EBMS Donor Sustainment PWS v3 CLEAN.pdf

DHA PWS Template V7 (August 19, 2018)

Department of Defense

Defense Health Agency –

Performance Work Statement –

(EBMS) Donor Sustainment

Health Information Technology (HIT)/Solution Delivery Division (SDD)

Electronic Health Record (EHR) Core Program Management Office

Solicitation Number:

Version:01

Date: 02/07/2020

(August 19, 2018)

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide Enterprise Blood Management System (EBMS)

Donor Sustainment. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the

Contractor who, in turn is responsible to the Government.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform EBMS Donor Sustainment as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this performance work statement.

1.3 Background: The Military Health System (MHS) consists of a worldwide network of military hospitals, health clinics, the Department of Defense’s (DoD) private sector health business partners, and the

Uniformed Services University of the Health Sciences. The primary mission of the MHS is to ensure the

Nation has available at all times a healthy fighting force and the ability to support DoD missions worldwide. The Assistant Secretary of Defense for Health Affairs (ASD (HA)) oversees the MHS and is responsible for providing a cost effective, quality health benefit to 9.4 million active duty members, retirees, survivors and their families. The Defense Health Agency (DHA) operates the MHS under the authority, direction, and control of the ASD (HA), who also serves as the Director of DHA.

Electronic Health Record Core Program Management Office

The mission of the Electronic Health Record (EHR) Core Program Management Office (PMO) is to sustain the current DoD EHR suite of outpatient and inpatient IT applications and systems used in the garrison setting. The current EHR provides Information Technology (IT) capabilities to over 96,000 users at 99 host sites and 400+ clinics, supporting 9.4M beneficiaries and averaging 775K outpatient encounters per week.

The EHR Core PMO’s mission includes maintaining and ensuring stability of the AHLTA Clinical Data

Repository (CDR) which contains data entered by Armed Forces Health Longitudinal Technology

Application (AHLTA) users, data constantly extracted and translated from the 101 Composite Health Care

System (CHCS) host systems, and clinical data flowing from the Theater.

Enterprise Blood Management System

Prior to the late 1990s, the Department of Defense (DoD) Blood Banks (donor centers and Donor services) used manual processes to comply with required documentation. Patient and test data were transcribed by hand onto labels, logs and result forms; look-backs required manual examination of blood Donor and donor records; patient and donor records were retrieved manually; inventory counting was done manually which resulted in inconsistent availability of blood supplies, over collection and increased number of expired blood units. In response to the need to automate blood management processes, the MHS developed an

Automated Information System (AIS) to support the Armed Services Blood Program (ASBP), the Surgeons

General and MHS personnel readiness. The legacy system, the Defense Blood Standard System (DBSS), was designated by the US Food and Drug Administration (FDA) as a Class II Medical Device (510K).

EBMS is a DoD Mission-Essential, Acquisition Category III Program consisting of two Increments:

Increment 1 – Enterprise Blood Management System – Donor (EBMS-D): Manages blood donation and donor deferral as well as the laboratory and distribution modules which manage the manufacturing and distribution of various blood products.

Increment 2 – Enterprise Blood Management System – Transfusion (EBMS-T): Manages the receipt, inventory and final disposition of blood products, a lookback capability for managing blood products, a learning system for training/reference, and data analytics.

(August 19, 2018)

Both EBMS Increments are FDA 510(k) cleared Class II medical devices manufactured by WellSky™

(previously known as Mediware). EBMS-D consists of the LifeTrak® Blood Donor Management

Commercial-Off-The-Shelf (COTS) product. EBMS-T consists of WellSky™ Blood Centers (previously known as LifeTrak™) COTS product.

1.4 Objectives: The objective of this contract is to support the operation and sustainment of WellSky™

Blood Centers at Blood Donor Sites as identified in Attachment 6. The Contractor shall follow the Code of

Federal Regulations (CFR), Title 21, Series 800, to ensure that WellSky™ Blood Centers is safe and effective for its intended use to include the implementation of a Quality Management System. This shall ensure that the WellSky™ Blood Centers is sustained as a FDA regulated medical device to support the health and safety of the 9.2 million MHS beneficiaries.

This support shall include installation and sustainment of all test, training, and production environments, site Military Treatment Facility (MTF) and Blood Donor Center (BDC) installs, customer support, system and infrastructure maintenance at MHS Enterprise Service Operations Center (MESOC), COOP site

(Aurora), and the test environments (traditional data centers or cloud infrastructure), and quality assurance.

