Draft Performance Work Statement (PWS)_3D Advanced Imaging Templating Software..docx

Performance Work Statement (PWS)

3D Advanced Imaging Software Solution Acquisition Program Manager (APM), Image Management Systems Picture Archiving and Communication Systems (PACS) Program Management Office (PMO), J-6

PART 1

1.0 GENERAL INFORMATION

1.1 This is a service type contract for the purchase and implementation of a single centralize 3D Advanced Imaging Software solution for Radiology Picture and Archiving System (PACS). The vendor will install a centralized 3D Advanced Imaging Software solution with full integration to either a single deconstructed PACS or existing PACS. The solution will be located within a government host virtual environment.

1.2 Description of supply/introduction: The Defense Health Agency (DHA) is pursuing the acquisition of a single 3D Advanced Imaging Software solution which must integrate to current DHA PACS vendors (Agfa, Fuji, and Phillips).

The contractor shall provide all personnel, equipment, supplies, transportation, tools, materials, supervision, and other items to provide as necessary for DHA to transition from local PACS or HUB PACS solution (s) to a single enterprise 3D Advanced Imaging Software solution integrated with current PACS vendors as defined in this Performance Work Statement (PWS). The contractor shall perform to the standards in this PWS.

The new 3D Advanced Imaging Software system will meet industry performance standards, offer the necessary redundancy and contingency features to meet DHA needs, and provide state-of-the-art technology enhancements to improve user experience and minimize service disruption.

1.3 Background: DHA is finalizing the consolidation of site local PACS to a HUB and Spoke model throughout the enterprise. Currently, DHA has 12 HUB PACS strategically located within the DHA PACS enterprise. Additionally, there are 50 spoke sites with downtime servers. DHA PACS locations are currently utilizing Terarecon, Vitrea, Syngo Via, DynaCAD and RadLink 3D Advanced Imaging Software solutions.

1.4 Objectives: The Contractor shall:

a. Acquire, implement, and maintain a single enterprise-wide standardized solution for 3D Advanced Imaging Software over a 5-year period of performance.

b. Standardize and reduce the amount of currently installed systems throughout the current installed PACS environment.

c. Acquire and implement a single enterprise-wide standardized solution that integrates to all existing DHA PACS vendors and current DHA deployed Hub and Spoke PACS currently installed.

d. Acquire commercially available solution that meets or exceeds the standards in this PWS, no future features and functionality of the solution will be considered.

1.5 Scope: The Contractor shall plan, coordinate, and manage the delivery of all software to the delivery addresses provided by the government. The Contractor shall also be responsible for managing the installation, software configuration, and integration necessary to establish communication with the existing on-site PACS and meeting RMF accreditation standards before delivery. The desktop integrations to the PACS workstations on the PACS will be provided by the government.

1.6 Period of Performance (PoP): 5 September 2025 to 14 September 2030

1.6.1 Transition: Transition-in/transition-out period. N/A

1.7 Administrative specifications

1.7.1 Place of performance: This contract will support the multiple DHA MTFs where 3D Advanced Imaging Software is currently located, government will provide at kick-off meeting.

Goods shall be shipped from the Contractor’s location as Free on Board (FOB) destination.

1.7.2 Recognized Federal holidays: The contractor is not required to perform services on holidays.

Independence Day

1.7.3 Hours of operation: The contractor is responsible for software 365 days a year, 7 days a week, 24 hours a day through a service maintenance agreement. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS.

1.7.4 Emergency Services: N/A

1.8 Contractor travel: N/A

1.9 Other Direct Costs (ODC): N/A

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective QC program to ensure all tasks are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is the means by which the work complies with stated requirements.

1.11 Contractor personnel

1.11.1 Common Access Card (CAC) requirements: A CAC is required for access to DoD systems that are PKI enabled. A vendor that needs access to these systems must use a CAC to authenticate to these systems. If the previous two requirements have been met and there is a valid contract with the vendor, then the process to issue a vendor CAC will begin. For all contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. (Attachment 2, Attachment 3). A CAC is the standard identification for eligible DoD contractor personnel. The eligibility for a CAC will be made by the COR. CACs are for engineer's that remote in to perform maintenance and engineers that work in DoD facilities on a full-time basis.

