Draft Performance Work Statement.pdf

DEPARTMENT OF PATHOLOGY

BAYNE JONES ARMY COMMUNITY HOSPITAL

FORT JOHNSON, LOUISIANA

PERFORMANCE WORK STATEMENT

APRIL 2024

1. Contract Requirements: Contract is to provide an Information Technology (IT) connectivity solution for the test results of Point of Care (POC) NOVA Glucose Analyzers entry into the MHS Genesis/Cerner at Bayne Jones Army Community Hospital. The IT solution must meet the requirements below:

• System must be Risk Management Framework (RMF) approved.

• All functionality delivered on one screen.

• Vendor neutral interfaces to all Glucose POC Devices

• Single LIS Interface

• Bi-Directional connectivity to all devices

• All results on a single shared server.

• Approved ATO before contract is awarded.

1.1. This contract is for the initial base year to begin on 01 OCT 2024 with four (4) 12-month option years and a six (6) month -8 extension.

2. IT solutions must be able to support data from the I-STAT, Nova Glucose meter and other POC analyzers. The Contractor will provide all educational materials & literature, Inpatient IT connectivity solution with MHS Genesis, equipment replacement, and system implementation.

2.1. The Government shall not be responsible, and the Contractor expressly agrees not to hold the

Government liable for the loss, damage or destruction of material while in the possession of the Government.

2.2. The Government shall not be held responsible for any cost associated with shipping material to Fort Johnson and any other required locations.

2.3. Prior to any material being placed into operation the Department of Information Management

(DOIM) will coordinate on any system which becomes part of the facility Network (MHS Genesis/Cerner). Serial Numbers of the equipment will be provided to the customer and DOIM at each facility.

2.4. The Contractor will ensure that all devices are checked for IT connectivity to ensure test results at each download site are interfaced with the MHS Genesis/Cerner. The Contractor will ensure prior to departure that this interface is verified by a government official and/or representative.

2.5. Information Technology (IT) Connectivity Solution:

2.5.1. Telecommunication:

a)All Contractor systems that will communicate with Department of Defense (DoD) systems will interconnect through the established Military Healthcare System (MHS) Business to Business (B2B) gateway. For all Web applications, the Contractor will connect to a Defense Information Systems Agency (DISA) and established a Web Demilitarize Zone (DMZ).

b) In accordance with contract requirements, the Contractor will connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor will assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This will include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

c) Contractors will comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies.

d) All costs for VPN hardware and software will be incurred by the Contractor.

2.5.2. Risk Management Framework (RMF) Implementation Plan:

a) The Contractor will provide all required information to support and initiate the RMF Implementation Plan. This will also include the required information for the System Identification profile.

b) The Contractor will provide information for the Risk Assessment Analysis to the Government for all networking IT applicability.

2.5.3. Security Clearances

a) Personnel to be assigned to an Automated Data Processing (ADP)/IT position must undergo a successful security screening before being provided access to DoD information technology resources. Prior to an employee being granted interim access to DoD sensitive information, BJACH must receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement must be met by Contractors, subcontractors and other who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under Health Insurance Portability and Accountability Act (HIPPA). Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees must have at a minimum an ADP Sensitivity Designation of Level II to access the DoD Network.

b) Contractors that use the DoD gateways to access government systems must submit a

DISA Form 41 or equivalent in accordance with Contracting Officer guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface. Contractors shall complete and submit to TMA one Form 41 for their organization, attached to which shall be a listing of those individuals for whom background checks have been completed, submitted to the OPM, and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request must clearly delineate the ports and protocols used for each Internet Protocol (IP) address. The Contractor shall complete the form and submit to the government for final processing.

c) All costs for the background investigations are the responsibility of the Contractor.

