/Database/Application Infrastructure shall be updated monthly for security patches for vulnerabilities identified as critical, high or medium.

5.6.5 The Server/Application Infrastructure shall provide comprehensive tools for managing both client and server software configurations that minimize hands-on involvement of DCRI technical staff.

5.6.6 The Server/Application Infrastructure shall provide comprehensive security and confidentially features including, but not limited to, biometric, password suppression, audit capabilities required by HIPAA, FISMA, and the Privacy Act, and ability to restrict or require data fields.

5.6.7 The Server/Application Infrastructure shall include redundancy for any servers required for the system. Servers should be configured in a high availability configuration and be clustered. Servers can be setup as virtual in the NIH CC Virtual Environment.

5.6.8 The Server/Application Infrastructure shall support FIPS 140-2 validated encryption at rest for all servers to support the Integrated System. This includes file systems and databases.

5.6.9 The Server/Application Infrastructure may support virtual servers on VMWare vSphere 6 as part of the NIH CC Virtual Environment.

5.6.10 The Server/Application Infrastructure configuration of hardware will comply with NIH standards for security hardening and install the NIH toolset of required applications, which will be performed by NIH.

5.6.11 The Server/Application Infrastructure will require multiple agents on each Server.

These agents include but are not limited to: McAfee VirusScan 8.8 (Patch 8), FireEye, ForeScout, CA Asset Management Agent, CylancePROTECT Agent, Nessus Agent, VMWare Tools (virtual only), NetBackup Agent (physical only), EMC PowerPath (physical, SAN connected hosts only).

5.6.12 The Server/Application Infrastructure shall provide end-to-end encryption for data in transit in accordance with HHS Standard for Encryption of Computing Devices and Information (if web based the system must use SSL and be located behind the

CC DMZ).

5.6.13 The Server/Application Infrastructure shall provide data encryption of data at rest at both the hardware (f physical) and file level.

5.6.14 The Server/Application shall provide comprehensive system performance measurement tools and reports to allow continual monitoring and optimization of performance.

5.6.15 The Server/Application Infrastructure shall provide tools for notifying system administrators in the event of slowness.

5.6.16 The Server/Application Infrastructure shall provide tools for notifying system administrators in the event of system down.

5.6.17 The Server/Application Infrastructure shall provide the ability to monitor and record data storage device usage.

5.6.18 The Server/Application Infrastructure shall provide tools for automated updating of client software.

5.6.19 The Server/Database Management System (RDBMS) Infrastructure must be MS SQL 2012 enterprise or greater. MS SQL 2016 is preferred with plan to migrate to

MS SQL 2016.

5.6.20 The Server/Application/RDBMS must only utilize supported products.

Unsupported hardware, software, operation systems, applications and database management system versions must be replaced one (1) year prior to end of life.

5.6.21 The Server/RDBMS Infrastructure configuration shall support mirroring with at least two nodes with the always on feature turned on.

5.6.22 The Server/RDBMS Infrastructure configuration shall support encryption in accordance with HHS Standard for Encryption of Computing Devices and Information. All encryption solutions used throughout the Department and referenced throughout this document must be Federal Information Processing Standard (FIPS) 140-2 validated

5.6.23 The Server/RDBMS Infrastructure shall support both complete and incremental backup of database and system files. Backups shall be able to be performed with the system up or down and shall not require taking the system down.

5.6.24 The Server/RDBMS Infrastructure shall provide the capability for exporting of system files to allow system restore capabilities.

5.6.25 The Server/RDBMS Infrastructure shall provide a fail over capability so that the application will resume operations in the event of server failure.

5.6.26 The Server/RDBMS Infrastructure failover capabilities will not require human intervention.

5.6.27 The Server/RDBMS Infrastructure failover procedures will not require changes in client configuration such as server TCP/IP addresses.

5.6.28 The Server/RDBMS Infrastructure shall provide the ability to recover the database from backups and transaction logs.

5.6.29 The Server/RDBMS Infrastructure shall provide tools for monitoring and enhancing system performance and load distribution across servers.

5.6.30 The Server/Application/RDBMS Infrastructure shall provide tools for automated setup of client software so that software can be installed without Information Technology staff involvement at each client workstation.

