DHA Source Sought FINAL_07APR2020.pdf

SOURCES SOUGHT: W912DY-20-R-0039

Defense Health Agency (DHA) Regional Health Facilities Technical Services

This is NOT a Request for Quote or Proposal (RFQ/RFP).

This notice is open for responses exclusively for 8(a) program for small businesses in accordance with Federal Acquisition Regulation (FAR), Subpart 19.8.

The Government is seeking to identify qualified business sources under North American Industry

Classification System (NAICS) 541513 - Computer Facilities Management. The Small Business size standard is $30 million.

This notice is for market research purposes only and does not constitute a solicitation nor does it restrict the Government as to the ultimate acquisition approach. The Government will not reimburse respondents for any costs incurred in preparation of a response to this notice.

Responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. The Government does not intend to rank responses, provide any reply to interested companies and responses will not be returned. If the determination is made that there are not enough qualified and/or interested small businesses to perform this requirement, the

Government may solicit the acquisition as an unrestricted full and open competitive basis.

1. CONTRACT INFORMATION: The U.S. Army and Engineering and Support Center in

Huntsville (CEHNC), Alabama intends to solicit and award a contract to provide program management, and technical services in support of Facility Communication Distribution Systems

(FCDS) to the Defense Health Agency (DHA) Regional Health Facilities.

The primary place of performance will be at the following locations:

a. RHC-A G-6 Ft. Belvoir, VA

b. KACC Ft. Meade, MD

c. Andrew Rader Health Clinic - Joint Base Myer-Henderson Hall Ft. Myer, VA

d. Logan Dental Clinic, VA

e. BACH Ft. Campbell, KY

f. Rock Island Arsenal Clinic, IL

The firm fixed price, stand-alone contract is anticipated to be awarded in 2020 with a twelve (12) month base performance period and four (4), twelve (12) month optional periods, for a total performance period of five (5) years. The total value of this acquisition is approximately

$38,000,000.00.

2. PROJECT INFORMATION:

The Contractor shall provide onsite personnel to provide immediate direct technical operations support to the following:

a. RHC-A HQ G6

9275 Doerr Road

Ft. Belvoir, VA 22060

b. KACC

2480 Llewellyn Ave, Fort Georg G. Meade, MD 20755-5128

c. Andrew Rader Health Clinic - Joint Base Myer-Henderson Hall

401 Carpenter Road, Fort Myer, VA 22211

d. Logan Dental Clinic

Bldg. 1220

9225 Doerr Rd

Fort Belvoir, VA 22060

e. BACH Ft. Campbell, KY and outline clinics

650 Joel Drive

Ft. Campbell, KY 42223

f. Rock Island Arsenal Clinic

1 Rock Island Arsenal

BLDG 110

Rock Island, IL 61299

To accomplish these goals the Contractor shall provide day-to-day support in the following technical areas:

a. Program Management Support

b. Project Management Support

c. Network Administration and Engineering Support

d. Systems Administration and Engineering Support

e. Help Desk Support

f. Cyber Security Support

g. Management Analyst Support

The Government and Contractor shall work as a team and collectively provide the FCDS support services that DHA Regional Health Facilities need. The Contractor shall devise an overall management approach and the activities necessary to perform the core functions required under this contract. The approach will define how technical management of the services, including functions, tasks, costs, schedules, and risks will be performed and managed under the contract. In devising the approach, the Contractor shall be consistent with the Government’s program management requirements, (e.g., Quality Management, Continual Service Improvement, Performance Management, Risk Management, and Information Technology Service

Management (ITSM)) in support of the delivery of the FCDS support services (Attachment 2:

Draft PWS).

3. SUBMISSION REQUIREMENTS

Interested business firms who meet the capability requirements identified in this notice are requested to reply to this notice with a response to the Capability Questionnaire (Attachment 1).

If no experience or capabilities are associated with a particular question, so indicate. Based upon responses received from both small and other than small businesses, consideration will be given to define an acquisition approach that provides maximum practicable opportunities and participation for small business programs.

Interested firms should submit detailed responses to the Capabilities Questionnaire (Attachment

1) which furnishes information describing relevant experience and qualifications in the following format:

Submission shall be received NO LATER THAN: 2:00 p.m. Central Time, Tuesday, April 21, 2020; and should not exceed ten (10) one-sided, 8 1/2” X 11” pages using no smaller than 12 sized font. Computer files must be compatible with Microsoft Word 2017.

NO HARD COPY OR FACSIMILE SUBMISSIONS WILL BE ACCEPTED.

Cover letters and extraneous materials (brochures, etc.) will not be considered.

Submit responses and questions concerning submissions to CEHNC-DHA-Regional-

Facilities@usace.army.mil and Robin.L.Boateng@usace.army.mil.

Office visits or site visits to meet with CEHNC personnel for the purpose of discussing this announcement will not be scheduled.

This notice does not restrict the Government as to the ultimate acquisition approach.