2.5.4. Business to Business (B2B) Partners and Third-Party Vendors

2.5.4.1. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

2.5.4.2. Personnel Security

a) The Contractor shall comply with DoD Directive 8500.1, “Information Assurance (IA),” DoD Instruction 8500.2, “Information Assurance (IA) Implementation,” DoD Directive 5400.11, “DoD Privacy Program,” DoD 6025.18-R, “DoD Health Information Privacy Regulation,” DoD 5200.2-R, “Personnel Security Program Requirements.” AR25-1, “Army Knowledge Management and Information Technology”, AR25-2 “Information Assurance.” And local regulations as deemed appropriate by the activity Information Assurance personnel.

b) The Contractor shall be responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

c) Follow the Army guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

d) Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility LAN.

e) Immediately report to the Bayne Jones Army Community Hospital Security Office Melinda Hill at 337-531-3044 and deny access to any automated information system (AIS), network, or information if the Contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate government representative for any reason.

f) Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

2.5.5. Electronic Security.

2.5.5.1. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of Bayne Jones Army Community Hospital shall operate in accordance with controlling laws, regulations, DoD, Army, and local policy.

2.5.5.2. Certification & Accreditation (C&A) requirements apply to all DoD and Contractor’s

IS/networks that receive, process, display, store or transmit DoD information. The Contractor shall comply with the C&A process for safeguarding IS. Certification is the determination of the appropriate level of protection required for IS/networks. Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

2.5.5.3. Accreditation is the formal approval by the Government to operate the Contractor’s

IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections, and with appropriate level of protection for the specified period.

2.5.5.4. Contractor shall comply with C&A requirements, as specified by the government that meet appropriate DoD Information Assurance requirements. The C&A requirements shall be met before the Contractor’s system is authorized to access DoD data or interconnect with any DoD IS/network that receives, processes, stores, displays or transmits DoD data. The Contractor shall ensure the proper Contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

• Attending and supporting C&A meetings with the government

• Supporting/conducting the vulnerability mitigation process

• Supporting the C&A Team during system security testing

2.5.5.5. Contractors must confirm that networks are locked down prior to initiating testing.

2.5.5.6. Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA)

2.5.5.7. Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

2.5.5.8. Any re-configuration or change in the system during the C&A testing process will require a re-base lining of the system and documentation of system changes.

2.5.5.9. Information Assurance (IA) mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected.

Operating system, routers, servers, development platforms and the application being delivered to the government shall be in compliance with all known applicable Department of Defense Computer Emergency Response Team (DoD-CERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

2.5.6. Disposing of Electronic Media. Vendors shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Vendors are required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

2.5.7. Information Assurance Vulnerability Management (IAVM) The Contractor shall implement an information assurance vulnerability management program for all AIS and corresponding subnets that are connected to or intermittently connect to Army networks. The program shall meet the scope and intent of AR25-2 and (Insert MTF Name) IA policies to provide protection against known threats and vulnerabilities. Compliance with Army IAVM alerts and bulleting is required for these systems and shall be completed within the specified timeframe.

2.5.8. Information Systems (IS)/Networks Physical Security. The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor will support a Physical Security Audit performed by the Government of the Contractor's internal information management infrastructure. The Contractor shall correct any deficiencies identified by the Government of the Contractor's physical security posture. The MHS Physical Security Audit Matrix is available at:

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean %20version.xls.

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls

Installation Physical Security

1. All personnel employed under this contract will adhere to all Fort Johnson access control policies which include, weapons registration, transportation of weapons on the installation, access control policies, use of installation passes and ID cards and the operation of motor vehicles.

2. A check of records through the National Crime Information Center (NCIC) Interstate

Identification Index (III) is the Army minimum baseline background check for entrance onto Army installations for non-CAC holders to include entrance of visitors. Contractors will provide proof of identity of all employees using E-Verify and ensure that no illegal immigrants are employed under the umbrella of this contract.

3. The Contractor shall provide employees with company identification (ID) cards prior to their commencement of work. Employees shall wear ID cards on front exterior clothing, above the waist, when performing under the Performance of Work Statement (PWS)/Statement of Work

(SOW).

Installation AT/FP

1. Pursuant to DoD Instruction Number 2000.16, "DoD Antiterrorism (AT) Standards," dated

October 2, 2006, each Contractor employee requiring access to a Federally- Controlled Installation, facility and/or federally controlled information system(s) shall complete Level I AT Awareness Training on an annual basis and receive a certificate of completion. The training is accessible from any computer and is available at https://jkodirect.jten.mil The Contractor is responsible for ensuring that all applicable employees have completed antiterrorism awareness training and shall certify that their workforce has completed the training through the submission of completion certificate(s) to the Contracting Officer and the Contracting Officer's Representative (if appointed) within five working days after contract award or prior to access to a federally-controlled installation or information system.

