EIRB Sustainment PWS.docx

DOCX document 2 MB Posted

Attached to
Electronic Institutional Review Board (EIRB) Services
Solicitation number
HT0011-25-RFI-0224
Issued by

About this file

This is a Performance Work Statement (PWS) for the Electronic Institutional Review Board (EIRB) Operations and Maintenance contract issued by the Defense Health Agency (DHA). The PWS outlines requirements for Cayuse (formerly iMedRIS) integrated Research Information Software enterprise licenses and associated maintenance services for EIRB, which manages lifecycle research review and oversight processes for DoD institutional review boards.

The contract includes a 12-month base period (September 3, 2025 - September 2, 2026) with four 12-month option periods and an optional 6-month extension. Key requirements include software license renewal for 18,500 users, operations and maintenance support, system updates, security compliance, functional/training support, and documentation. The contractor must maintain EIRB's availability 24/7/365 across development, test, and production environments while supporting nearly 18,500 users at 200 DoD research sites managing over 30,000 research projects. Critical services include Tier III help desk support, database administration, application maintenance, security management, configuration management, and risk management. The system must maintain compliance with DoD cybersecurity requirements and interface with multiple DoD systems through CAC authentication. The contractor will be required to work remotely using government furnished equipment to access the DISA-hosted environment.

View the file

Other files

File Type Posted
RFI EIRB 2-11-2025 MC_wo.docx DOCX document

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

ELECTRONIC INSTITUTIONAL REVIEW BOARD (EIRB)

OPERATIONS AND MAINTENANCE

Department of Defense Defense Health Agency Performance Work Statement Program Executive Office (PEO) Medical Systems Chief Information Officer (CIO) (J-6) Solution Delivery Division, Clinical Support Program Management Office Solicitation Number:

Version: 1.0 Date:

DHA PWS Template V13 November 16, 2021

DHA PWS Template V13 November 16, 2021 Table of Contents

Part 1 - General Information4
1.1Description of services/introduction4
1.2Background4
1.3Objectives6
1.4Scope6
1.5Period of Performance (PoP)7
1.6Administrative specifications9
1.7Contractor Travel10
1.8Other Direct Costs (ODC)11
1.9Quality11
1.10Contractor Personnel12
1.11Key Personnel (Contractor)13
1.12Data Rights14
1.13Reporting14
1.14Contractor Identification15
1.15Contractor Access to Health Affairs (HA) / DHA Network(s)15
1.16Personnel Security16
1.17Section 508 Compliance16
Part 2 - Definitions, Acronyms, and Applicable Publications/Instructions17
2.1Definitions17
2.2Acronyms17
2.3Applicable Publications, DHA Administrative Instructions (AI), etc24
Part 3 - Government Furnished Property, Equipment, and Services25
3.1Services25
3.2Facilities25
3.3Utilities25
3.4Equipment25
3.5Materials26
Part 4 - Contractor Furnished Items and Services27
4.1Services27
4.2General27
4.3Secret Facility Clearance27
4.4Materials27
4.5Equipment27
4.6Facilities27
Part 5 - Specific Tasks28
5.1EIRB Software License Renewal28
5.2Task Management28
5.3EIRB Operations and Maintenance Technical Management31
Part 6 - Information Technology & Security46
6.1Unclassified46
6.2Position Sensitivity Designation46
6.3Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal Information Requirements46
6.4Training46
6.5Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS47
6.6Risk Management Framework (RMF) for DoD IT47
6.7Facility Related Control Systems (FRCS)49
6.8System Communications49
6.9MHS Demilitarized Zone (DMZ) Medical Community of Interest (MedCOI) Business-to-Business (B2B) Gateway49
6.10Contractor Provided IT Infrastructure49
6.11System Access, Defense Department (DD) Form 287550
6.12MHS Systems Telecommunications51
6.13Establishment of Telecommunications51
6.14Reserved52
Part 7 - Attachments / Technical Exhibit Listing53
7.1Forms53
Performance Requirements Summary – Attachment 154
Other Attachments56
7.2Attachments56
7.3Technical Exhibits56

Part 1 - General Information This is a non-personal services contract to provide software maintenance and sustainment services for the Electronic Institutional Review Board (EIRB) information technology solution.

Description of services/introduction The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform operations and maintenance services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this PWS.

Background The Defense Health Agency (DHA) is a joint, integrated Combat Support Agency that enables the Army, Navy, and Air Force medical services to provide a medically ready force and ready medical force to Combatant Commands in both peacetime and wartime. The DHA supports the delivery of integrated, affordable, and high-quality health services to Military Health System (MHS) beneficiaries and is responsible for driving greater integration of clinical and business processes across the MHS.

There are eight (8) directorates within DHA:

Defense Health Agency Strategy | Health.mil Administration and Management (J-1) Operations (J-3) Component Acquisition (J-4) Strategy, Plans and Functional Integration (J-5) PEO Medical Systems / CIO (J-6) Education and Training (J-7) Research and Development (J-9) TRICARE Health Plan (J-10) The mission of DHA PEO Medical Systems / CIO (J-6) Directorate, within which Solution Delivery Division (SDD) resides, is to implement, manage, and sustain an integrated and protected medical information enterprise to ensure the right information is accessible to the right DHA customers at the right time and in the right way.