This support also includes change and configuration management of current and future versions of

WellSky™ Blood Centers to ensure production of safe, pure, and potent blood products.

This support also includes the configuration, implementation and maintenance activities required to deploy new versions of WellSky™ Blood Centers (future releases and/or upgrades of application software throughout the life of the sustainment contract) to include interfaces with other clinical systems (i.e. CHCS and other specified government interfaces). All components of the application software including reports are required to perform accurately and contain no defects on all versions. All supporting, and third-party software shall be tracked and tested to ensure that all versions are current and qualify for use with the system. Tracking of expiration dates, licenses, end of life notifications, cybersecurity compliances are some of the attributes to be tracked in addition to others that may be identified during the contract period.

In addition, the Contractor shall manage the Host Based Security System (HBSS) on the Enterprise Blood

Management System (EBMS) production, training, and testing servers located at three MHS sites (San

Antonio, TX, Aurora, CO, or equivalent Government data and testing center). HBSS is a DoD Commercial

Off-The-Shelf (COTS) suite of software applications used within the DoD to monitor, detect, and counter attacks against DoD computer networks and systems. The Contractor shall acquire certification to manage

HBSS. The EBMS servers (i.e. mobile server, etc.) will be managed using HBSS, Anti-Virus/Anti-malware, monitoring, and management administration software packages installed by the Contractor, EBMS HBSS administrators. If DoD selects another suite of software serving a similar purpose to HBSS, the Contractor shall manage that software suite and acquire any necessary certification. The basic service objective is to ensure operational resilience through maintaining IA regulatory compliance, DHA security posture and via implementation of a cybersecurity risk management process to ensure protection of DoD systems, assets and/or technology components (e.g. hardware and software).

1.5 Scope: This award provides for maintenance and sustainment services in support of the currently deployed version of the WellSky Blood Centers and its associated components (i.e. Analytics, KnowledgeTrak, etc. ), an FDA regulated Class II medical device. This award also provides for the configuration, implementation and maintenance activities required to deploy new versions of WellSky™

Blood Centers (future releases and/or upgrades of application software throughout the life of the sustainment contract) to include interfaces with other clinical systems (i.e. CHCS and other specified government interfaces).

This award also provides for the maintenance and sustainment of the HBSS on the EBMS production, training, and testing servers and the management of HBSS on all EBMS servers at MHS Enterprise Service

Operation Center (MESOC) San Antonio, TX, all COOP EBMS servers at MESOC Aurora, CO, or an equivalent testing environment and all Mobile Servers located at EBMS-D sites. Services include testing and implementation of HBSS on applicable servers. The contractor shall accomplish the sustainment and maintenance of a secure and safe medical device to ensure that the medical device can operate in DoD environments and provide safe patient treatment and outcomes.

1.6 Period of Performance (PoP): The period of performance shall be for one (1) Base Year of 12 months and three (3) 12-month option years. In addition, there is an optional 1 month Transition Out, and an optional 6 month extension IAW FAR 52.217-8. The Period of Performance reads as follows:

Base Year October 1, 2020 – September 30, 2021

Option Year I October 1, 2021 – September 30, 2022

Option Year II October 1, 2022 – September 30, 2023

Option Year III October 1, 2023 – September 30, 2024

Transition Out (Optional) After last exercised option period for 1 month duration

FAR52-217.8 (Optional) After last exercised option period for 6 months duration

1.6.1 Transition: Transition-out period

Option Item: Outgoing Transition

In accordance with this task order, and due to the importance of having a comprehensive plan prior to opting for this task the Contractor shall provide a detailed Outgoing Transition Plan (Deliverable 21) that includes a comprehensive listing of activities such as those listed below, that demonstrates their understanding of all the tasks involved with a transition-out as well as a timeline on when those tasks would best be conducted for the benefit of the Government. This plan shall provide for 90 days outgoing transition for transitioning work from an active task order to a follow-on contract/order or Government entity. This transition may be to a Government entity, another Contractor or to the incumbent Contractor under a new contract/order. In accordance with the Government-approved plan, the Contractor shall assist the Government in planning and implementing a complete transition from this Contract and/or orders issued under this Contract to a successful provider. This shall include formal coordination with

Government staff and successor staff and management. It shall also include delivery of copies of existing policies and procedures, and delivery of required metrics and statistics. This transition plan shall be in accordance with the SDD Transition Plan guidance that includes, but is not limited to:

Coordination with Government representatives, Review, evaluation and transition of current support services, Transition of historic data to new Contractor system, Government-approved training and certification process, Transfer of hardware warranties and software licenses, Transfer of all System/Tool documentation to include, at a minimum: user manuals, system administration manuals, training materials, disaster recovery manual, requirements traceability matrix, configuration management documents and all other documents required to operate, maintain and administer systems and tools, If another Contractor follows this Contractor with work related to this work, this Contractor will provide any developed source code (compiled and uncompiled, including all versions, maintenance updates and patches) with written instructions for the source code on which this

Contractor has worked, so that an experienced software engineer, previously not familiar with the source code can understand and efficiently work with the source code. In addition, this Contractor will provide for 90 days, a software engineer (or person of comparable work level) with significant experience working with the source code, to assist the new Contractor, Orientation phase and program to introduce Government personnel, programs, and users to the

Contractor's team, tools, methodologies, and business processes, Disposition of Contractor purchased Government owned assets, including facilities, equipment, furniture, phone lines, computer equipment, etc., Disposition of tool(s) and/or emulator(s) used to test the developed product, Transfer of Government Furnished Equipment (GFE) and Government Furnished Information

(GFI), and GFE inventory management assistance, Applicable DHA debriefing and personnel out-processing procedures, Turn-in of all government keys, ID/access cards, and security codes.

1.7 Administrative specifications

(August 19, 2018)

1.7.1 Place of performance: The work to be performed under this contract will be at the Contractor’s facilities and via travel to the sites listed in Attachment 6.

1.7.2 Recognized Federal holidays: The Contractor shall not be required to perform work on the following holidays, except at Military Treatment Facilities (MTFs) when required to do so by the COR.

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day

President’s Day Veteran’s Day

Memorial Day Thanksgiving Day

Independence Day Christmas Day

1.7.3 Hours of operation: The contractor is responsible for conducting business, between the hours of 8:00

AM and 5:00 PM, local time, Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. In addition, circumstances may require work outside of normal business hours at the

MTFs/BDCs and/or system maintenance and troubleshooting for issues. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall consider employee suitability to ensure the stability and continuity for the project based upon the contract requirements.

1.7.4 Emergency Services: On occasion, services may be required to support an activation or exercise of contingency plans outside othe normal duty hours.

1.7.5 Conduct: Contractor personnel shall adhere to standards of conduct as established by the DHA

Commander.

1.8 Contractor travel: Contractor will be required to travel CONUS and OCONUS during the performance of this contract. Contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires

Government approval/authorization and notification to the COR. Contractor travel shall be compliant and adhere to Government per diem rates, where applicable. Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. Travel costs shall be incurred and billed in accordance with FAR Part 31. Costs for these expenses will be reviewed, certified and approved by the COR. The Contractor shall comply with requirements in the DoD Electronic Foreign

Clearance Guide for all travel outside the United States. The Contractor shall adhere to any specialized training requirements and country/theater clearance lead times as specified in the DoD Electronic Foreign

Clearance Guide. In addition to the requirements in the DoD Electronic Foreign Clearance Guide, the

Contractor shall comply with the requirements below.

1.8.1 DHA Foreign Travel Requirements: Contractor employees who will be employed, assigned, or on temporary duty to locations outside of the United States shall complete a DHA Form 18 (Attachment 14), and provide the completed Form (Deliverable 80) to the DHA Mission Assurance Division (e-mail address provided on Form) not later than ten (10) working days prior to travel. The DHA Form 18 is available through the DHA Mission Assurance Division Forms Library web page (CAC login required). Upon return from foreign travel, debriefings may be required based on the travelers encounter with any reportable situations. If the traveler has a situation to report, they must contact DHA security (dha.ftv@mail.mil) with the following information (notifications shall not contain any classified information):

• Date/time of incident

• Location of incident

• Level of information involved (if involved and/or known)

1.8.2 Performance in Germany: Contractor personnel providing support under this contract who will travel to Germany will be classified as Troop Care Information Technology (TC-IT) Providers as specified in the

(August 19, 2018)

Supplementary Agreement (SA), North Atlantic Treaty Organization (NATO) Status of Forces Agreement

(SOFA), Article 72, Treatment of Non-German Commercial Enterprises.

