DRAFT PWS Leica Microsystems Non Personal Services over 250k.docx

Department of Defense Defense Health Agency Performance Work Statement

Leica Microsystems Maintenance and Service Agreement

20250609

Naval Medical Readiness and Training Center, Portsmouth

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide maintenance and repair services to all Leica Microsystems equipment listed in this PWS and its subcomponents.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide full maintenance support for the items listed in Section 1.5 and all support items / components as defined in this PWS except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.3 Background: Naval Medical Center Portsmouth HT9406 has a requirement for a non‐personal service and maintenance contract for designated, Government-owned Leica Microsystems Inc. microscopes, light, examination, microscopes, light, operation, otorhinolaryngology, and microscopes, light, operating, according to this Performance Work Statement.

1.4 Objectives:

· Preventive maintenance

· Corrective Maintenance

· Replacement Parts

· Equipment Modification Upgrades

1.5 Scope: Uninterrupted operation of the Leica Microsystems equipment is vital to support of the Navy mission. An annual service contract is required to support the installed equipment located within the Main Operating Room. The service contract would include access to technicians via phone, text, or email, technical phone support during procedures, on-site preventative maintenance every 12 months, and on-site emergency service for malfunctioning equipment. Service will include full coverage on parts/travel/labor charges, full coverage on replacement consoles/parts, hardware or software upgrade, all software updates, shipping to ensure parts are available to on-site technicians during service and maintenance, and a 24 hr response time for preventative maintenance. Response time and requirements for Corrective maintenance is listed in Specific Tasks section 5.

1.6 Period of Performance (PoP):

Base: 01 Oct 2025- 30 Sept 2026 Option I: 01 Oct 2026- 30 Sept 2027 Option II: 01 Oct 2027- 30 Sept 2028 Option III: 01 Oct 2028- 30 Sept 2029 Option IV: 01 Oct 2029- 30 Sept 2030

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at NMRTC Portsmouth

1.7.2 Recognized Federal holidays: is not required to perform services on holidays.

Independence Day

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.7.4 Emergency Services: On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

1.8 Quality

1.8.1 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.9 Contractor Personnel

1.9.1 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.9.2 Lock combinations: Reserved.

1.10 Data rights: Reserved

1.11 Reporting

1.12.1 Contractor Manpower Reporting (CMR): RESERVED.

1.12.2 Non-Disclosure Agreement (NDA): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.12.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.13 Contractor Identification

1.13.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.13.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.13.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.14 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.14.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system (If applicable, if not delete 1.16.1 and 1.16.2 and replace to 1.16 Reserved). Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.14.2 Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.15 Personnel Security

1.15.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.15.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.15.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.15.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D-Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☐ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.2 Facilities: The Government:

☐ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.3 Utilities: The Government:

☐ WILL provide Utilities in support of this contract/task orders. The Government provided Utilities are described below:

· Electricity

· O2

· Medical Air

· Suction

· Water

3.4 Equipment: The Government:

☐ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.4.1 Procurement Integrated Enterprise (PIEE), GFP Module Application

The contractor shall be responsible for obtaining and maintaining access, training and successful operation of the PIEE/GFP Module application for the entirety of the contract/task order PoP. The PIEE GFP Module application is located at the following website: https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the contractor’s responsibilities regarding GFP can be found at the following website: https://dodprocurementtoolbox.com/.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The CO and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded through DHA, in accordance with applicable FAR Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA AI 095 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the Contracting Office, and requested within the PIEE/GFP Module system.

Contractor Responsibilities:

A key contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

The contractor shall report semi-annually 100% inventories, reconciliations, and final disposition of GFP provided by the government. Final invoices will not be paid pending GFP reconciliation. Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245 and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA Administrative Instruction 094 and DHA Guidance. (If this option is used, a semi-annual GFP inventory CDRL will need to be added to the PWS Technical Exhibit 1.)