1.11.2 All Contractors requiring access to their systems for any type of remote support of systems/applications on the DoD network will meet DoD requirements for a privileged-level account before being granted a network account. See DOD 8570 Chart located at (https://public.cyber.mil/wid/cwmp/dod-approved-8570-baseline-certifications/). Not maintaining these requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract is met.

1.11.1.1 Alternative Tolken (ALT Token):

Anyone requiring System Administrative (SA) roles/access to a system must have an ALT token. A separate 2875 and 2842 must be completed for this as well as a face-to-face meeting with a Trusted Agent to issue the Alt Token CAC.

1.11.1.2 CAC Renewal: Cardholders are encouraged to notify their company and ICS PMO 30 days prior to expiration. When the new application has been submitted and approved, the cardholder will receive a system generated email stating the application has been submitted/approved and a new card is ready to be picked up. If a card is revoked due to not being re-verified or if a card expires, there is a 24 hour wait period before a new application can be entered by the Government POC.

1.11.1.3 The contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training (Attachment 4). The contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at: https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.2.3 The DHA’s new employee handbook at Part 7 Section 7.1.4. (Attachment 5)

1.11.2.4 The DH Standards of Conduct at Part 7 Section 7.1.4 (Attachment 6)

1.11.3 Physical Security: NA.

1.11.4 Key control: Reserved.

1.12 Key personnel (Contractor): N/A.

1.13 Data rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the CO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.14 Reporting

1.14.1 RESERVED.

1.14.2 Non-Disclosure Agreement (NDA) (Attachment 7): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA prior to beginning work on the subject contract. The contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on this contract execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system. Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17 Personnel Security

1.17.1 The contractor shall comply with Department of Defense Manual (DoDM) 8140.03, “Cyberspace Workforce Qualification and Management Program” (Attachment 8); 8500.01, “Cybersecurity”, dated March 14, 2014 (Attachment 9); DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019 (Attachment 10), Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019 (Attachment 11); and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020 (Attachment 12). Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or CUI. If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D-Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: A delivery order under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed QASP for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc.

2.3.1. DHA Cybersecurity/RMF Requirements

2.3.1.1. System Security Requirements

2.3.1.1.1. The contractor shall submit the Medical Device Equipment Assessment Questionnaire (Attachment 13) herein and shall be returned to the government representative within the timeframe listed in paragraph 2.3.1.3. below. Additionally, the contractor shall provide scans after being selected for an order. A Nessus scanner must be procured by the contractor, at their own cost, in order to comply with RMF requirements.

2.3.1.1.2. The Contractor shall comply with security regulations and guidance listed below:

2.3.1.1.3 Cybersecurity Regulations and Guidance (Attachment 14) and all RMF requirements (Attachment 15).

2.3.1.1.4. Failure to meet the requirements may result in termination of the contract for cause, in accordance with FAR 52.212-4(m).

2.3.1.1.5. The contractor device or system shall pass pre-validation screening (Vulnerability scans utilizing Nessus, and SCAP (Security Content Automation Protocol) scans), administered within six (6) months of contract award that will be conducted by Government, and must meet criteria listed below:

2.3.1.1.5.1. No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

2.3.1.1.5.2. No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities as described in the appropriate DISA STIGs located on http://iase.disa.mil/stigs/Pages/index.aspx

2.3.1.1.5.3. No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

2.3.1.1.5.4. No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

2.3.1.1.6. The contractor shall mitigate all Very High, High, and Moderate Severity/CAT I and CAT II vulnerabilities discovered during the Assessment and Authorization (A&A) process according to a schedule published by Government.

2.3.1.1.7. The contractor shall appoint a contractor POC responsible for the cybersecurity of the contractor device or system throughout the lifecycle of the system. The contractor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials and meet required deliverable timelines.