4. Additional information

Contracting Office Address:

USACE HNC, Huntsville, P. O. Box 1600, Huntsville, AL 35807-4301

Place of Performance:

Locations identified in the PWS

USACE Point of Contact(s):

Kijafa Johnson-Cooper, Contracting Officer

USACE HNC, Huntsville

Robin Boateng, Senior Contracting Specialist

USACE HNC, Huntsville

Interested parties are responsible for monitoring modifications to this notice and a draft PWS has been posted with this notice.

Attachment 1

CAPABILITIES QUESTIONNAIRE

Huntsville Engineering and Support Center provides program management and acquisition support to the Defense Health Agency (DHA) for medical facilities including hospitals and clinics. It is the Government’s intent to conduct frequent market research to identify industry capabilities and interest in potential upcoming requirements in support of the DHA mission.

The Government encourages you to respond to this request for information as it may be used for several acquisitions as they arise within the next 6 months. It is also the Government’s intent to annually refresh this market research.

SECTION 1. GENERAL

DUNS: _______________ CAGE Code: ___________

A. Business Name: (Insert Business Name

B. Business Address: (Insert Business Address)

C. Is your firm registered under the NAICS code 541513: Computer Facilities Management

(Yes or No)

D. Responsible Point of Contact:

Name: (Insert Name)

Telephone: (Insert Telephone Number)

Email: (Insert Email Address)

SECTION 2. TYPE OF BUSINESS: (check all that apply)

8(a) small business Service-disabled veteran-owned small business

Veteran-owned small business HUB Zone small business

Women-owned small business Small Disadvantaged business

Small business Large Business

When do your graduate from 8(a) program: Insert Date

Who is your SB Specialist?

Name: (Insert Name)

Telephone: (Insert Telephone Number)

Email: (Insert Email Address)

Experience:

Number of years/months in business executing technical service for facility communication projects: ________years ______ months

CONTRACTOR ARRANGEMENT

Our firm will most likely be proposing on this project as a:

Joint Venture with (Insert business name, business size, and cage code).

Refer to FAR subpart 9.6 for Government policy on teaming arrangements, as well as

8(a)Program regulations described in 13 CFR 124.513, HUBZone Program regulations described in 13 CFR 126.616, and Service-Disabled Veteran-Owned Program regulations described in FAR 19.1403(c) and 13 CFR 125.15(b).)

Sole Contractor, self-performing 100% of the work

Prime Contractor (Small Business), self-performing at least 50% of the work

Prime Contractor (Small Business) performing at least 50% of the work with the following team member subcontractor(s) (Insert business name, business size, cage code, and work which will be subcontracted)

Subcontractor, performing less than 50% of the work for (Insert business name, business size, cage code, and work which will be done)

Other – explain_________________________

SECTION 3. CAPABILITY

A. Our firm is/ is not capable of performing at least 25%, but not more than (insert percentage) of the cost of the contract (not including the cost of materials) with its own employees.

B. Our firm has had the following number of contracts relevant to this requirement:

2-5 6-10 11-15

16-20 21-30 30+ orders

C. Has your firm been awarded any Federal contract in the past three (3) years?

Yes No

D. Your highest valued relevant contract was $_______________ . Please describe your firm’s role in this project and the services your firm executed.

For The Remaining Responses, Read In Its Entirety To Ensure All Points Are Addressed In Your

Response(S). Negative Responses Are Needed So Please Do Not Leave Any Section Blank.

Program Management & Retention

1. Describe your capability and experience with recruiting and retaining professional certified personnel in accordance with DoD 8570.1M. What sort of reach-back capability does your firm have?

2. Describe your ability to manage programs in an environment with competing priorities and potential pilot programs.

3. Provide examples of how you have met or exceeded Service Level Requirements or metrics for previous contracts. Did you serve as the prime contractor, Joint Venture partner

(indicate if controlling or not) or sub-contractor for the effort. What were the best practices employed to ensure success.

Help Desk Support

1. Describe your experience and past performance with Remedy Ticketing and Help Desk

Support?

2. Describe your experience with Problem/Resolution Processes as it relates to the following:

a. Response time expectations for all levels of severity

b. Average time to close tickets by severity level

c. Escalation Process

d. Severity Level System

e. Issue/Resolution Tracking System

f. Test System vs. Live System

3. Describe your experience for providing Help Desk support within a clinical or hospital environment?

4. Describe the process you use to complete a EUD Refresh in a medical environment.

System/Network Engineering & Administration Support

1. Describe your capability and experience providing services related to delivering solutions for turnkey systems. This includes, but not limited to highly complex architecture, program and technical assistance planning networks, designing infrastructure, and supporting these highly complex network infrastructures for voice, data and video networks.

2. Describe your capability and experience providing services related to delivering virtual infrastructure solutions for turnkey systems. This includes, but not limited to highly complex production, staging and development environments.

3. Describe your capability and experience providing services related to delivering storage and backup solutions within a highly complex environment.

Database Administration

1. Describe your experience for the maintenance, support and enhancement of medical databases to include evaluation planning requirements analysis, design, optimization, testing, implementation and sustainment of new and existing mission databases.