1.8.2.1 The Contractor shall follow the German “fax-back” process for employees who will travel to

Germany in performance of this contract. This process may only be used for employees who will remain in

Germany for 90 days or less in a 12-month period. The fax-back process must be completed before the employee arrives or begins work in Germany (before the employees leaves the CONUS or other location for Germany). The Contractor shall refer to Army in Europe Regulation 715-9, Contractor Personnel in

Germany – Technical Expert, Troop Care, and Analytical Support Personnel, for additional guidance. As requirements are subject to change, the Contractor shall refer to the DoD Electronic Foreign Clearance

Guide and the DoD Contractor Personnel Office (DOCPER) website (currently at http://www.eur.army.mil/g1/content/CPD/docper/docper_germanyLinks.html?tab=5&framepage=germanfa xback.html#top) for the latest information.

1.8.3 Performance in Japan: See Attachment 9.

1.8.4 Performance in Korea: See Attachment 11. Not later than 20 work days prior to any Contractor employee travelling to Korea, the Contractor shall provide the COR with a completed USFK Form 700-

19A-R-E (Attachment 12) (Deliverable 81), Applicant Questionnaire Memo (Attachment 13) (Deliverable

82), and a copy of the first page of their passport. The COR will notify the Contractor when SOFA designation has been obtained for their employees. Contractor employees shall not travel to Korea prior to confirmation from the COR that the employee has been approved for SOFA designation. Additional information is available in USFK Regulation 700-19, The Invited Contractor and Technical Representative

Program. The United States Forces Korea (USFK) Acquisition Management website (currently located at http://www.usfk.mil/Organization/AcquisitionManagement,FKAQ.aspx) also contains additional information and links to required forms.

1.8.5 Performance in Spain: All Contractor employees, regardless of their length of stay in Spain, supporting a DoD contract must obtain a Certificate of Civil Liability Insurance, in accordance with the requirements of the US-Spain Agreement on Defense Cooperation, issued in Spain. This insurance must be issued by a company authorized to conduct this type of business in Spain and may not contain any deductible or similar limitation. To obtain the certificate, Contractors must contact their insurance provider and instruct them to contact their affiliate in Spain, who in turn will issue the certificate and forward it to the Contractor, who will obtain a corporate signature. The signed certificate must be e-mailed along with a completed Country

Clearance Request form, the Employee Certification, and a statement from the DoD contract administrator validating the visit to the point of contact at the unit being visited (for visits to Naval Station Rota, or Moron

Air Base), who in turn will endorse the visit and forward the documents to the U.S. Embassy Office of

Defense Cooperation (ODC) for processing through Spanish authorities. Contractors visiting any other location in Spain in support of a DoD contract must follow instructions identified above; However, the

Certificate of Civil Liability Insurance, the Country Clearance Request form, the Employee Certification, and the statement from the DoD contract administrator validating the visit will be e-mailed directly to the

ODC for processing through Spanish authorities. Additional information is available at the CNIC Naval

Station Rota website (currently at http://www.cnic.navy.mil/regions/cnreurafswa/installations/ns_rota/about/gs-and-civilian-sponsorship.html).

The current minimum required coverage of said insurance is as follows:

• Personnel Liability (Per Injured Party) 90,151.82 Euros

• Property Damage (Per Occurrence) 60,101.21 Euros

• Security Deposit (Judiciary Bond to cover court expenses) 6,010.12 Euros

• Maximum Total (Per Occurrence) 601,012.10 Euros

1.9 Other Direct Costs (ODCs): If proposed, ODCs shall be billed on a cost-reimbursable basis. Costs are defined as the purchase price of materials or service plus General and Administrative charges (G&A) or material and handling charges (M&H). G&A or M&H charges received by the Contractor are subject to periodic Government conducted Defense Contracting Audit Agency (DCAA) audits and to adjustment as a result of the final contract closeout audit conducted by DCAA. Profit/fee on ODCs other than http://www.eur.army.mil/g1/content/CPD/docper/docper_germanyLinks.html?tab=5&framepage=germanfaxback.html#top http://www.eur.army.mil/g1/content/CPD/docper/docper_germanyLinks.html?tab=5&framepage=germanfaxback.html#top http://www.usfk.mil/Organization/AcquisitionManagement,FKAQ.aspx http://www.cnic.navy.mil/regions/cnreurafswa/installations/ns_rota/about/gs-and-civilian-sponsorship.html

(August 19, 2018) subcontracting is prohibited. All ODCs shall be fully supported in compliance with all competition requirements of the FAR, specifically Part 31. All ODCs shall be reported in the Monthly Progress Report

(Deliverable 3).