2.3.1.1.8. The contractor shall maintain an Authority to Operate (ATO) as directed by Government regulations.

2.3.1.1.9. RESERVED

2.3.1.1.10. Pursuant to subsequent warranty period and Service Maintenance Agreements (SMA), the contractor shall, after the issuance of this order, ensure that the contractor’s device or system maintains its ATO for the life of this order.

2.3.1.1.11. The contractor shall maintain an ATO on all equipment/product versions owned by the DHA and originally purchased through the contractor’s contract. If a contractor cannot support the ATO for all DHA owned versions of the equipment/product, the contractor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the ATO for the life of this order, either at no cost to the Government or at a fixed price that is included and evaluated as part of the contractor’s new equipment/product offer.

2.3.1.1.11.1. During the period of time the contractor must maintain the ATO; the life of this order; the contractor shall provide all required cybersecurity patches/updates. If the patches are separate from updates as required by the contractor’s contract, the contractor shall offer the cybersecurity patches under a maintenance offering that provides for all required cybersecurity patches/updates needed to maintain the ATO. Maintaining the RMF ATO shall be included as part of the contractor’s warranty period. For updates/patches, executable files should be distributed by the manufacturer accordingly or implemented by the manufacturer technical staff dependent on Service Agreement processes.

2.3.1.1.12. The contractor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

2.3.1.1.13. The contractor shall notify the Program Management Office (PMO) and CO POCs in writing with any inabilities to comply with DoD security requirements. Contractor will provide anticipated costs and timelines required to address vulnerabilities in question.

2.3.1.1.14. The contractor shall contact the IA/RMF Office Representative, no later than five (5) business days after contract award to start the process. Failure to do so would be considered a contractor caused delay.

2.3.1.2. RMF Requirements:

2.3.1.3. All actions to meet the RMF requirements occur in a sequential manner and worked concurrently. (Deliverable #7)

The contractor shall submit all RMF required documentation, as specified by Government Reps for review and approval, no later than four (4) months after request by the Government.

The contractor shall maintain approval from the Government, any contractor developed RMF policies, plans, and procedures prior to implementation.

The contractor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of request by the Government.

The contractor shall provide technical scans within one (1) month of the A&A kickoff meeting.

The contractor shall provide updated technical scans on a monthly basis., The contractor shall ensure that the contractor device or system is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and antimalware applications that are approved at the time of ATO issuance. The contractor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. DLP, IPS, Antivirus, etc.) without performance degradation of the medical system/device. In cases where the operation of security applications is not technically achievable, the contractor shall provide detailed justification and a Plan of Actions and Milestones (POA&M) describing steps towards compliance with this requirement.

The contractor shall ensure that the contractor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the contractor shall provide a detailed list of exclusions with justifications.

2.3.1.4. Privileged User Training and Certification Requirements

2.3.1.4.1. If a contractor requires a Business-To-Business (B2B), access, etc. to government networks to maintain, analyze, etc., their equipment/product, they must adhere to the following requirements:

2.3.1.4.2. Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the DHA network will meet DHA requirements for a privileged-level account before being granted a network account. Requirements include:

2.3.1.4.3. Cyber (Information assurance (IA)/information technology (IT)) certification. Per DoD Manual 8140.03, DFARS 252.239.7001 and AR 25-2, the Contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level II (IAT – II) and be required to meet minimum Professional Baseline certifications at the time of contract award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD Manual 8140.03 will result in the Contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract is met. Note: No network access will be provided unless DoD Manual 8140.03 requirements are met.

2.3.1.4.4. Background Investigation. NACI or above is required.

2.3.1.4.5. Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (Global Information Assurance Certification (GIAC) Security Leadership Certification (GSLC), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), etc.) will satisfy this requirement.

2.3.1.4.6. Computer Environment (CE) Certification. Certifications are determined by the role of the Contractor and must be met within six (6) months of contract issuance. Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a professional certification that coincides with the technology inherent in the system (i.e. MCSE, CCNA, RHCSE, etc.). The CompTIA A+ certification will also satisfy the CE certification requirement.

