Draft Statement of Work -Salient Characteristics Connexus.pdf

Real Time Location System Asset Tracking and Management Solution

Landstuhl Regional Medical Center

18-Nov-22

Statement of Work (SOW) Landstuhl Regional Medical Center (LRMC)-Project for

Real Time Location System,

1. Background:

The Landstuhl Regional Medical Center (LRMC) is a hospital facility, located in Landstuhl, Germany.

2. Scope:

LRMC is seeking to acquire the ability of a real time location system (RTLS) via Radio Frequency Identification (RFID) for asset tracking/management. The ability to access and track assets through facilities is vital to ensure timely scheduled preventive maintenance, accurate inventory capture, and efficient allocation of assets for patient care.

Initial RTLS requirements will focus on asset tracking to facilitate preventive maintenance and inventory management. The system shall increase the efficiency of the hospital’s ability to identify, locate, track, and monitor assets. For this acquisition, the contractor shall provide the government with a RTLS that will consist of hardware, software, asset tags, RFID scanners, installation, configuration, and training on this system.

3. General Requirements:

- The selected Contractor shall provide an integrated RTLS (all hardware, tags, scanners, software etc. that make up the system) and provide all installation, configuration, training, and testing. This effort is to provide an integrated system with the capability to track and manage assets; these assets include, but are not limited to, medical devices, IT equipment, wheelchairs, beds etc. This requirement shall consist of 3000 Active tags, 3000 Passive tags, two (2) handheld scanners, and all software licensing required for a complete system.

4. Technical Requirements:

• The system shall be locally hosted and client/server-based.

• The system shall provide administrators with a thick client and web-based interface

• The system shall have local and remote administration and management

• The system shall be capable of leveraging a virtual infrastructure.

• The system shall leverage the hospital’s Local Area Network (LAN) for server and application administration.

• The system shall primarily leverage the hospital’s Wireless Local Area Network

(WLAN) for active asset tracking communication.

• The system shall use ports and protocols deemed approved for use on DoD networks. Refer to www.disa.mil for approved ports and protocols.

• The system shall be IPV6 capable.

http://www.disa.mil/

• The system shall be Public Key (PKI) enabled and Client Access Card (CAC) enforced.

5. System Capabilities:

o The system shall be able to track and manage 3,000 Active and 3,000 Passive tags initially with the ability to scale up to 50,000 assets.

o The system shall have alert options that at least display and send alerts via e-mail.

o The system shall provide zone tracking, such as when tags pass a system-defined boundary.

o The system shall provide location resolution within a 10-foot radius or 90% precision room-level accuracy for active tracking.

6. Software:

• The software shall provide users with a full featured web-based interface.

• The software shall support up to 20 concurrent users.

• The software shall allow for equipment location queries, searches, displays and custom or automated reports.

• The software shall provide an assets location, at a minimum, by class (device nomenclature), serial number, Equipment Control Number (ECN), floor, zone, or room.

• The software shall show last known location and historical location data for at least a 12-month period, for any given tagged asset.

• The software shall support role-based administration and asset management that allows for various levels of software access, including at a minimum read-only, edit and full administrator access.

7. Tags:

• Active and Passive tags shall have the option for permanent and temporary mounting.

• Permanently mounted tags shall not be easily removed.

• Tags must be able to be cleaned via typical equipment infection control disinfectant.

• Tags shall have the ability to be mounted on multiple types of materials used in medical equipment, including but not limited to plastics and metals.

• Examples of medical equipment to be tagged include but are not limited to: infusion pumps, electrocardiographs, ventilators, mobile radiographic units, beds, and wheelchairs.

Active tags

• Must be able to beacon at least once per minute.

• Shall have a battery life of at least two (2) years assuming a beaconing frequency of once per minute.

• Must use a commercially available battery.

• Shall include programmable buttons and indicator lights.

• Shall be programmable remotely to change beaconing frequency and for configuration

• Shall have a Wi-Fi interface compatible with WLAN 802.11n or later specification.

Passive tags

• Must be no larger than 1 inch x 3 inches (length by width)

• Shall have a minimum read range of 6 feet from readers

Network:

• The system must not degrade the current WLAN/LAN throughput

Implementation:

• The Contractor shall conduct a site survey prior to implementation.