3.5 Materials: The Government:

☐ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☐ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

PART 5

5.0 SPECIFIC TASKS

5.1 Service Agreement for Annual Preventative Maintenance and Corrective Maintenance

5.1.1 Preventive maintenance. Shall be performed once a year in accordance with the Original Equipment Manufacturers (OEM) recommendations. The contractor shall be qualified / authorized by the OEM (IE: Certified Agent of the OEM) in the repair of all equipment listed within this contract. Certification of the OEM must be current (within 2 years) at all times prior to contract award and throughout contract period. Contractor and its employees shall maintain qualifications throughout entire contract period. In the event that a sub-contractor is used for this requirement, the sub-contractor must be a Certified Agent of the OEM. Qualification includes but not limited to the certification of all repair persons and repair facilities by the OEM( original equipment Manufactuers) as being trained / qualified to perform required repairs. The Government shall maintain the right to seek proof of qualification prior to award and anytime during contract period of performance. Additionally, contractor must have ready access to parts inventory of OEM replacement parts.

5.1.2 This contract shall provide annual preventative maintenance services which include on-site corrective repairs and calibration in accordance with the Original Manufacturer’s Equipment requirements, normal working hour coverage (8:00 A.M. to 4:00 P.M. Monday through Friday excluding Federal holidays); emergency service and routine preventive maintenance services to Department of Defense owned equipment. It shall include all systems, subsystem components, and assemblies, (i.e.: contractor responsible for total maintenance of entire system). All maintenance provisions shall apply to hardware, firmware, and software, as appropriate, unless otherwise stated. Preventative maintenance and corrective repairs, if needed shall be done prior to the 15th of September each fiscal year to all equipment listed under section 1.1.3 and its subcomponents.

5.1.3 The contractor shall make a best effort to schedule and complete annual preventive maintenance services prior to the 15th of Septemeber, but no later than the last day of the month.

Vendor shall report to Biomedical Engineering Bldg. 250 1st floor located at 54 Lewis Minor St. Portsmouth, VA 23708. The contact number is 757-953-5336. The FSE shall personally notify Biomedical Engineering (BME) of problems that result in the equipment being left disabled upon their departure. After normal duty hours, contractor FSE’s shall notify the Officer of the Day Desk (Bldg 2, 2nd Floor).

5.1.4 The contractor shall provide to BME a Field Service Report (FSR) within two (2) days after completion of all service performed. The service report shall include, but not be limited to: contract number, equipment description (model, serial number, equipment control number) contractor’s log number, detailed description of the service(s) performed, replacement part(s) information (part number, part value, nomenclature, unit price, manufacturer, if not OEM, and whether the part is new/used/reconditioned), the completion date and time, man-hours expended, model and serial numbers, and the name of the FSE performing the service. In the event that agents/sub-contractor’s are used in the performance of repairs, said agent shall be identified on the service report by company name and contact information (i.e., telephone number). Additionally contractor will be required to affix a tag on equipment upon the completion of a preventative maintenance inspection. Tag may either be a “sticker” or “hanging tag”. As a minimum the tag shall contain: the name of the contractor, technician performing inspection and date of inspection legibly printed. FSR will be emailed to BME distribution email at usn.hampton-roads.nmrtc-portsmouth-va.list.nmcp-dfabiomed@health.mil.

5.1.5 All test equipment used in the performance of this contract must be calibrated (if required / as required by manufacture of test equipment) and shall be in compliance with Joint Commission (JC) Original Equipment Manufacturer (OEM) and Federal Drug Administration (FDA) standards as required.

5.1.6 The contractor shall provide trained, experienced, English speaking personnel, labor, tools, diagnostic equipment, software, test phantoms, material, supplies, transportation, parts and equipment necessary to perform Preventive Maintenance (PM), Calibration (CAL), Safety testing (ST) and corrective maintenance

5.1.7 The contractor shall provide telephonic communications with the Government to discuss technical matters relating to the performance of this contract. A systems operator will be made available to answer technical questions regarding system operations and applications. The contractor points of contact (POC). Service calls shall be placed 24 hours a day, 7 days a week by calling a vendor supplied toll free response center. Qualified service reps are required to make a “best effort” to call back within 4-hours during normal business hours (8am – 5pm EST Monday – Friday excluding Federal Holidays) to schedule service visit.

5.2 Corrective Maintenance. Normal working hour maintenance coverage will be Monday through Friday, between 8:00 A.M. to 4:30 P.M. A contractor Service Tech shall respond via telephone within 4 hours after receipt of trouble call, and make a best effort to provide on-site service no later than the close of business (4:30 pm) on the next business day. Vendor is to make a best effort to have all equipment operational within 72 hours of initial on-site response.