2.3.1.4.7. IA Training Requirements. Contractors will meet minimum training requirements within six (6) months of contract award. Contractors will be required to complete Cyber Security Fundamentals located at URL: https://ia.signal.army.mil/IAF/

2.3.1.4.8. Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The only method for authenticating is the CAC. The vendor must provide a solution utilizing this same methodology. The Department of Defense CAC identifies users on the AD Domain and specific group they belong to on AD.

2.3.1.4.9. Network Account Request Package (Authorized & Privileged). The Contractor will submit a request package through the Information Assurance/Cyber Security Branch for contractors requiring remote access to a DHA network. Remote access must be through a DHA B2B solution.

2.3.1.4.10. Training. DoD Cyber Awareness Challenge Training must be completed by all Contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://www.jcs.mil/JCO.

2.3.1.4.11. Acceptable Use Policy (AUP). (Attachment 16) All contractors will sign/acknowledge the DHA B2B Standard AUP prior to being granted a DHA B2B network account. The DHA B2B Standard AUP is available upon obtaining a CAC.

2.3.1.5. Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity Requirements Continuous Risk Management:

2.3.1.5.1. The contractor shall maintain a duplicate of the fielded equipment/product falling under one authorization; for testing in a contractor supplied lab environment at contractor location for six (6) years from initial ATO approval or as long as the contractor commercially supports the equipment/product, whichever is longer. The contractor shall maintain a duplicate of the equipment/product for each version owned by the DHA and originally purchased through the contractor’s contract. The duplicate equipment/product does not have to be a physical duplication and can just be virtual duplication, as long as all components within the authorization boundary are represented.

2.3.1.5.1.1. The contractor shall maintain the duplicate system or device in operational condition with the latest security patches installed.

2.3.1.5.2. The contractor shall update all ATO required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system.

2.3.1.5.3. The contractor shall maintain the authorized security configuration and notify the government within forty-eight (48) hours of any major changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO. Contractor shall support reauthorizations due to major upgrades.

2.3.1.5.4. The contractor shall ensure the contractor’s device or system is in compliance with the DoD Information Assurance Vulnerability Management (IAVM) program upon each deployment.

2.3.1.5.5. The contractor shall ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a lab environment.

2.3.1.5.6. The contractor shall make the duplicate device or system available for periodic security reviews, within forty-five (45) business days of notification by Government. The contractor shall perform monthly vulnerability scans using the most recent and updated version of approved DoD scan tools.

2.3.1.5.7. Contractor shall maintain system and update to comply with updated STIGS as made available by the Government within three (3) months of notification by the Government.

2.3.1.5.8. The contractor shall provide vulnerability scan and SCAP scan results to Government on a monthly basis. Contractor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month (Deliverable #6).

2.3.1.5.9. The contractor shall close all discovered vulnerabilities within three (3) months of discovery.

2.3.1.5.10. The contractor shall submit to Government detailed explanations for the inability to close discovered vulnerabilities.

2.3.1.5.11. The contractor shall submit to Government for approval of any mitigation that addresses any open vulnerabilities.

2.3.1.5.12. The contractor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to Government for approval.

2.3.1.5.13. The contractor shall use the Government approved method for remote access administration (DISA B2B) of system or device.

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government Will NOT provide Government Furnished Services in support of this contract. As a result, this paragraph is Not Applicable.

3.2 Facilities: The Government Will NOT provide Facilities in support of this contract. As a result, this paragraph is Not Applicable.

3.3 Utilities: The Government: Will NOT provide Utilities in support of this contract. As a result, this paragraph is Not Applicable.

3.4 Equipment: The Government Will NOT provide Equipment in support of this contract. As a result, this paragraph is Not Applicable.

3.5 Materials: The Government will provide the Virtual environment as well as the MS Windows and SQL version required for the 3D Advanced Imaging Software.

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor WILL NOT provide Contractor Furnished Services required in support of this contract. As a result, this paragraph is Not Applicable.