Special Instructions:

a. Using an internet search engine, search JKO (Joint Knowledge Online) to begin the process.

Clicks:

b. No DOD CAC

c. I am a US mil, government civil servant, or contract employee.

d. I've been directed to take required training on JKO.

e. Click on Courses

f. I do not have a .MIL, .GOV, or.NDU.EDU address or I am a Multi-National Student

g. Fill out the contact sheet and email to sponsor (This is the COR)

h. Sponsor will email to the JKO help desk. (This is the COR)

Approval:

a. Help desk sends non-CAC user an email with User ID

b. Help desk will send a separate email with an electronic token to register a new password (token is good for 24 hours)

c. New User follows the instructions in the email and enters a new password.

d. User will need to enroll in Course # JS-US007-14 (User has up to 30 days to complete the course)

2. If the automated system at https://jkodirect.jten.mil not available (e.g., server problems), Level I AT Awareness Training can be provided by a qualified instructor.

However, if the training is not completed online, the Level I AT Awareness instructor qualification must be coordinated with the installation Antiterrorism Officer or (installation security equivalent) and the resultant name(s) of approved instructors shall be provided the contracting officer or designee along with all associated cost or schedule impacts to the contract.

3. Antiterrorism performance (Level I AT Awareness Training attendance and compliance) may be documented as a performance metric under the resultant contract and be part of past performance information in support of future source selections.

Installation OPSEC

1. In accordance with AR 530-1, Operations Security (OPSEC), dated 19 April 2007, and DoDM 5205.02-M, DoD Operations Security (OPSEC) Program Manual, dated 03 November 2008, contract personnel shall receive initial OPSEC Level I training which consists of initial and continual awareness training. Contract personnel shall receive initial OPSEC training either by on-line training through the Fort Johnson SharePoint OPSEC site on the intranet, or the Defense Security Services website at:

http://cdsetrain.dtic.mil/opsec/index.htm

2. The Contractor shall ensure all applicable employees have completed OPSEC initial training and annual refresher training and shall certify that their workforce has completed the training through the submission of completion certificate(s) to the Contracting Officer and the Contracting Officer's Representative (if appointed) upon arrival on post.

3. Operations Security (OPSEC) Awareness Training attendance and compliance may be documented as a performance metric under the resultant contract and be part of past performance information in support of future source selections.

Installation Access

1. All unescorted visitors to Fort Johnson must be vetted at the Visitors Center, located adjacent to the main gate on Louisiana Avenue (building 5903). Personnel requiring unescorted access will present a state issued Real ID Act compliant driver’s license (check status of your state at:

https://www.dhs.gov/real-id-enforcement-brief). Visitors who do not have a Real ID act http://cdsetrain.dtic.mil/opsec/index.htm http://www.dhs.gov/real-id-enforcement-brief) http://www.dhs.gov/real-id-enforcement-brief) http://www.dhs.gov/real-id-enforcement-brief) compliant driver’s license may use alternate forms of ID to proof their identity. Contact the Fort Johnson Visitor’s Center at (337) 531-7907 to obtain a listing of authorized alternate forms of identity. Each visitor with acceptable screening results will be issued an access control credential for unescorted access to the installation. Personnel with unfavorable screening results may be denied unescorted access to Fort Johnson. Law enforcement data obtained during the vetting process will not be released by personnel at the Visitors Center. A waiver process has been established for personnel who are denied unescorted access. Generally, waivers will be processed within five days of completion.

2. Escorted visitors who are accompanied by Department of Defense-affiliated personnel (active-duty Soldiers, civilian common access card holders, retiree ID card holders, DoD dependent ID card holders, and civilian Contractor CAC holders) will not require vetting for access and will only need to produce a valid ID card; these visitors must be in the immediate vehicle of the escorting card holder. DoD affiliated personnel will be responsible for their escorted visitors on the installation. Personnel who are enrolled and vetted through the Rapid Gate program or possess an installation issued ID/Pass do not have escorting privileges.

3. The Fort Johnson Visitors Center is open 24 hours a day, seven days per week. For additional information concerning access control please contact the Visitors Center at (337) 531- 0380/4978/7186.

4. Point of contact is the undersigned at 337-531-3409.