• Heat maps and floor plans will be provided by the government.

• The Contractor shall prepare and submit a site survey report to the government.

• The report shall include at a minimum:

• Location accuracy expectations leveraging WLAN.

• Finding and/or recommendations regarding the need for enhancements, for example additional access points, to meet accuracy requirements.

• Findings and/or recommendations for supplemental RFID technologies (e.g. infrared, ultrasound etc.) if needed to meet required location tracking accuracy or areas where Wi-Fi is not conductive.

• Finding and recommendations regarding WLAN shall be annotated on the heat map and/or floor plans.

• The Contractor shall develop a detailed project schedule. The final schedule should be delivered to the government in PDF format. The schedule should show timelines for on-site work, installation, training, and setup. The schedule should also delineate major milestones and work durations. This schedule will be coordinated with the overall initial outfitting and transition plan, and used to ensure LRMC personnel are available during the times needed and that coordination with staff can be effectively accomplished.

• The Contractor shall work with the LRMC Information Management Department (IMD) to install and configure software for full system functionality (i.e. level of resolution, zones, etc.).

• The Contractor shall work with the LRMC IMD for server installation and network implementation.

• The Contractor shall conduct system acceptance testing to include testing of all system and software requirements.

10. Training:

• The Contractor shall provide three levels of on-site training, to include all necessary student-training materials, on the installed RTLS.

• General user training shall include at least the following knowledge areas:

• End-user software client operation to include launching the application, application navigation, systematic procedures for how to perform queries, application capabilities, and application functions.

• Super user training shall include at least the following knowledge areas of concentration:

• Application and database set-up and configuration, user account setup, operation and maintenance of tags to include procedures for tag activation, programming, naming conventions, mounting and removal, and periodic maintenance.

11. Support Requirements:

• The Contractor shall provide at least a one-year warranty on all Contractor provided system components.

• The Contractor shall provide technical phone support as least during normal duty hours, 0800 to 1700, Monday through Friday, excluding Federally recognized holidays.

• The Contractor shall provide at least two user manuals and two operator manuals for all hardware and software components, regardless of original equipment manufacturer (OEM).

12. Information Assurance (IA) Requirements:

Security:

• All contractor employees shall adhere to the DoDI 8570.01-M training and certification requirement for persons executing work on behalf of the Government. Additionally, all personnel accessing information systems shall have an IAT Level III Baseline Certification per. the DoDI 8570.01-M, and undergo the annual cybersecurity awareness challenge exam on the Fort Gordon, Georgia, information assurance (IA) training portal and shall complete the Health Insurance Portability and Accountability Act (HIPAA) and Privacy Act Training Course on Joint Knowledge Online (JKO).

OPSEC:

• All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities, controlled access areas, or require network access, shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. Upon request, the contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website:

http://jko.jten.mil/courses/atl1/launch.html; or it can be provided by the RA ATO in presentation form which will be documented via memorandum.

• All contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation/facility access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any installation or facility change, the Government may require changes in contractor security matters or processes.

• Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05 / AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative, as NCIC and TSDB are available), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

• The contractor and all associated sub-contractors shall receive a brief/training (provided by the RA) on the local suspicious activity reporting program. This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the project manager, security representative or law enforcement entity. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 5 calendar days after the completion of the training.

• All contractor employees with access to a government info system must be registered in the Army Training Certification Tracking System (ATCTS) at commencement of services, and must successfully complete the DOD

Information Assurance Awareness prior to access to the information systems and then annually thereafter in accordance with personnel security standards listed in AR 25-2 (Information Assurance), an appropriate background investigation will be conducted prior to accessing the government information systems.

• The Contractor shall develop an OPSEC SOP/Plan within 90 days of contract award. The OPSEC SOP/Plan must be reviewed and approved by the RA OPSEC Officer. The SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator.

• All new contractor employees will complete Level I OPSEC Training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training. OPSEC awareness training is available at the following websites: https://www.iad.gov/ioss/ or http://www.cdse.edu/catalog/operations-security.html; or it can be provided by the RA OPSEC Officer in presentation form which will be documented via memorandum.