5.6.31 The Server/Application/RDBMS Infrastructure shall provide version control for server software.

5.6.32 The Server/Application/RDBMS Infrastructure shall provide version control for structure changes in the database

5.7 Application Specifications. These requirements are for any application that is accessible via NIH Workstations such as System Configuration, System Administration, automated storage, inventory management and Data Analytics.

5.7.1 Applications shall have a consistent look and feel across modules and functions.

5.7.2 Applications shall be designed to utilize at least 1024x768 resolution when applicable.

5.7.3 Applications shall work across Windows 7, 8, 10, Mac OS platforms and CITRIX to include 32-bit and 64-bit platforms.

5.7.4 Applications shall support the following browsers: MS IE 11 and greater, MS Edge;

Google Chrome, Safari 9 and most current for MAC; and FireFox with the most current of each Internet Browser within 3 months of release

5.7.5 Applications shall not be dependent on browser specific controls.

5.7.6 Applications shall allow CC Administrators to set time-out duration based on organizational policy.

5.7.7 Applications shall provide the capability to exit with one keystroke or mouse-click after appropriate warnings have been acknowledged.

5.7.8 Applications shall provide a help file index.

5.7.9 All points of log into the application should allow a customizable warning banner.

This includes websites, mobile and desktop applications/software.

5.8 NIH Network Security/User Access Requirements.

5.8.1 The System shall require NIH Single Sign On/Active Directory for access.

5.8.2 The System shall provide the capability to automatically log users off after a specified period of inactivity using parameters that can be set by the system administrator.

5.8.3 The System shall provide restricted access to functions and patients based upon user class.

5.8.4 The System shall always display the current user name.

5.8.5 The System shall require ID & non-displaying password.

5.8.6 The System shall have an access model that accommodates a variety of secure access methods, including, but not limited to, biometric or token-based access, and different access procedures for devices located inside the NIH intranet).

5.8.7 The System shall require the use of a card reader and the NIH Smartcard for authentication.

5.8.8 The System shall monitor multiple failed attempts to logon by triggering a system alert.

5.8.9 The System shall monitor multiple (i.e., 3) failed attempts to logon by disabling the login id.

5.8.10 The System shall connect/link/access with NIH active directory or NED Database to load all eligible employees into the system initially and to maintain the user list as employees come on board and leave.

5.8.11 The System shall allow CC staff to assign privileges to individual users of the system.

5.8.12 The System shall provide the ability to set up and manage user access and privileges using role-based security. Security Roles, at a minimum,

5.8.13 The System shall allow CC staff to assign security rights, with the possibility of further customization based on individual need, to assign a group of privileges to any user based on their role or on organizational need.

5.8.14 The System shall provide the ability to assign/restrict rights/privileges to the security roles. Security Rights, at a minimum, A. ability to search for patient information B. ability to add new users to the system C. ability to change users’ roles and privileges

D. ability to create reports, data analytic dashboards E. ability to run specific reports F. ability to view specific data analytic dashboards G. ability configure reports and dashboards and assign to specific roles H. Ability to configure pathways, screens, choice lists selections.

5.8.15 The System shall log user sessions.

5.8.16 The System shall log access to patient data.

5.8.17 The System shall maintain an audit capability that will log access or modification of individual data elements and patient records viewed on reports.

5.8.18 The System shall log system events (i.e., add an event, issue a report request).

5.8.19 The System event field displays shall include event date and time.

5.8.19 If the System has any web components to include web sites or web services, the following HTTPS requirements must be met (refer to https://https.cio.gov/) :

A. A certificate that meets the guidance below:

Publicly validated TLS certificates, either from HHS or a public vendor for publicly facing websites. Internal sites are allowed to use HHS certificates. Self-signed certificates are prohibited from use.

TLS certificate uses SHA2 as a signature algorithm.

TLS certificate key length of at least 2048 bits.

Use of wildcards is strongly discouraged.

B. HTTPS Only: Only HTTPS shall be utilized for all websites and web services. The use of HTTP is prohibited.

C. Mixed Content: All content shall be served and referenced over HTTPS.

Linking to libraries, CSS, JS, fonts, iframes, etc. that load content not hosted on the server shall be served over HTTPS.