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s quality control program is the means by which the work complies with stated requirements.

The Contractor shall deliver a Quality Control Plan (QCP) (Deliverable 11) to the Government, the draft being due with the technical proposal, and the final being due 30 days after date of award. Additional details regarding the QCP are provided in paragraph 5.2.2.6.1. After acceptance of the Quality Control

Plan (QCP) the contractor shall receive the contracting officer’s (CO) acceptance in writing of any proposed change to his QC system. See Technical Exhibit 1 - Contract Data Requirements List (CDRL)

A001.

1.10.2 Quality assurance: The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel

1.11.1 Common Access Card (CAC) requirements: All security and CAC requirements are identified in

Attachment 4 found in Part 7, 7.4. Contractor personnel performing work must have and maintain the appropriate security and designation required.

1.11.1.1 Automated Data Processing/IT (ADP/IT): The ADP/IT levels and position sensitivity designation for positions under this TO shall be ADP/IT I and ADP/IT II.

1.11.2 Contractor training. The contractor shall complete all requirements, training, and forms per the

DHA’s Onboarding Checklist for Contractor Employees, current edition February 2018 or more recent when updated. See the form at https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf.

1.11.2.1 The DHA’s Onboarding Checklist for Contractor Employees at Part 7 Section 7.1.2

1.11.2.2 The DHA’s Contractor training instructions embedded at Part 7 Section 7.1.3.

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at:

https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.2.4 The DHA’s new employee handbook at Part 7 Section 7.1.4.

1.11.3 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use.

1.11.4 Key control: RESERVED

1.11.5 Lock combinations: RESERVED

https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx

1.11.6 Personally Identifiable Information (PII), Protected Health Information (PHI), and Federal

Information Requirements (Attachment 15).

1.12 Key Personnel (Government): RESERVED

1.12.1 Key personnel (Contractor): Qualifications for all key personnel are listed below:

Project Manager – The Project Manager must have at least five years of applicable technical and managerial experience within Health Information Technology, experience with DHA projects, and a

Bachelor’s degree, PMP certification preferred but not required.

Subject Matter Expert-Master (Blood Bank Subject Matter Expert) – The Subject Matter Expert must have at least three years of Donor experience and have Specialist in Blood Bank (SBB) certification.

1.12.2 Substitutions of proposed Key Personnel shall not be allowed for a period of six months after award, except under extreme circumstances. Any substitution or replacement of Key Personnel shall have qualification equal to or greater than the individuals proposed. For temporary and/or permanent replacement of Key Personnel, the Contractor shall provide a resume for each individual to the CO.

Resumes shall be provided at least two weeks (or as mutually agreed upon) prior to making any personnel changes. The Government reserves the right to pre-approve any replacement or substitution of Key

Personnel.

1.12.3 Program Manager: The contractor shall provide a program manager who shall be responsible for the performance of the work and the single point of contact. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the CO. The contract manager or alternate shall have full authority to act for the contractor on all technical matters relating to daily operation of this TO. The contract manager or alternate shall be available between 8:00 AM and 5:00

PM, local time, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

1.13 Data rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.14 Government training: The Contractor shall ensure that all Contractor employees attend or successfully complete all mandatory Government training. The training typically encompasses matters of security and safety, and is provided during billable time at no cost to the Contractor.

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): RESERVED

1.14.2 Non-Disclosure Agreement (NDA): All DHA Government contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA Contractor NDA (DHA Form 49) (Deliverable 1) prior to beginning work on the subject contract. The Contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not

(August 19, 2018) executed this statement or failure to adhere to this statement shall constitute default on the part of the

Contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.14.3 Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor

Contractor's performance and notifies both the CO and Contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with

Federal Acquisition Regulation Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.14.5 CDRL: DHA Health IT is being strategically managed. DHA's CO, Program Manager and other appropriate Government personnel may meet periodically to assess enterprise level performance of contractors and issues related to Health IT acquisition. Data will be gathered through CDRL (DD Form

1423-1). Enterprise level data will be collected and may be used as a source for Past Performance in

Contract Performance Assessment Reporting System (CPARS). The CDRL will reside as an exhibit to the

PWS when applicable to this effort, See Part 7, 7.6 Technical Exhibit 1.

1.14.5.1 Initial performance deliverables include: Contract usage, contract number, PoP, CO's name, Contracting Specialist's name (if applicable), COR’s name. Deliverables will be emailed using document received from the Government. See Part 7, 7.6 Technical Exhibit 1 - CDRL 2 Initial Performance Report

B002.