2. Does your work include responsibility for Contingency Planning, backup and recovery strategies, and Configuration Management? If so, please discuss your experience and capability to ensure the industry standard principles are used.

Health Informatics

1. Describe your experience supporting and maintaining DoD Electronic Health Experience with Data Management and Sharing Plans; ensuring data is FAIR (findable, accessible, interoperable, and reusable).

2. Explain what tools or software you have used in the past to conduct Virtual training.

3. Describe your experience with life cycle management, maintenance of clinical system implementation, integration and deployment.

4. Describe your knowledge and experience on the expertise and skillsets of generating clinical system related data mining and AdHoc reports using relational database management system (RDBMS) query tools, SQL language, and post relational database query tools such as CHCS CACHE.

Cyber Security

1. Describe your engineering and design experience and capabilities dealing with Cyber

Security architecture and capabilities such as firewalls, web filtering appliances, Anti-spam and Network Access Control hardware and software.

2. Describe your experience analyzing networks and systems to identify potential security weaknesses and threats.

3. Describe your experience and capabilities designing VPN connections on unclassified networks.

4. Describe your capabilities and experience maintaining Type 1 encryption on non-classified but sensitive networks.

5. Describe your experience with application/software lifecycle management (ALM/SLM).

6. Describe your experience maintaining interfaces with external networks, including but not limited to, malware inspection, URL and HTTP filtering.

7. Describe your experience and capabilities monitoring and conducting incident response, to include enterprise-wide malware scans.

8. Security Incident and Event Management (SIEM) Services – Describe your experience and capabilities providing:

a. Intrusion Management Services

b. Security Incident Handling Services

c. Digital Forensic capabilities

d. Audit and Accountability Services

e. File Removal Services

9. Describe your experience and capabilities with Risk Management Framework (RMF) accreditation support, to include records maintenance in eMASS.

10. Describe your experience and capabilities conducting Assess only and Assess and

Authorize security control testing.

11. Describe your capability and experience providing services related to RMF within a medical environment.

12. Provide any other pertinent information pertaining to capabilities and experience in this area.

Attachment 2

Performance Work Statement

DEFENSE HEALTH AGENCY (DHA) REGIONAL HEALTH FACILITIES

FACILTY COMMUNICATION DISTRIBUTION SYSTEMS (FCDS) SUPPORT

SERVICES

9 March 2020

Period of Performance: 1 September 2020 – 30 August 2025

PART 1

GENERAL INFORMATION

1 INTRODUCTION

1.1 Description of Services: The purpose of this requirement is to provide technical services in support of Facility Communication Distribution Systems (FCDS) to the Defense Health

Agency (DHA) Regional Health Facilities. These facilities are comprised of Regional

Health Command Atlantic (RHC-A) Headquarters G-6 located at Ft. Belvoir, Virginia

(VA), Kimbrough Ambulatory Care Center (KACC) located at Ft. Meade, Maryland

(MD), Andrew Rader Health Clinic - Joint Base Myer-Henderson Hall located at Ft. Myer, VA, Logan Dental Clinic located at Ft. Belvoir, VA, Blanchfield Army Community

Hospital (BACH) located at Ft. Campbell, Kentucky (KY), and Health Service Area

(HSA) at Rock Island Arsenal Clinic located at Rock Island, Illinois (IL). The

Government’s objective through this acquisition is to acquire innovative, customer-focused, cost-effective enterprise FCDS by applying industry best business practices in addressing mission requirements. While most day-to-day work involves continuation of existing services and is centrally funded, certain projects require service, installation, and support of FCDS resources for configuration of engineering and Help Desk support. Other projects require rapid response and flexible service, installation, and support of FCDS resources for Emergency Operations response efforts.

1.2 Background: RHC-A is still experiencing a revolutionary transformation. As of 01

October 2019, with approval from the Secretary of the Army followed by operational order from U.S. Army Medical Command, RHC-A has begun transitioning its Medical

Treatment facilities and all Information Technology (IT) functions to DHA Health IT.

Army and MEDCOM leadership is also working to transform MEDCOM/OTSG to a medical readiness platform. As a result of the reorganizational process, RCH-A G6 is no-longer tasked with the responsible of transition MTF IT functions to DHA. RHC-A is tasked with continued world class IM/IT support for a medical Army assets within the

AOR until DHA markets are stood up and certified. RHC-A G6 is responsible for RHC-A

HQ IT transformation tasks, activation planning and support of its new readiness support functions/mission. During the transition, RHC-A G6 must maintain its current level of operational support to the following medical facilities; Eisenhower Army Medical Center, Ft. Gordon, Ga., Martin Army Community Hospital, Ft. Benning, Ga., Winn Army

Community Hospital, Ft. Stewart, Ga., Fox Army Health Center, Redstone Arsenal, Ala., Lyster Army Health Clinic, Ft. Rucker, Ala., Blanchfield Army Community Hospital, Ft.

Campbell, Ky., and Moncrief Army Community Hospital, Ft. Jackson, S.C.

BACH and KACC are state of art world-class medical care healing environments and leads military medicine through outstanding patient-centered care, innovation, and excellence.