4.2 General: The contractor shall furnish all supplies required to perform work listed under Section 5 of this PWS.

4.3 Secret Facility Clearance: Not Applicable

4.4 Materials: Not Applicable

4.5 Equipment: Not Applicable

4.6 Facilities: Not Applicable

PART 5

5.0 SPECIFIC TASKS

5.1. Delivery and configuration of software

5.1.1. The contractor shall deliver software and configure it as necessary to establish connectivity throughout the infrastructure. The ultimate service goal is to consolidate site local PACS to a Hub and Spoke model throughout the enterprise to provide standardization across the DHA. This task includes but is not limited to:

5.1.1.1. Implementation at government hosted virtual environment

5.1.1.2. Standardize system configurations

5.1.1.3. Fully integrate to the PACS desktop

5.1.1.4. Utilize a Web version of the client to allow reconstructions without limitation of location with thick client

5.1.1.5. System must have the capability to display at least two different series of images that has the ability to be locked and correlated for side-by-side comparison and scrolling with appropriate scaling.

5.1.1.6. System must have the ability to calculate and display Standard Uptake Value (SUV) measurements, to include SUV max and SUV lean, converted from recorded counts per voxel / Volume of Interest (VOI) to activity per unit volume with SUV calculations. System must include support to the following- but not limited to PET tracers (F18; Ga68; Rb82; Cu64; 90Y; 89Zr) and non-PET radionuclides (67Ga, 166Ho, 123I, 131I, 111In, 81mKr, 177Lu, 99mTc, 201Tl, and the dual isotopes).

5.1.1.7. System must have the capability to process and display static and dynamic planar nuclear medicine images, should include- but not limited to: whole body images, brain, brain metabolism, cerebrospinal fluid, thyroid, lung, lung quantification, gastrointestinal, genitourinary, gastric emptying, hepatobiliary, spleen, skeletal, lymphatic, oncologic, cardiac, gated studies, and all hybrid display combinations.

5.1.1.8. System must be capable of providing a toolkit for reconstruction / processing of images to include quality control, attenuation and scatter correction, motion correction, reconstruction with collimator response, 3D zooming, post-filtering reorientation, and attenuation map registration.

5.1.1.9. System must have the capability to adjust the lookup table / window settings, with the capability to manually adjust upper and lower thresholds (window) limits.

5.1.1.5. System must be capable of processing Myocardial Perfusion Imaging (MPI), perform quantitative cardiac segment to score myocardial perfusion in measurements of Summed Stress Score (SSS), Summed Rest Score (SRS), and Summed Difference Score (SDS), process and calculate Coronary Flow Reserve (CFR) and Coronary Artery Calcium (CAC) for each coronary artery, and process gated imaging to evaluate wall motion and ejection fraction. Capability should include support to the following radionuclides- but not limited to: F18; Tc99m; Rb82; and N13.

5.1.1.10. System must be capable of performing brain quantification measurements on brain SPECT and brain PET images, along with the capability to compare to a normative database for brain metabolism- Fluorodeoxyglucose (FDG), Positron Emission Tomography (PET) images. Could include overlay of subtraction image with MR scan for subtraction analysis.

5.1.1.11. System must be capable of processing multimodality lung images, Computed Tomography (CT), Single-Photon Emission Computerized Tomography (SPECT, Magnetic Resonance Imaging (MRI) and PET to calculate lobe function and volumetric anatomy, pulmonary segmentation, calculate and display histograms of V/Q (Ventilation/perfusion) frequency distributions and quantitative values to assess for parenchymal lung disease or pulmonary embolism.

5.1.1.12. System must have the capability to display at least two different Nuclear Medicine studies that have the ability to be locked and correlated for side-by-side comparison while displaying SUV measurements.

5.1.1.13. System must have the capability to display and overlay images obtained in Nuclear Medicine along with images obtained from another modality. The fusion of these images must allow for anatomy on the images to be correlated to allow for hybrid viewing. Displayed images must allow for the capability to zoom and reorient images."

5.1.1.14. System must have the capability to calculate quantitative measurements and display radiation energy that is deposited in the tissue(s) / organ(s) / region(s) of focus on Nuclear Medicine images to allow for dose calculation.