D. HTTP Strict Transport Security (HSTS): HSTS shall be enabled for any and all System web servers.

E. Perfect Forward Secrecy shall be enabled on all web servers.

F. The use of weak or deprecated ciphers shall not be used.

G. The NIH shall perform a web application vulnerability scan of any websites using the IBM AppScan commercial product. The vendor is responsible for remediating any vulnerabilities identified within the following timeframe:

HIGH and CRITICAL Vulnerabilities: 30 days

Medium Vulnerabilities: 45 days

LOW Vulnerabilities: 60 days.

H. The System shall ensure that the web site and servers are not vulnerable to the risks identified in the Open Web Application Security Project (OWASP) Top 10 list of web vulnerabilities (refer to www.owasp.org).

PART 6 – PROJECT MANAGEMENT, IMPLEMENTATION, SERVICE

6.1 PROJECT MANAGEMENT

6.1.1 The Contractor shall identify each key personnel to be assigned to this contract and a detailed resume shall be submitted for each key person proposed. The following personnel are considered key personnel by the government: Contract Manager, Contractor Project Manager, and Contractor Systems Engineer.

6.1.2 The Contractor shall identify each key personnel to be assigned to this contract and a detailed resume shall be submitted for each key person proposed. The following personnel are considered key personnel by the government: Contract Manager, Contractor Project Manager, and Contractor Systems Engineer.

6.1.3 The Contractor shall identify all prime and subcontractor(s), management and implementation personnel to be assigned to this project and describe their credentials, roles, responsibilities, and relationships to the contract and its implementation

6.1.4 The Contractor shall use Microsoft Project for providing a project plan to the NIH CC COR throughout the project deployment and across each task.

6.1.5 The Contractor shall provide a detailed draft plan with the proposal. (see technical questionnaire and exhibit table 1) The plan shall establish the budget, resource needs, major tasks and schedule for implementation required in accordance with American National Standards Institute/Electronic Industries Alliance (ANSI/EIA) Standard 748-A, Earned Value Management Standards, May 1998. The NIH CC and the Contractor will finalize the details such as specific dates and resources after award. The NIH CC and the Contractor will maintain the plan throughout the duration of the implementation work with regular updates provided by the Contractor.

6.1.6 The Contractor shall follow project management and project change management as part of the project implementation.

6.1.7 The Contractor shall submit the deliverables based on the content and timeframe identified under Technical Exhibit 1 – Deliverables Schedule.

6.1.8 The Contractor shall validate the Technical Exhibit 2 – Estimated Workload Data as part of the proposal.

6.2 TRAINING

6.2.1 The Contractor shall provide a Training Plan that encompasses all requirements proposed in the SOW. The plan shall be submitted with the Contractor proposal for consideration when making an award. Acceptance of training completion will be performed by the COR.

Training is complete when the NIH CC Staff are capable and competent to independently perform all required work specific to their role on the automated storage and inventory management system.

6.2.2 Schedule for training sessions shall be coordinated with the COR.

6.2.3 The Contractor shall train all staff members on the use of the system.

6.2.4 The Contractor shall provide at least six (6) training sessions.

6.2.5 The Contractor shall provide training that will include a period of live demonstration and observation of the staff using the system in each training session

6.2.6 The Contractor shall provide training materials to include quick reference guide(s) in addition to full documentation describing installation, support and troubleshooting steps.

6.2.7 The Contractor shall schedule on-site or virtual training prior to installation to be completed within two (2) weeks prior to installing the first items of the automated storage and inventory management system.

6.2.8 The Contractor shall provide training agendas, schedules, presentations, manuals and reference guides to the NIH CC COR prior to conducting any training.

6.2.9 The Contractor shall provide electronic training materials (e.g., CD-ROM, LMS and/or ongoing access to role specific computer based training) which shall also be accessible by staff unavailable to attend in person training, staff in need of refresher training or staff who are hired after the Contractor led initial training sessions.

6.3 SERVICE LEVEL MANAGEMENT AND SUPPORT SYSTEMS

6.3.1 The Contractor shall provide service management including routine and emergent service.

The NIH CC COR will determine the need for service and evaluate emergent and urgent conditions.

6.3.2 All repairs must meet equipment manufacturers’ specifications.

6.3.3 The Contractor shall provide manufacturer trained staff and train certified CC employees as factory trained technicians to be first responders for…