KACC is an out-patient ambulatory care facility part of a comprehensive health care network, which encompasses four medical care facilities and one toxicology lab.

Fort Meade Medical and Dental Activity (MEDDAC)’s primary mission is to build readiness of the force we serve with as well as build a medically ready force at each of our installations consisting of more than 64,000 enrollees and over 143,000 eligible beneficiaries with 60% of those eligible beneficiaries at Kimbrough (Ft Meade) and Rader

(Ft Myer). 43% of our 19,500 Active Duty enrollees come from other than Army services.

Our organization consists of five major Military Treatment facilities (MTF) geographically distributed across three states and the District of Columbia (DC) spread over a distance of

296 miles supporting five Active Army Installations. Almost all of the MEDDAC’s subordinate MTFs have additional outlying clinics to support (children MTFs have children sites). The headquarters of our MEDDAC is at Fort Meade, MD where we support a host of DoD organizations on one of the busiest Army posts in CONUS. Fort

Meade supports embedded military in the National Security Agency (NSA), multiple

Brigades from United States Army Intelligence & Security Command (INSCOM), CYBER

Command, and many other DoD, Office of the Secretary of Defense (OSD), Office of the

State Auditor (OSA) organizations. In the DC area we have clinics at both Joint Base

Meyer-Henderson Hall and Fort McNair primarily supporting IMCOM, Military District of

Washington, National Defense University, and Marines. The Fort Meade DENTAC is a separate Command but shares a similar footprint with our organization. We are intertwined partners charged with improving readiness of the force and cannot be separated. They also cover Fort Belvoir installation for dental support. Our total staffing consists of 1288 staff / visiting in the MEDDAC and 170 in the DENTAC.

BACH (USA MEDDAC-Ft. Campbell) support ready Soldiers and healthy Families through high quality, safe, accessible health care; while relentlessly pursuing improvement, providing outstanding service, leveraging innovative technology and developing the next generation of Army healthcare leaders. BACH provides a premier healthcare delivery platform with the best trained, most highly disciplined staff, and adaptable organization that gives our Army an unmatched medically ready military force. BACHs available services include Primary Care, Emergency Room, Internal Medicine Subspecialties, Dermatology, Behavioral Health (BH), Obstetrics, Optometry, Orthopedics, General

Surgery, Inpatient Surgical, Surgical Subspecialties, Inpatient BH, Audiology, Urology, Ear, Nose, and Throat (ENT), Occupational Therapy, Physical Therapy, Nutrition, and

Virtual Health. Subordinate elements to BACH include the Warrior Transition Unit, National INTREPID Center of Excellence (NICoE) and Screaming Eagle Medical Home

(SEMH). USA MEDDAC-Ft. Campbell assumes HSA responsibility of Rock Island

Arsenal Clinic (IL) and Occupational Health (Ft. McCoy, WI). BACH services a patient population of over 73,600 Active Duty Military, AD Family Members, Retirees and beneficiaries.

1.3 Mission: The mission of the DHA Regional Health Facilities is a commitment to outstanding patient experience through safe, quality, compassionate care for all served.

RHC-A HQ G6, KACC, Ft. Myer, Logan Dental Clinic at Ft. Belvoir BACH, and Rock

Island Arsenal Clinic are committed to maximize operational readiness and keep the uniformed services fit to fight, deliver quality primary and tertiary care in a customer focused environment, provide distinguished graduate/undergraduate medical education, professional education and research, and to develop and export innovations in healthcare services and informatics.

RHC-A HQ G6

Assistant Chief of Staff for Information Management’s (ACSIM) primary mission is to provide policy, planning, guidance, technical expertise, and management oversight of enterprise initiatives, programs, and projects throughout the region.

BACH

Inpatient/Outpatient Services: Primary Care, Internal Medicine, Surgery / General Surgery, Behavioral Health, Inpatient BH, Emergency Medicine, Nutrition Care, Audiology, Optometry, Orthopedics, Internal Medicine, Occupational Therapy, Ophthalmology, ENT, Inpatient Medicine, Inpatient Surgical, Obstetrics and Gynecology (OB/GYN), and

Inpatient Maternal/Child services.

KACC

Outpatient Services: Primary Care, Internal Medicine, Surgery / General Surgery, Behavioral Health, Nutrition Care, Audiology, Optometry, Ophthalmology, ENT

Orthopedics, Internal Medicine, Occupational Therapy, outpatient Surgical, OB/GYN, and pediatrics.

1.4 Scope: DHA Regional Health Facilities are challenged by ongoing support of programs such as Warrior Care, new opportunities for collaboration and mission integration of health services; and new requirements for support brought on by the fielding of new operations and sustainment of new medical information systems and the implementation of the electronic health record throughout our region. The purpose of this contract is to provide program management, technical support in direct support of this emerging business and transformation of the DHA Regional Health Facilities. The Government’s objective through this acquisition is to acquire innovative, customer-focused, cost-effective enterprise MCITS by applying industry best business practices in addressing DHA

Regional Health Facilities mission requirements. The Contractor shall provide non-personal services, personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items identified in this Performance Work Statement

(PWS).