1.14.5.2 Monthly performance deliverable includes providing the prescribed documentation to the government in a timely manner. Information provided will include contract specific details on contractor availability, requirements delivered and accepted by the government, schedule variances and small business compliance. See Technical Part 7, 7.6 Technical Exhibit 1 - CDRL 3 Monthly Performance Report B003.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-

A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting

DHA/DAD-A/HCA understands that the person is contractor support personnel.

(August 19, 2018)

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with

Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system (If applicable, if not delete 1.16.1 and 1.16.2 and replace to

1.16 Reserved). Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The Contractor shall be prepared for this process as it could take two (2) or more weeks. The Facilities Security Officer/Security

POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security

Office in writing of a contractor's termination from the contract, including the termination date.

1.17. Personnel Security

1.17.1 The contractor shall comply with

DoD 8570.01-M, “Information Assurance Workforce Improvement Program,” December 19, 2005 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule

Compliance in DoD Health Care Programs”, DoDI 6025.18 “HIPAA Privacy Rule Compliance in DoD

Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel

Security Program (PSP),” dated April 3, 2017. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances.

Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 681-

6777.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office will deny any access to any automated information system (AIS), network, or CUI if a contractor receives an unfavorable adjudication, or if information that would result in an unfavorable adjudication becomes available.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS

2.1 Definitions

2.1.1 Category D: Information Technology and Telecommunications Services (called D-Services)

2.1.2 Category R: Support (Professional/Administrative/Managements) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts, and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the contracting officer to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the Quality Assurance Surveillance Plan or require the offerors to submit a proposed Quality

Assurance Surveillance Plan for the Government’s consideration in development of the Government’s plan.

2.1.7 Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the

Government. The term used in this contract refers to the prime.

2.1.8 Defective Service: A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.9 Deliverable: Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.10 Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.11 Physical Security: Actions that prevent the loss or damage of Government property.

2.1.12 Quality Assurance: The Government procedures to verify that services being performed by the

Contractor are performed according to acceptable standards.

2.1.13 Quality Control: All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.14 Subcontractor: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.15 Work Day: The number of hours per day the Contractor provides services in accordance with the contract.

2.1.16 Work Week: Monday through Friday, unless specified otherwise.

2.2 Acronyms:

ACRONYM MEANING

3DES Triple Data Encryption Standard

A&A Assessment & Authorization

ABACUS Armed Forces Billing and Collection Utilization Solution

ACE AHLTA/CHCS Express

ACOR Alternate Contracting Officer’s Representative

ACPD Automated Change Package Distribution

ADAMHA Alcohol, Drug Abuse and Mental Health Administration

ADP Automated Data Processing

AES Advanced Encryption Standard

AHLTA Armed Forces Health Longitudinal Technology Application

AIS Automated Information System

AM Acquisition Manager

AMEDD Army Medical Department

AO Authorizing Official

API Application Program Interfaces

APU Ambulatory Procedure Unit

AQL Acceptable Quality Level

ASD Assistant Secretary of Defense

ATFBH Army Task Force for Behavioral Health

ATO Authorization to Operate

AUB Agency Use Block

B2B Business-to-Business

BAA Business Associate Agreement

BAC Budget At Completion

BCP Business Continuity Plan

BECS Blood Establishment Computer System

BH Behavioral Health

BHIE Bidirectional Health Information Exchange

C&A Certification and Accreditation

CAC Common Access Card

CACB Common Access Card Branch

CAF Central Adjudication Facility

CAL Category Assignment List

CAP Contractor-Acquired-Government Owned Property

CASE Computer-Aided Software Engineering

CBT Computer Based Training

CC Change Control

CDD Certificate of Data Disposition

CDR Clinical Data Repository

CDR Critical Design Review

CDRL Contract Data Requirements List

CE Computing Environment

CERT Computer Emergency Response Team

CFR Code of Federal Regulations

CFSR Contract Funds Status Reports

CHCS Composite Health Care System

CHDR Clinical Data Repository / Health Data Repository

(August 19, 2018)