System must be capable of calculating dose distribution for the whole body or a single organ and provide a voxel-wise dose distribution calculation.

5.1.1.15. System must be capable of providing a consistent workflow for Selective Internal Radiation Therapy (SIRT) to include the ability to perform dose planning to determine activity required to achieve a therapeutic dose and process dose verification to assess radioactive spheres to confirm location of the administration of the therapeutic dose.

5.1.1.16. System must have the capability to detect and process images with dedicated algorithms in relation to anatomy and type of study; to include the abilities to overlay several modalities, automatic co-registration of different modalities, local co-registration between different modalities, one-click lesion segmentation, simple semi-automatic organ segmentation, automatic volumetric measurements on PET and SPECT and other modalities, volumetric lesion measurements, automatic transfer (copy/paste) of 3D regions between modalities.

System must have the capability to identify and track lesions to allow for comparison and evolution of lesions over time.

5.1.1.17. System must have the capability to identify lesion segmentation and volumetric lesion measurements.

5.1.1.18. System must have the capability to redraw any regions of interest or adjust any calculations or measurements performed during the initial image post-processing if the initial regions of interest or calculations are determined to be inaccurate or misleading.

5.1.1.19. System must be capable of supporting advanced data analytics (machine learning / artificial intelligence) of stored data to assist in clinical decision support for patient care and population health.

5.1.1.20. System must have the ability to Auto-tracking of main and branch vessel coronary arteries throughout the cardiac phases to allow for production of curved MPR images.

5.1.1.21. System must have the ability to auto-trace vessels for diameter/stenosis assessment, aorta to peripheral vessels.

5.1.1.22. System must have the ability to perform Volumetric assessment of Left ventricular (LV) and Right ventricular (RV), Right Atrium (RA) and Left Atrium (LA) on CT using auto-tracking.

5.1.1.23. System must have the ability to perform Vessel stenosis analysis.

5.1.1.24. System must have the ability to perform Ability to construct cardiac structure in 3D environment.

5.1.1.25. System must have the ability to perform remove blood pool digitally.

5.1.1.26. System must have the ability to perform alter coloration of chambers, vessels, walls.

5.1.1.27. System must have the ability to perform alter transparency of chamber, vessels walls.

5.1.1.28. System must have the ability to perform alter lighting angle to provide best 3D rendering.

5.1.1.29. System must have the ability to One click reset to standard axial sagittal and coronal views.

5.1.1.30. System must have the ability to perform One click standard cardiac orientation to short axis, two chamber and four chamber configurations.

5.1.1.31. System must have the ability to perform Preset window level tool for myocardial perfusion analysis.

5.1.1.32. System must have the ability to perform accurate assessment of coronary artery calcium score (It should always be a whole number).

5.1.1.33. System must have the ability to perform 3-point delineation of the aortic valve annulus with ability to lock those points after screen manipulation.

5.1.1.34. System must have the ability to perform auto contouring tools.

5.1.1.35. System must have the ability to perform 3D left atrial appendage rendering w/ ability to measure and demonstrate projections.

5.1.1.36. System must have the ability to perform Ability to create bookmarks that can be accessed by all users to reproduce images.

5.1.1.37. System must have the ability to perform Ability to record moving renderings and transfer them into PACS.

5.1.1.38. System must have the ability to Reduce motion artifact.

5.1.1.39. System must have the ability to perform early, accurate detection of subdural hemorrhages.

5.1.1.40. System must have the ability to perform seamless care coordination for incidental cerebral aneurysms.

5.1.1.41. System must have the ability to perform Intracerebral Hemorrhage Detection & an algorithm that detects aneurysms in CTAs.

5.1.1.42. System must have the ability to perform Auto detection of Left ventricular (LV) and Right ventricular (RV)blood tissue boarders that require minimal user correction.

5.1.1.43. System must have the ability to perform T1, T2, T2* analysis tools with auto propagation of contours.

5.1.1.44. System must have the ability to perform Later Gadolinium Enhancement (LGE)mass analysis package allowing standard deviation, manual and full width half mass detection of LGE along with in image contouring for determination of left ventricular mass.