5.2.1 In the event that emergency service outside the normal working hours are required by the Government, additional work shall be billable to the Government at published commercial rates, and negotiated and approved by a Contracting Officer prior to services rendered. Government request for corrective maintenance will be placed by BME, to the contractor’s POC. Corrective Maintenance shall be completed during the hours specified in the contract.

5.3 Base Access. Vendors and contractors will apply for, and maintain, base access. This can be done at https://dbids-global.dmdc.mil/home/. Vendors and contractors will also complete form SECNAV 5512/1 and submit to BME points of contacts Mr. Benjamin Lee benjamin.c.lee8.civ@health.mil and HMC Malcolm Roberts malcolm.j.roberts4.mil@health.mil for processing.

5.3.1 The contractor representative(s) at each site is encouraged to request a pre-maintenance inspection prior to the onset of the contract. As all apparent discrepancies must be identified upon submittal of quote, any and all claims must be received within 30 days of contract award or prior to contract start whichever occurs first. All non-apparent / hidden discrepancies must be identified no later than the first scheduled preventative maintenance. Any claims resulting from hidden defects must be received within 30 days of first scheduled preventative maintenance. Any equipment found to be inoperable during this pre-maintenance inspection would be repaired using a separate purchase order. The cost of repairs shall not exceed contractor’s normal retail rate for required repairs. The government certifies that the equipment to be maintained under this contract will be in good operating condition on the effective date of this contract. For the purpose of this contract, the clause, “good operating condition” means the conditions necessary for the equipment to function as intended without corrective maintenance. The contractor agrees to leave the equipment in good operating condition at the expiration of this contract. During the final week of this contract, the Government will make final inspection of the equipment. Any correction of deficiencies noted during this inspection shall be resolved prior to contract end. The Government reserves the right to request the repair (at no additional cost to the Government) of items identified with latten defects after contract termination, when it has been determined that defects either are a result of contractor’s performance or should have been discovered during normal performance of work under this contract.

5.3.2 The Government will not be responsible for the damage or loss due to fire, theft, accident, or other disaster of contractor supplies, materials, or for the personal belongings brought onto Government property by contractor’s personnel.

5.4 Replacement Parts: The contractor shall have ready access to unique and/or high mortality replacement parts. All parts supplied shall be compatible with the existing system. In the event that replacements parts are required to be shipped. Shipping shall be performed in the fastest reasonable means possible (i.e., next day air) at no additional cost to the Government. All replacement parts shall be new and certified as OEM replacement parts. In the event that new parts are not available, rebuilt parts and sub-assemblies are allowed provided that they are warranted to be free of defects for a period of time that meets or exceeds warranties of similar replacement parts. The contractor shall at their expense, replace all worn or defective parts necessary to restore the equipment to 100% operational condition as specified by the OEM. Vendor is not responsible for consumable items. The contractor shall specifically annotate on the final Field Service report the use and identification of rebuilt parts and the period of warranty. When discrepancies occur, the Government will make the final determination on whether a replacement part is of equal or better quality. Replacement parts must maintain the integrity of system / equipment certification to include compliance with any UL, AMA, Joint Comission (JC), manufacturer’s certifications or any other certifications as they apply.

5.4.1 The contractor shall at their expense, replace all worn or defective parts necessary to restore the equipment to 100% operational condition as specified by the OEM. Vendor is not responsible for consumable items.

5.4.2 Contractor installed replacement parts shall become the property of the Government and the replaced malfunctioning part shall become the property of the contractor. Replaced items shall be properly disposed of at no additional cost to the Government (contractor to pay all “environmental fees” where required).

5.4.3 Contractor’s pricing shall be inclusive of all cost including parts, labor, travel and shipping, unless otherwise indicated.

5.4.4 Freight, postage, and storage charges associated with shipment and receipt of replacement parts, and the return of parts shall be the responsibility of the contractor.

5.5 Software: The contractor must include software revisions and updates (field service changes), which are required due to FDA, or manufacturer announced safety-hazard recall, to include FDA Year 2000 Compliance Directive, as part of the contract at no additional cost to the Government. Updates shall be performed as soon as possible after release, but no later than the first scheduled Preventative Maintenance Inspection after release. For any updates that have been identified as critical, or required for the proper operation of equipment by the OEM, contractor shall provide installation within 30 days of release regardless of preventative maintenance schedules.