CI Configuration Item

CIAR Counterintelligence and Reporting

CIO Chief Information Officer

CM Configuration Management

CMM Capability Maturity Model

CMMI Capability Maturity Model Integration

CMMP Capability Maturity Module Plan

CMR Contractor Manpower Reporting

CO Contracting Officer

COD-FC Contract Operations Division – Falls Church

CONUS Continental United States

COOP Contingency Operations Plan

COR Contracting Officer’s Representative

COTR Contracting Officer's Technical Representative

COTS Commercial Off-The-Shelf

CP Change Package

CPARS Contractor Performance Assessment Reporting System

CPFF Cost Plus Fixed Fee

CPOE Computer-based Provider Order Entry

CPR Contract Performance Report

CRC Cyclic Redundancy Check

CS Contract Specialist

CSC Computer Software Components

CSCI Computer Software Configuration Items

CTS Computer Training System

CV Cost Variance

CVE Common Vulnerabilities and Exposures

CWBS Contractor’s Work Breakdown Structure

D/SIDDOMS DoD/Systems Integration, Design, Development, Operations and Maintenance

Services

DA Days after

DACA Days after contract award (award of this order)

DAEOM Days after end of month

DBDD Database Design Description

DBMS Database Management Systems

DBSS Defense Blood Standard System

DCAA Defense Contract Audit Agency

DCR Document Change Request

DD254 Department of Defense Contract Security Requirement List

DEERS Defense Enrollment Eligibility Reporting System

DES Data Encryption Standard

DFARS Defense Federal Acquisition Regulation Supplement

DFAS Defense Finance and Accounting Service

DHA Defense Health Agency

DIACAP DoD Information Assurance Certification and Accreditation Process

DID Data Item Description

DII Defense Information Infrastructure

DII Data Innovations Inc.

DII COE Defense Information Infrastructure/Common Operation Environment

DISA DoD Information Systems Agency

DISR Defense Information Technology Standards Registry

DIT Development Integration Test

DITO DoD IPv6 Transition Office

DMDC Defense Manpower Data Center

(August 19, 2018)

DMDF DoD Data Master Drug File

DOA Date of Award

DoD Department of Defense

DoDAF Department of Defense Architecture Framework

SDRM Dynamic Object-Oriented Requirements System

DSA Digital Signature Algorithm

DSA Data Sharing Agreement

DSAA Data Sharing Agreement Application

DSM Diagnostic and Statistical Manual of Mental Disorders

DT&E Development, Test and Evaluation

DUA Data Use Agreement

DVBIC Defense and Veterans Brain Injury Center

E Electronic Copy

EA Enterprise Architecture

EAC Estimate At Completion

EBMS Enterprise Blood Management System

EBMS-T Enterprise Blood Management System-Donor

ECDSA Elliptic Curve Digital Signature Algorithm

ECP Engineering Change Package

EHR Electronic Health Record

EIT Electronic and Information Technology

EMSS Emergency Medical Services System eQIP electronic Questionnaires for Investigations Processing

ESB Enterprise Service Bus

EUD End User Device

EVM Earned Value Management

FAR Federal Acquisition Regulations

FAT Factory Acceptance Tests

FBI Federal Bureau of Investigation

FFP Firm Fixed Price

FHP Force Health Protection

FIPS Federal Information Processing Standard

FOIA Freedom of Information Act

FMP Family Member Prefix

FSO Facility Security Officer

FTC Federal Trade Commission

G&A General and Administrative

GFE Government Furnished Equipment

GFI Government Furnished Information

GIG Global Information Grid

GIS Generic Interface System

GOTS Government-Off-the-Shelf

GPO Government Printing Office

GSA U.S. General Services Administration

GUI Graphical User Interface

HAIMS Healthcare Artifact and Image Management System

HBSS Host-Based Security System

HCM Hardware Configuration Management

HHS Health and Human Services

HIPAA Health Insurance Portability and Accountability Act

HL7 Health Level 7

HW Hardware

HWCI Hardware Configuration Items

(August 19, 2018)