This requirement includes regional MCITS as defined in this PWS. The Contractor shall perform to the standards in this PWS. The Contractor is required to provide FCDS support services to DHA Regional Health Facilities and its subordinate units. Work shall be performed onsite at RHC-A HQ G6, KACC, Ft. Myer, Logan Dental Clinic at Ft. Belvoir

BACH, and Rock Island Arsenal Clinic or any of its outlying clinics. Inherent in providing these services, the Contractor shall provide the supervision and management effort necessary for efficient and effective administration and control of work performed.

Government will provide oversight of the overall Contractor performance but will not exercise direct supervision over the contract service providers performing the services herein.

The Contractor shall provide onsite personnel to provide immediate direct technical operations support to the following:

a. RHC-A G-6 Ft. Belvoir, VA

b. KACC Ft. Meade, MD

c. Andrew Rader Health Clinic - Joint Base Myer-Henderson Hall Ft. Myer, VA

d. Logan Dental Clinic, VA

e. BACH Ft. Campbell, KY

f. Rock Island Arsenal Clinic, IL

To accomplish these goals the Contractor shall provide day-to-day support in the following technical areas:

a. Program Management Support

b. Project Management Support

c. Network Administration and Engineering Support

d. Systems Administration and Engineering Support

e. Help Desk Support

f. Cyber Security Support

g. Management Analyst Support

1.5 General Information: The Government and Contractor shall work as a team and collectively provide the FCDS support services that DHA Regional Health Facilities need.

The Contractor shall devise an overall management approach and the activities necessary to perform the core functions required under this contract. The approach will define how technical management of the services, including functions, tasks, costs, schedules, and risks will be performed and managed under the contract. In devising the approach, the

Contractor shall be consistent with the Government’s program management requirements, (e.g., Quality Management, Continual Service Improvement, Performance Management, Risk Management, and Information Technology Service Management (ITSM)) in support of the delivery of the FCDS support services.

1.5.1 Place of Performance: The primary place of performance will be at the following locations.

g. RHC-A HQ G6

9275 Doerr Road

Ft. Belvoir, VA 22060

h. KACC

2480 Llewellyn Ave, Fort Georg G. Meade, MD 20755-5128

i. Andrew Rader Health Clinic - Joint Base Myer-Henderson Hall

401 Carpenter Road, Fort Myer, VA 22211

j. Logan Dental Clinic

Bldg 1220

9225 Doerr Rd

Fort Belvoir, VA 22060

k. BACH Ft. Campbell, KY and outline clinics

650 Joel Drive

Ft. Campbell, KY 42223

l. Rock Island Arsenal Clinic

1 Rock Island Arsenal

BLDG 110

Rock Island, IL 61299

1.5.2 Hours of Operation: The requirement for Contractor support services will vary depending on the hours of operation of the supported location. The hours of duty for

DHA Regional Health Facilities and ancillary units may change. Depending on mission requirements, the Contractor shall be required to provide service outside of normal operating hours (to include rotating shifts, weekdays, weekends, and Federal Holidays).

The Contractor shall request to make work week adjustments to meet mission requirements.

1.5.3 RHC-A Support Hours: Contractor shall have 100% coverage 0900-1500 daily. Peak

IT support hours are 0630 to 1700.

KACC Support Hours: Contractor shall have 100% coverage 0900-1500 daily. Peak IT support hours are 0630 to 1700.

Andrew Rader Health Clinic - Joint Base Myer-Henderson Hall Support Hours:

Contractor shall have 100% coverage 0900-1500 daily. Peak IT support hours are 0630 to

1700.

Logan Dental Clinic Support Hours: Contractor shall have 100% coverage 0900-1500 daily. Peak IT support hours are 0630 to 1700.

BACH Support Hours: Contractor shall have 100% coverage 0900-1500 daily. Peak IT support hours are 0630 to 1700.

Rock Island Support Hours: Contractor shall have 100% coverage 0900-1400 daily.

Peak IT support hours are 0700 to 1600.

1.5.4 Recognized Holidays: Contractor is not required to perform services on the federal holidays listed below.

New Year’s Day

Dr. Martin Luther King’s Birthday

Presidents Day

Memorial Day

Independence Day

Labor Day

Columbus Day

Veteran’s Day

Thanksgiving Day

Christmas Day

In the case of emergency situations, (e.g. network outages, critical system outages, account lockouts for emergency department users, natural disasters, etc.), the Contractor shall be required to perform services on federal holidays and shall have staff designated as “on call” to respond. When responding to system wide outages, on-call personnel will need to notify the Government program manager once they arrive onsite and upon completion of service request.

1.5.5 Inclement Weather: The Government may designate certain Contractor positions as emergency/key essential positions which are required to support vital services during inclement weather, base closure or other situations. Those positions will be determined on a case by case basis.