5.6 Removal of Government Property: Whenever the repair of equipment cannot be performed at the Government site as determined by the contractor, the contractor shall notify BME who will make arrangements for the contractor to remove the item to the contractor’s designated site. The contractor may be required to sign a Government form accepting responsibility for the Government equipment. The contractor shall provide a detailed description of removed items. For associated items / accessories, contractor to provide a detailed description and quantities of items to be removed. Description to include as a minimum manufacturers serial numbers and equipment control number (ECN) of all equipment / items removed. In the event that items / sub-assemblies / accessories are repaired via “Repair by Replacement” a detailed description of replaced items is to be included upon return of repaired components.

5.6.1 All charges resulting from a contractor determined requirement to transport Government owned property, covered by this contract, to and from an alternate repair location shall be the responsibility of the contractor.

5.7 Equipment Modification Upgrades: The contractor shall only incorporate OEM specified modifications, alterations and upgrades. Approval shall be obtained from BME prior to the contractor installation of any modification, alteration, or upgrades.

5.7.1 The contractor shall maintain contact with the OEM to determine the requirement for field modifications and to ensure accomplishment of these modifications in accordance with the time schedule set forth by the OEM.

5.7.2 The Government shall not alter the system without prior notification to the contractor.

5.7.3 The contractor at no additional cost shall provide software updates to the Government. Installation of updates will be left to the discretion of the Government. All supplied software is to be warranted current and free of defects such as viruses.

5.8 Service beyond the Scope of the Contract: The contractor shall immediately, but not later than 24 consecutive hours after discovery, notify BME, in writing, of the existence or the development of any defects in, or repair required to the scheduled equipment, which the contractor considers they are not responsible for under the terms of this contract.

5.8.1 At the same time of the notification, the contractor shall furnish BME with written estimate of the cost to make the necessary repairs. Repairs considered by the contracting Officer to be outside the scope of this contract shall not be covered under this contract, but shall be ordered under a separate purchase order.

5.9 Special Qualifications: The Contractor must be an OEM-certified service provider. Contractors must verify that an individual whom they plan to employ or continue to employ in the performance of this contract is authorized to accept employment in the United States. Individuals such as those who have been admitted as permanent residents, granted asylum or refugee status, or admitted in work-related nonimmigrant classifications may have employment authorization as a direct result of their immigration status

5.9.1 When using education/certification in conjunction with labor categories, the COR in coordination with the CO must establish a review process of contractor personnel to ensure labor category requirements are met.

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is Unclassified

6.2 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements:

6.2.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data. After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution.

6.2.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.3 System Communications - RESERVED

6.4 MHS Demilitarized Zone (DMZ) Medical Community of Interest (MedCOI) Business-to-Business (B2B) Gateway

6.4.1 If there is an external system connection to a DoD IS required, then the contractor shall, in accordance with contract requirements, connect to the DHA B2B Gateway via a contractor procured Internet Service Provider (ISP) connection.

6.4.2 The contractor shall assume all responsibilities for establishing and maintaining their connectivity to the B2B Gateway. This shall include acquiring and maintaining the circuit used to connect to the B2B Gateway and the acquisition of a Virtual Private Network (VPN) device maintenance agreement and license compatible with the MHS VPN device. The list of compatible devices are detailed in the DHA B2B/MedCOI Gateway questionnaire.

6.4.3 The contractor shall submit a completed current version of the DHA B2B Gateway questionnaire to their Contracting Officer or COR within 10 calendar days after new requirements have been provided to the contractor.

6.4.4 The contractor shall provide information specific to their connectivity requirements, proposed path for the connection and last mile diagram.

6.5 Contractor Provided IT Infrastructure

6.5.1 Platforms shall support HyperText Transfer (Transport) Protocol (HTTP), HyperText Transfer (Transport) Protocol Secure (HTTPS), web-derived Java Applets, and Secure File Transfer Protocols (SFTPs) (e.g., STFP, Secure Socket Layer/Transport Layer Security), and all software that the contractor proposes to use to interconnect with DoD facilities.

6.5.2 The contractor shall configure their networks to support access to Government systems (e.g., configure ports and protocols for access).

6.5.3 The contractor shall provide full time connections to a TIER 1 or TIER 2 ISP. Dial-up ISP connections are not acceptable. All IP addresses need to be publicly routable. Private address space using Network Address Translation will not be permitted.

6.5.4 The contractor shall maintain a valid maintenance contract and pertinent licenses for all devices connecting to the MHS B2B Gateway.