I&T Implementation & Training

IA Information Assurance

IAM Information Assurance Management

IAVA Information Assurance Vulnerability Alert

IAVM Information Assurance Vulnerability Management

ICCB Internal Configuration Control Board

ICD Interface Control Document

ID/IQ Indefinite Delivery/Indefinite Quality

IDD Interface Design Document

IDES Integrated Disability Evaluation System

IEEE Institute of Electrical and Electronics Engineers

IM Information Management

IM Instrument Manager

IMMP Integrated Master Management Plan

IMP Integrated Master Plan

IMS Integrated Master Schedule

IP Internet Protocol

IPPSRS Integrated Program Planning, Scheduling, and Reporting System

IPR In-progress Review

IPT Integrated Product/Process Team

IPv6 Internet Protocol version 6

IS Information System

ISSM Information System Security Manager

ISSO Information System Security Officer

IT Information Technology

ITP Incoming Transition Plan

JAC Joint Application Configuration

JDBC Java Database Connectivity

JMIS Joint Medical Information System

JPAS Joint Personnel Adjudication System

JTA Joint Technical Architecture

JTR Joint Travel Regulation

LCS Local Cache Server

LPO Local Processing Office

MAC Mission Assurance Category

M&H Material and Handling

MESOC MHS Enterprise Systems Operations Center

MHS Military Health System

MIS Management Information Systems

MPR Monthly Progress Report

MRRS Medical Readiness Reporting System

MTF Military Treatment Facility

NAC National Agency Check

NACLC National Agency Check with Local Agency Checks and Credit Check

NATO North Atlantic Treaty Organization

NCID Numerical Concept Identifiers

NCR National Capitol Region

NIST National Institute of Standards and Technology

NLT Not Later Than

NSA National Security Agency

OBX Observation/Result

OCI Organizational Conflict of Interest

OCONUS Outside the Continental United States

(August 19, 2018)

ODBC Open Database Connectivity

ODC Other Direct Costs

OMB Office of Management & Budget

OPM Office of Personnel Management

OPSEC Operations Security

OS Operating System

OSD Office of the Secretary of Defense

OT&E Operation Test and Evaluation

OVAL Open Vulnerability Assessment Language

P&R Personnel and Readiness

PASS Pharmacy Analytics Support Section

PDR Preliminary Design Review

PDS Pharmacy Data Standardization

PHI Protected Health Information

PIA Privacy Impact Assessment

PII Personally Identifiable Information

PIN Personal Identification Number

PIP Project Implementation Plan

PI/PO Phase In/Phase Out

PKE Public Key Encryption

PKI Public Key Infrastructure

PMO Program Management Office

POA&M Plan of Action and Milestones

POC Point of Contact

PPBE Planning, Programming, Budgeting and Execution

PPS Ports, Protocols, and Services

PR Production Review

PRS Performance Requirements Summary

PSB Personnel Security Branch

PSP Presidential Support Program

PWS Performance Work Statement

PWS Ref Performance Work Statement Reference (paragraph number)

QA Quality Assurance

QAP Quality Assurance Program

QASP Quality Assurance Surveillance Plan

QC Quality Control

QCP Quality Control Plan

RAV Requirement Analysis Verification

RBO Rule Based Optimizer

RCA Root Cause Analysis

RM Resource Management

RMF Risk Management Framework

RM&A Reliability, Maintainability, and Availability

ROI Return on Investment

RPO Recovery Point Objective

RSA Rivest, Shamir, & Adleman

RTM Requirements Traceability Matrix

RTO Recovery Time Objective

SAT System Acceptance Test

SAT Site Acceptance Test

SAM Script-based Active Monitor

SAN Storage Area Network

SBB Specialist in Blood Bank

(August 19, 2018)

SCA Static Code Analyzer

SCM Software Configuration Management

SCP Secure Copy

SDD Software Design Description

SDD Solution Delivery Division

SDS Same Day Surgery

SED Self-Encrypting Drives

SEI Software Engineering Institute

SF Standard Form

SFTP Secure File Transfer Protocol

SHA-1 Secure Hashing Algorithm 1

SHA-256 Secure Hashing Algorithm, 256-Bits

SHA-384 Secure Hashing Algorithm, 384-Bits

SHA-512 Secure Hashing Algorithm, 512-Bits

SIT Systems Integration Testing

SIPRNET Secret Internet Protocol Router Network

SME Subject Matter Expert

S/MIME Secure/Multipurpose Internet Mail Extensions

SMO Security Management Office

SMP Security Management Plan

SOA Service Oriented Architecture

SOFA Status of Forces Agreement

SOO Statement of Objectives

SOP Standard Operating Procedure

SOR Statement of Reason

SORN System of Record Notice

SOW Statement of Work

SPI Schedule Performance Index

SQL Structured Query Language

SQT System Qualification Testing

SRG Security Requirements Guide

SRS Software Requirements Specification

SSDD System/Subsystem Design Document

SSBI Single Scope Background Investigation

SSL Secure Socket Layer

SSO-CM Single Sign-On with Context Manager

SSR System Specification Review

STG System Test Group

STIG Security Technical Implementation Guide

STP System Testing Plan

STR System Testing…