1.5.5.1 Location Delays: Delays issued by the Office of Personnel Management (OPM) are not applicable to Contractors and may not always be consistent with the operating hours of DHA Regional Health Facilities because of the nature of the healthcare services it provides. As a result, OPM delays shall trigger specific communication and coordination between Contractor employees and the Site Manager for coordination with the Contracting Officer Representative (COR) to designate specific hours of operation for Contractors during delays. The COR and Site Manager will take into consideration the safety of personnel given the conditions and may implement mechanisms for remote support using “situational telework” for some tasks as defined in section 1.5.11.3.

Remote support shall be the exception and not the norm.

1.5.5.2 Location Closures: The Site Manager and COR shall coordinate and communicate regarding planned closures and as soon as possible for unplanned closures so that

Contractor personnel can be notified quickly.

The Contractor shall obtain authorization from the COR, or their designee, when the

Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

The Contractor shall include narrative which addresses the lines of communication and escalation for inclement weather, specifically delays and closures. (Contract Data

Requirements List (CDRL) A001 – Communication Plan)

1.5.6 Utilities: The Government will provide all utilities within federal facilities. These utilities will be available for the Contractor’s use in performance of tasks outlined in this

PWS. The Contractor shall instruct employees in utilities conservation practices. The

Contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after use.

1.5.7 Quality Control: The Contractor shall develop, maintain and execute an approved quality control plan (QCP). This quality control plan shall define processes to monitor

Contractor performance at applicable PWS locations and ensure compliance with the requirements of this contract and applicable regulatory guidance. The Contractor’s QCP shall delineate procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor shall electronically submit a comprehensive, written QCP to the

COR within 30 days of contract award. The QCP shall be reviewed by the Government before acceptance. After review of the quality control plan, the COR will provide the

Contractor with written acceptance or rejection of the QCP along with any proposed changes. (CDRL A002 – Quality Control Plan)

1.5.8 Quality Assurance: The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government will monitor to ensure Contractor compliance in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). The Government may unilaterally adjust the QASP to evaluate the Contractor’s quality performance.

1.5.9 Safety: In accordance with Federal Acquisition Regulation 52.236-13, Alt I, Accident

Prevention (FAR 52.236-13), the Contractor shall comply with the latest version of U.S.

Army Corps of Engineers (USACE) Safety and Health Requirements Manual 385-1-1, including any updates and interim revisions, in effect at the time of the solicitation. All federal, state, and local (including host nation laws), e.g., the Occupational Safety and

Health Administration (OSHA) requirements (29 CFR 1910 and 1926), and installation/site safety requirements will be followed, the most stringent requirements will govern. If contractor deems the EM 385-1-1 or certain safety procedures are not required;

they can submit a variance/waiver to the Safety Office per the EM 385-1-1 Appendix D.

The variance/waiver shall be submitted to the Government by cover letter from the

Contractor for review and acceptance.

1.5.10 Security Requirements: The Contractor shall comply with Department of Defense

Instruction (DoDI) 8500.01 Cyber Security, Department of Defense Directive (DoDD)

5400.11, Department of Defense (DoD) Privacy Program, DoDI 6025.18, Privacy of

Individually Identifiable Health Information in DoD Health Care Programs, and

Department of Defense Manual (DoDM) 5200.02, Procedures for the DoD Personnel

Security Program (PSP).

1.5.10.1 Personnel Security: All Contractors are required to have a minimum of a National

Agency Check with Law and Credit (NACLC) security investigation for suitability with a favorable adjudication for employment at RHC-A HQ G6, KACC, Ft. Myer, Logan

Dental Clinic at Ft. Belvoir BACH, and Rock Island Arsenal Clinic. Contractor personnel shall be required to obtain and maintain DHA Regional Health Facilities security badges and adhere to the installation security requirements. Contractor responsibilities for ensuring personnel security include meeting the following requirements:

1.5.10.1.1 Upon award of the contract, the Contractor shall immediately contact the COR for processing procedures to meet the security requirements, for information needed to access DHA Regional Health Facilities sites.

1.5.10.1.2 In accordance with (IAW) Army Regulation 525-13, paragraph 5-19, all prospective

Contractor Personnel shall undergo a verification process to determine the trustworthiness and suitability prior to being granted access to federal property.

Limited access with escort may be granted (at the installation's discretion) for an interim period while investigations are being conducted.

1.5.10.1.3 Contractor personnel shall comply with the DoD and DHA Regional Health Facilities personnel identification and access requirements. At all times, each Contractor personnel shall wear a visible security badge identification (ID), provided by the DHA

Regional Health Facilities in accordance with its guidance.

1.5.10.1.4 The Contractor shall follow the DHA Regional Health Facilities Security Office guidelines for submittal of IT background investigations and security clearances and ensure all Contractor personnel are designated as IT-I, IT-II, or IT-III where their duties meet the criteria of the position sensitivity designations. The Contractor shall contact the DHA Regional Health Facilities Cybersecurity Office for guidance on the appropriate IT levels for personnel on the agreement. DoD Guidance defines IT-I as the System Administrator (SA) responsible for the servers in the data center supporting MCITS and Network Administrator (NA)’s responsible for DHA Regional

Health Facilities infrastructure. Those with privileged accounts IT-II are those administrators responsible for common network applications, operating systems administrators, those with limited privileged accounts. IT-III are typically power users, SAs for individual systems w/limited privileged accounts and regular user populations that have non-privileged accounts.