6.6 System Authorization Acess Request (SAAR), Defense Department (DD) Form 2875

6.6.1 The contractor shall submit the most current version of DD Form 2875, “System Authorization Access Request (SAAR), in accordance with CO guidance for all contractors that use the DoD Gateways to access Government IT systems and/or DoD applications shall. A DD Form 2875 shall be completed for each contractor employee who will access any system and/or application on a DoD network. The DD Form 2875 shall clearly specify the system and/or application name and justification for access to that system and/or application.

6.6.2 The contractor shall submit the completed DD Form 2875 to the DHA IT Security for verification of Tier I or Tier II Designation. The DHA Personnel Security will verify that the contractor employee has the appropriate background investigation completed or a request for background investigation has been submitted to the Office of Personal Management (OPM). Acknowledgment from OPM that the request for a background investigation has been received and that an investigation has been scheduled will be verified by the DHA Personnel Security prior to access being approved.

6.6.3 Upon approval, DHA will notify the user of the ID and password via secure/encrypted e-mail upon the establishment of a user account. User accounts will be established for individual use and may not be shared by multiple users or for system generated access to any DoD application. Misuse of user accounts by individuals or contractor entities will result in termination of system access for the individual user account.

6.6.4 The contractor shall conduct a monthly review of all contractor employees who have been granted access to DoD IS’/networks to verify that continued access is required

6.6.5 The contractor shall provide the DHA DPCLO with a report of the findings of their review by the 10th day of each month following the review. Reports identifying changes to contractor employee access requirements shall include the name, DoD ID number from CAC, Company, IS/network for which access is no longer required and the date access will be terminated.

6.7 MHS Systems Telecommunications

6.7.1 The primary communication links shall be via encrypted tunnels (i.e., Secure Internet Protocol (IPSEC), GetVPN, or Secure Socket Layer) between the contractor’s primary site and the MHS B2B Gateway.

6.7.2 The contractor shall place the VPN appliance device outside the contractor’s firewalls and shall allow full management access to this device (e.g., in router access control lists) to allow Central VPN Management services provided by DHA or other source of service as designated by the MHS to remotely manage, configure, and support this VPN device as part of the MHS VPN domain.

6.7.3 The contractor shall procure and configure for operation an auxiliary VPN device for backup purposes to minimize any downtime associated with problems of the primary VPN.

6.7.4 The contractor shall send devices to the MHS VPN management authority (e.g., DHA) via postage paid and include prepaid return shipping arrangements for the devices(s).

6.7.5 The MHS VPN management authority (e.g., DHA) will remotely configure and manage the VPN appliance once installed by the contractor.

6.7.6 The contractor shall be responsible for the maintenance and repair of contractor procured VPN equipment.

6.7.7 The Government will be responsible for the troubleshooting of VPN equipment.

6.8 Establishment of Telecommunications

6.8.1 Telecommunications shall be established with the MHS through coordination with DHA.

6.8.2 The contractor and DHA Program Office shall identify their requirement(s) for the establishment of telecommunications with the MHS and/or other Government entities.

6.8.3 The DHA/MedCOI B2B Gateway Questionnaire (provided by DHA) identifies the required telecommunication infrastructure between the contractor and the MHS systems. This includes all Wide Area Network, Local Area Network, VPN, Web DMZ, and B2B Gateway access requirements.

6.8.4 The contractor shall complete their applicable portion of the questionnaire and shall return it to the DHA designated POC for review and approval.

6.8.5 The contractor shall, Upon Government request, provide technical experts to provide any clarification of information provided in the questionnaire. DHA will review and process the questionnaire when it is accepted.

6.8.6 DHA will coordinate any requirements for additional information with the POC and schedule any meetings required to review the Questionnaire. Upon approval of the Questionnaire, DHA will coordinate a testing meeting with appropriate stakeholders.

6.8.7 DHA will notify the contractor POC of the meeting schedule. The purpose of the testing meeting is to complete a final review of the telecommunication requirements and establish testing dates.

6.9 Contractors Located On Military Installations

6.9.1 The contractor(s) shall coordinate/obtain the connections with the local MTFs/ Enhanced Multi-Service Markets (eMSMs) and Base/Post/Camp communication personnel located on a military installation who require direct access to Government systems.