• The Contractor must pre-screen Candidates using the E-verify Program

• (http://www.uscis.gov/e-verify ) website to meet the established employment eligibility requirements. The Vendor must ensure that the Candidate has two valid forms of Government issued identification prior to enrollment to ensure the correct information is entered into the E-verify system. An initial list of verified/eligible Candidates must be provided to the COR no later than 3 business days after the initial contract award.

Cyber Security:

• The contractor shall design, develop, and integrate cybersecurity (CS) (to include, but not limited to, all hardware, software and/or equipment) IAW Department of Defense (DoD) standards, per. DoD 8500.01, 8510.01 and DoD 8530.01. Per the DoD 8500.01, all information technologies (IT) systems, also known as devices, communications, security and control systems are required to be assessed and authorized by an authorizing official (AO) via a formal authority to operate (ATO) utilizing the Risk Management Framework (RMF) process.

• The contractor shall deliver system(s), application(s) and databases to the Government already in a hardened state, where possible, IAW current DoD, Army, and DISA standards. This includes the application of automated and manual STIGs and any additional hardening efforts required to make the system ready to connect https://www.iad.gov/ioss/ http://www.cdse.edu/catalog/operations-security.html http://www.uscis.gov/e-verify to a DoD network. When issues are found (High, Medium, Low Impact Levels) the Contractor shall work with the on-site IMD Cyber Security Team to remediate those issues and have the system rescanned to ensure all issues have been fixed and/or properly and acceptably mitigated.

• High impact level findings that cannot be fixed shall be reported to the Government immediately along with a valid reason the vulnerability cannot be fixed and a mitigation plan to fix the vulnerability in the future.

• The Contractor shall provide to the government the follow artifacts related to Cybersecurity and the RMF process.

• Network Architecture Diagram

• Software \ Hardware listing

• Listing of Ports, Protocols and Services

• Have an Engineer available during installation of application, to work with the

Hospital IMD Cyber Security Team conducting ACAS system scans.

• Engineer shall remediate any finding(s) from the scanning process.

• The IT systems and components provided for this facility by the contractor / vendor shall be able to obtain a favorable ATO using the RMF Process to all requisite Government networks. All network and communication equipment provided shall be listed on the unified capabilities approved products list (UC APL). The contractor shall provide CS that is IAW current policies, procedures, and statutes, to include (but not limited to) the following:

o Army Regulation (AR) 25-1, Army Information Technology o Army Regulation (AR) 25-2, Information Assurance o The Federal Information Security Management Act (FISMA) o Committee on National Security Systems, Policy No. 11 o Federal Information Processing Standards o Defense Information Systems Agency (DISA) Secure Technical

Implementation Guides (STIGs) o DoD Instruction 8510.01, Risk Management Framework (RMF) for

DoD (IT) o DoD Directive 8140.01, Cyberspace Workforce Management o NIST SP 800-37, RMF for Information Systems and Organizations o NIST SP 800-53, Security and Privacy Controls for Information

Systems and Organizations

13. Period of Performance:

The period of performance is 150 days from contract award.

14. Delivery Requirements:

• The Contractor must notify the site Technical POC of the intent to deliver equipment a minimum of 14 business days prior to shipping in order to assure that the facility is ready to except the equipment for installation. Email address and telephone number will be provided after award of contract. All uncoordinated shipments will be refused at the contractor’s expense.

• The Contractor is required to provide a delivery vehicle and personnel with appropriate unloading capability where applicable.

• Transport of equipment to the installation areas within the hospital will be solely the responsibility of the contractor.

• The Contractor shall clean up all debris and discard in the appropriate recycle dumpsters outside the building provided by the U.S. Government.

Location: The delivery and installation shall take place at the following location.

Dr. Hitzelberger Strasse 66849 Landstuhl, Germany

Schedule: Hours of operation are 0730-1630 MST, Monday-Friday, except Federal and Local Holidays.

Delivery & Technical Points of Contact (POC):

Name: ……………………………..

Title: Project Manager, Landstuhl Regional Medical Center Email: ……………………………….

Office Phone: ………………………

Name: ……………………………… Title: Contracting Officer Email: ……………………………… Office Phone: ……………………..