5.1.1.45. System must have the ability to perform MRI LV, RV, LA, RA strain to include longitudinal, radial and circumferential strain, auto calculate average strain and display in bullseye format.

5.1.1.46. System must have the ability to create bookmarks that can be accessed by all users to reproduce images.

5.1.1.47. System must have the ability to record moving renderings and transfer them into PACS.

5.1.1.48. System must have the ability to perform Large Vessel Occlusion (LVO) Detection automatically detects and triages suspected large vessel occlusions.

5.1.1.49. System must have a minimum 2-dimentional radiographic templating software compatibility within the PACS

5.1.2. Implementation and Sustainment

5.1.2.1. Implementation and Sustainment includes:

5.1.2.2. Project Management and implementation planning/scheduling

5.1.2.3. Provide a detailed topography document to include details on how the enterprise system will be configured 30 days prior to Go-Live (Deliverable #1)

5.1.2.3. Go-Live shall implement the most current commercially available software version

5.1.2.4. Software maintenance

5.1.2.4.1. Provide maintenance support for the enterprise software solution over the contract period

5.1.2.4.2. Must include software updates and upgrades, to include all updates and upgrades to the clinical application, to ensure deployed version is the current commercially available software version.

5.1.2.4.3. Software updates and upgrades will not be made without the written approval from either the Government’s Contracting Officer’s Representative (“COR”) or designated Government’s official.

5.1.2.5 Software Training

5.1.2.5.1. The contractor shall provide applications training for 400 individuals at the 12 PACS Hubs across the enterprise. Training shall be conducted one time in person on site (travel cost paid by contractor) and one time virtually per PACS Hub (12 in person trainings/12 virtual trainings). One virtual session shall be recorded and saved for future training purposes.

5.1.2.5.2. The contractor shall provide virtual trainings at each PACS Hub when an upgrade to the software application is applied.

5.1.3. The contractor shall assign a Project Manager (PM) within 30 calendar days after award.

5.1.4. The contractor shall deliver an overall project plan at proposal submission and within 30 days after award of the contract; with weekly updates until project completion. The detailed project plan, shall highlight the key deliverables, timelines, and expectations of each party responsible for delivery, configuration, and final acceptance of the systems and provide weekly reporting regarding the status of each site’s progress. (Deliverable #2 and Deliverable #3)

The project plan shall include the start of delivery of software within 60 calendar days of award of the contract and installation shall begin within 90 calendar days of award. All sites must Go-live (clinically in use) within 12-months of contract award.

Business-to-Business (B2B) remote connection cannot be guaranteed, contractor should include costs for onsite installation and maintenance in the event B2B connection is not available or is not approved for a connection. The absence or lack of remote connectivity shall not delay implementation of system or configuration.

5.1.5. The contractor shall provide an implementation plan and implementation timeline for all sites.

Implementation plan shall include the following:

· Comprehensive implementation plan to install all systems, including total number of project managers and implementation team(s) involved.

· Proposed timeline for production Go-live for all implementations. “Go-live” date is met by full clinical usage of the system with fulfillment of migration requirements related to Go-live with no reliance on the legacy system.

5.1.5.1 The contractor shall attend weekly status meetings with the Government representatives; contractor shall provide meeting agenda 24 hours prior to meeting and provide meeting minutes within 48 hours of the meeting conclusion.

5.1.6. The contractor shall provide all of the following, included in the setup/configuration of the system to ensure proper installation:

5.1.6.1. Validate functionality of software in accordance with RMF accreditation documentation

5.1.6.2. Validate RMF STIG requirements and scan for vulnerabilities with DoD provided Nessus vulnerability scan software

5.1.6.3. Resolve or mitigate any Category 1 or High Category 2 vulnerabilities

5.1.6.4. Upon site installation validate configuration is correct and working

5.1.7. The contractor shall agree to the DHA Cybersecurity/RMF requirements, receive an ATO and maintain the ATO for up to five (5)…