1.5.10.1.5 DoD 5200.2-R, the DoD Personnel Security Program, requires Contractor personnel performing work on sensitive automated information systems (AIS)s to be assigned to positions which are designated at one of 3 sensitivity levels. These designations equate to Critical Sensitive and Non-Critical Sensitive positions as defined in Army regulations and guidance from Department of Army (DA). IT Level – I – Individuals assigned to positions where damage to DoD/DA networks and development systems can be accomplished and no checks are in place to determine potential destruction of sensitive information. This includes SA’s responsible for the servers in the data center supporting MCITS and NA’s responsible for infrastructure. The investigation requirement for these positions is completion of a Special Security Background

Investigation (SSBI) with favorable results. Foreign National personnel may not be assigned to IT Level –I positions. IT Level – II and III – Individuals assigned to positions where daily unsupervised access to DoD networks and information systems containing Sensitive but Unclassified or Sensitive Classified up to and including

Collateral Secret information is a portion of their duties. The investigation requirement for these positions is completion of a Defense National Agency Check with Written

Inquiries (NACI) with favorable results. For positions identified as IT – II and III, foreign nationals may be appointed if they: Possess a unique or unusual skill or expertise that is urgently needed for a specific DoD requirement and for which a suitable United States citizen is not available, and approved in writing by the cognizant

Designated Approving Authority (DAA). However, under no circumstances can these individuals be assigned before completion and favorable adjudication of the appropriate security investigation. DHA Regional Health Facilities retain the right to request removal of Contractor personnel, regardless of prior clearance or adjudication status, whose actions while assigned to this contract are determined to be detrimental to the overall performance of the contract or the best interests of the Government as determined by the Contracting Officer (KO). The reason for the request for removal will be fully documented in writing by the COR and submitted through the KO for approval and issuance to the Contractor.

1.5.10.1.6 The Contractor shall ensure individuals assigned to these sensitive positions have completed the appropriate access request forms.

1.5.10.1.7 The Contractor shall forward employee investigation information to the designated

Government Representative before assignment of these individuals.

1.5.10.1.8 The Contractor shall ensure personnel have the proper security clearances, have read and signed the User Agreement, and have completed Cyber Awareness Challenge training prior to being granted access to networks and/or systems.

1.5.10.1.9 Contractor employees accessing the Government network are required to be citizens of the United States and must maintain that status for the duration of the contract. The

Contractor shall submit verification of this check for each employee accessing the

Government network on the task prior to the employee beginning work.

1.5.10.1.10 SubContractor employees shall be considered Contractor employees for the purpose of Security Requirements.

1.5.10.1.11 The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to

Sensitive Information (SI).

1.5.10.1.12 The Contractor shall immediately report to the DHA Regional Health Facilities

Security Office and deny access to any AIS, network, or SI information if a Contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for security reasons.

1.5.10.1.13 Government Issued Common Access Card (CAC): Proof of employment and security clearance/favorable background check is required before an ID CAC will be issued authorizing access to the Installation and Government computer systems.

CACs may not be issued to Contractors unless a data record authorizing CAC issuance is resident in the Defense Enrollment Eligibility Reporting System (DEERS). The

Trusted Associate Security System (TASS) was developed as a secure and authorized means of entering Contractor data into DEERS in addition to automating the CAC application and approval process. In order to enter Contractor data into TASS, the

Contractor’s data must be resident in an authorized source database. The Joint

Personnel Adjudication System (JPAS) is that authoritative source. The Contractor’s

Facility Security Office (FSO) shall ensure its employee(s) has a record in JPAS prior to its employee(s) requesting a CAC be issued. Contractors without JPAS accounts may request accounts by following the instructions provided in the Frequently Asked

Questions (FAQ) topic “How do I get a JPAS account (Industry Users)?” found on the

JPAS website, https://jpas.dsis.dod.mil/faq-gen.html. Personnel eligible for a CAC who are not in JPAS (i.e., certain Contractors, Foreign Nationals, and DoD affiliates) will be required to register at a site where an equivalent background vetting will be accomplished IAW Federal Information Processing Standard (FIPS) 201.

1.5.10.1.14 The Contractor shall return all issued United States (U.S.) Government Common

Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a Contractor employee no longer requires access to the installation or facility.

1.5.10.2 Information Security: The Contractor shall be responsible for safeguarding information of a classified, sensitive, or privileged nature. Failure to safeguard any classified/sensitive/privileged information that may involve the Contractor or the

Contractor’s personnel or to which they may have access may subject the Contractor https://jpas.dsis.dod.mil/faq-gen.html and/or the Contractor’s employees to criminal liability under Title 18, section 793 and

798 of the United States Code. Provisions of the Privacy Act apply to all records and reports maintained by the Contractor. All programs and materials developed at

Government expense during the course of this contract are the property of the

Government.