6.9.2 These connections will be furnished by the Government.

6.9.3 Contractors located on military installations that require direct connections to their networks shall provide an isolated IT infrastructure. They shall coordinate with the Base/Post/Camp communications personnel and the MTF/eMSM in order to get approval for a contractor procured circuit prior to installation to ensure the contractor is within compliance with the respective organizational security policies, guidance and protocols.

Note: In some cases, the contractor may not be allowed to establish these connections due to local administrative/security requirements.

6.9.4 The contractor shall be responsible for all security certification documentation as required to support DoD IA requirements for network interconnections.

6.9.5 The contractor shall provide, on request, detailed network configuration diagrams to support IA accreditation requirements.

6.9.6 The contractor shall comply with IA accreditation requirements. All network traffic shall be via Transmission Control Protocol/Internet Protocol using ports and protocols in accordance with current Service security policy. All traffic that traverses MHS and/or military Service Base/Post/Camp security infrastructure is subject to monitoring by security staff using Intrusion Detection Systems.

PART 7

7.0 ATTACHMENTS/TECHNICAL EXHIBIT LISTING

(Under this section list all attachments and technical exhibits that will be useful for the contractor to submit an appropriate proposal.)

7.1 The following forms are to be completed by the FSO/Security POC, or COR once the contractor is granted the proper background investigation.

7.1.1 Contractor CAC Request Process. (If a more recent form is available, please replace the embedded version below.)

7.1.2 DHA’s contractor training instructions. (Current form embedded from October 2021. If a more recent form is available, please replace the embedded version below.)

7.1.3 DHA’s new employee handbook. (If applicable, if not delete entire 7.1.3 and the embedded document)

PART 7, ATTACHMENT 1

PERFORMANCE REQUIREMENTS SUMMARY

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective (The Service required—usually a shall statement from Part 5)

Performance Requirements Summary (PRS) # 1.

The contractor shall provide [Insert an objective that relates directly to a mission essential required item, i.e., analysis of DoD Business Process and Agency Operating Models and the PWS paragraph number, i.e., PWS paragraph 5.2].

(see listing below) and who performs, i.e., Validated Customer Complaint received by COR.]

PRS # 2

(See example provided in PRS 1.)

PRS # 3

(See example provided in PRS 1.)

PRS # 4

(See example provided in PRS 1.)

The following listing provides various types of Surveillance as examples to select from and should not be included on the final document:

Random Sampling: Appropriate for frequently recurring tasks. Evaluate randomly selected samples of the lot to determine the acceptability of the entire lot.

Random Inspection Guide, Method of surveillance, Lot size, Sample size, Performance requirement, Sampling procedure, Inspection procedure.

100 Percent Inspection: Appropriate for tasks that occur infrequently. Inspect and evaluate performance each time task is performed.

Periodic Surveillance: Evaluation of samples selected on other than 100% or statistically random basis. (i.e., monthly, quarterly, semi-annually etc.)

Validated Customer Complaint: Complaints must be validated.

NOTE: You may also identify any surveillance method used in the commercial market to survey the required service. (This will be discovered when market research is conducted).

7.2 Other Attachments

Attachment 2, Deliverable Schedule Table (Paragraph 6.5.2.1.1)

Attachment 3, Cybersecurity Regulations and Guidance (Paragraph 6.7.2.3)

Attachment 4, FRCS Responsibility Matrix (Paragraph 6.7.5.3)

Attachment 5, Risk Assessment Timeframes (Paragraph 6.7.7)

PART 7, ATTACHMENT 6

ESTIMATED WORKLOAD DATA

(This technical exhibit lists the historical estimated workload data, i.e., the estimated hours previously performed under the PWS by labor category. This workload data should be used to prepare the IGCE, if available. Note: Based on the PWS, historical workload data can be provided in other formats, i.e., the volume of task orders issued over a five year period, the number of users by locations requiring IT Support, etc. If hours are used, then the estimated quantity for each labor category should be the annual (e.g. 12 month) quantity.)

PART 7, TECHNICAL EXHIBIT 1

DELIVERABLES SCHEDULE

(This technical exhibit lists any reports or documentation that is required as a deliverable to include the frequency, # of copies, medium/format and who/where it is to be submitted. A deliverable is anything that can be physically delivered but may include non-physical things such as meeting minutes. Note: All PWS deliverables should be included in this exhibit.)