1.5.10.2.1 The Contractor shall provide physical security for all material, equipment, data, and information handled during order performance, in accordance with DoD 5200.08-R, Physical Security Program (Sensitive and Non-sensitive), and command policies, procedures, and regulations. Accountability of all government equipment will be coordinated through the office of the administrative officer or supply technician. No government equipment will be moved or transferred without documentation or authorization.

1.5.10.2.2 The Contractor shall perform operations on, have access to, or handle data and information that contain sensitive, proprietary, or Privacy Act information or data.

The Contractor shall handle sensitive information in accordance with the Department of Defense Contract Security Classification Specification.

1.5.10.2.3 The Contractor shall obtain a NACLC for all personnel assigned to this contract and sign a Non-Disclosure Agreement (NDA), Conflicts of Interest (COI), and Rules of

Conduct Certificate to be provided at time of award. Each task will specify appropriate IT levels and security clearance requirements for the tasks performed.

Individuals who have been barred or were previously barred from the installation pursuant to Title 18 U.S.C. Section 1382 shall not be allowed to enter or work on

DHA Regional Health Facilities.

1.5.10.2.4 The Contractor shall be required to gain access to DoD networks for performance of this task and shall follow all guidelines and policies established for the use of these networks. As such, Contractor personnel will undergo appropriate background investigation and security awareness training. The Contractor shall be prepared for this process to take at least two (2) weeks, if not longer. The Contractor shall submit the appropriate forms for background investigation to the Office of Personnel

Management and obtain receipt confirmation.

1.5.10.2.5 Upon termination of a Contractor employee from this DHA Regional Health Facilities

FCDS support services contract, the Contractor shall notify the DHA Regional Health

Facilities COR of the action within 24 hours or no later than the next business day, including the termination date.

1.5.10.3 Health Insurance Portability and Accountability Act (HIPAA): The Contractor shall comply with the HIPAA (P.L. 104-191) requirements, specifically the administrative simplification provisions of the law and the associated rules and regulations published by the Secretary, Health and Human Services (HHS) and the published DHA implementation directions. This includes the Standards for Electronic Transactions, the

Standards for Privacy of Individually Identifiable Health Information and the Security

Standards. It is expected that the Contractor shall comply with all HIPAA-related rules and regulations as they are published and as DHA requirements are defined (including identifiers for providers, employers, health plans, and individuals, and standards for claims attachment transactions).

1.5.10.4 Disclosure of Protected Information: If, during the performance of this procurement, Contractor personnel obtain access, by any means, to protected information, including trade secrets or proprietary information of other Contractors, Government source selection information, HIPAA, Privacy Act information, or any other information with distribution limited by the Government, Contractor personnel will in no way divulge any such information except as it relates to the performance of this procurement within

DHA Regional Health Facilities, or shall not otherwise use or disclose this information for their personal gain, the gain of their employer, or the gain of anyone else. Contractor personnel will notify the KO, their Task Manager, or the COR of any potential organizational conflict of interest created by any such access. A nondisclosure agreement, however, will not overcome an Organizational Conflict of Interest (OCI) as defined in Federal Acquisition Regulation (FAR) part 9.5. Moreover, compliance with the Trade Secrets Act requires the consent of the owner of the proprietary information before another non-federal entity may be allowed access to such information.

Accordingly, all Government Contractors are required to mark their proprietary information; any time the Contractor is given access to such marked information, it is incumbent upon the Contractor to inform the KO of the access. Contractor personnel ordinarily will be required to sign a nondisclosure agreement before starting work under the agreement. Failure to comply with this clause shall be deemed adequate cause for the removal of a Contractor employee from employment with the Contractor. The

Contractor’s employment contracts with its employees will include a provision to provide for their removal under these conditions.

1.5.10.5 Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government.

These documents and materials may not be used or sold by the Contractor without written permission from the KO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.5.10.6 Organizational Conflict of Interest: Contractor and sub-Contractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent OCI as defined in

FAR Subpart 9.5. The Contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential

OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI.

The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO and in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.5.10.7 Physical Security: The Contractor shall be responsible for safeguarding all

Government equipment and property provided for Contractor use, when performing in a

Government facility. At the close of each work period, Government facilities, equipment, and materials shall be secured. The Contractor shall, at a minimum, follow the DoD and DHA Regional Health Facilities guidelines.

1.5.10.8 Access and General Protection/Security Policy and Procedures: The Contractor and all associated sub-Contractors' employees shall comply with applicable installation, facility, and area commander installation and facility access and local security policies and procedures (provided by the Government representative). The Contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of

Emergency Services, or Security Office. The Contractor workforce must comply with all personal identity verification requirements as directed by DoD, DHA, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

1.5.10.9 Cybersecurity Vulnerability Management: Contractor shall provide cybersecurity vulnerability remediation and mitigation support for all detected/known vulnerabilities across all applicable DHA Regional Health Facilities assets. The Contractor shall remediate these vulnerabilities within any defined suspense date (i.e. Cyber Command

IAVA, DoD/DHA taskord, DoD Control Correlation Identifier (CCI)) The Contractor shall provide mitigation strategies where remediation of the vulnerability cannot be executed prior to suspense date.