EIRB Background DHA PEO Medical Systems/ CIO(J-6), SDD, will provide programmatic management and technical support for the EIRB, the DoD approved enterprise system for managing the lifecycle research review and oversight processes for DoD Institutional Review Board (IRBs) for Human Subjects biomedical and social/behavioral research, Institutional Animal Care and Use Committee (IACUCs), Institutional Biosafety Committee (IBCs), Radiation Safety, Cooperative Research and Development Agreement (CRADA)/Grants, Scientific Review and Publication Clearance, as well as unique DoD review needs (e.g., FHP&R Program Manager Network, etc.).

EIRB automates these processes, allowing the Government to streamline document submission and review, decrease paper waste, reduce time spent routing work and/or locating misplaced work, and minimize administrative overhead thus allowing staff to focus on complex issues and support to the DoD research innovation community. EIRB gathers data to support enterprise level strategic decisions regarding regulatory system performance, resource utilization, and research portfolio management across the DoD. The system facilitates collaboration and data sharing amongst Researchers and Administrators via a secured web environment.

EIRB serves nearly 18,500 users across 200 DoD research sites and compliance boards, and hosts over 700,000 electronic documents in support of more than 30,000 research projects. EIRB is accessible to users via Common Access Card (CAC) as well as Veteran Affairs Personal Identity Verification (PIV) and External Certificate Authority (ECA).

The EIRB system allows the researcher, oversight support offices at various interacting regulatory levels, IRBs, and other research/non research related committees to:

Streamline document submission and review processes.

Reduce paper use, i.e., distribution packets and mailings.

Reduce time wasted routing work or locating misplaced paperwork.

Reduce administrative tasks to allow staff to focus on complex issues and support the innovation community.

Facilitate clear, coordinated communications and track correspondence.

Enable registered system users, Researchers and Administrators to collaborate and access/share data seamlessly and securely in real time, anytime, anywhere.

Manage research and related meetings and committees, and meeting materials and minutes availability.

Increase process transparency.

Increase data security.

Maintain a clear audit trail (with appropriate documentation and versioning) of review and oversight processes, including capture of associated electronic signatures.

Improve the quality of documentation and study design.

Improve ability to measure processes – i.e., system produced metrics.

Produce metrics reports.

Enable multi-center innovation work.

Facilitate ability to implement and enforce consistent innovation experience across the DoD research community.

Facilitate ability to implement and enforce standardization of business processes and practices across the DoD research community.

Facilitate improved coordination of submission, review, management, and oversight of multi-site studies capabilities.

The government hosting site for EIRB is Defense Information Systems Agency (DISA) Capacity Services environment.

Objectives The Government expects to establish a relationship with a Contractor who will provide flexible, responsive, measurable, and supportive services to the PEO MS/J-6 and to Contractors who are tasked with developing, deploying, and maintaining useful and responsive applications to the user community. The focus of the resulting contract is to provide high quality application administration and operation activities for PEO MS/J-6 for the EIRB product.

Scope This award provides for purchase Cayuse (formerly iMedRIS) integrated Research Information Software (iRIS) enterprise software licenses with the developer supported license agreement and the required platform and software maintenance and sustainment services for the Electronic Institutional Review Board (EIRB) information technology solution. This includes, operations and maintenance support for EIRB and all other system COTS software components (e.g., operating system, database, etc.), continued software maintenance releases, operating system upgrades, software upgrades, database upgrades, Cayuse COTS upgrades, testing, ongoing compliance with DoD Instruction (DoDI) 8500.01, “Cybersecurity, March 2014” and DoDI 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT), March 2014” requirements, functional and training support, creation of system and security documentation, and other associated services as directed by the Government.

The Contractor shall work in collaboration with other Contractors who may be tasked with application development by PEO/MS/J-6. The Contractor shall also provide technical/analytical support for acquisition of hardware and software to support EIRB.

The Contractor shall provide application modifications (code changes, minor functionality development, etc.) for EIRB, databases, and common components identified in this award. The Contractor shall provide support for testing, production pre-insertion testing, transition to production, management and documentation, security maintenance, information assurance and security activities and support Defense Information Assurance Certification and Risk Management Framework (RMF) Accreditation Process of the SDD applications specifically set forth in this order.

The Contractor shall sustain all the Production (Prod), Production Test, Demonstration and Training, Development (Dev) and Development Test (Dev/test) Environments; to include operating system patches, database patches, IAVA patches, patching, backup & recovery of code. All patches are to be tested and test results shall be submitted. The Contractor shall perform all required security scans, mitigations, and associated documentation for Information Assurance Activities.

Specific business rules are embedded in the commercial product suite of the Cayuse (formerly iMedRIS) products now known as EIRB. Due to the proprietary nature of the Cayuse suite of products, the Contractor should have knowledge of the EIRB application and data load interface.

The EIRB maintenance support shall include but be not limited to:

Tier III help desk and triage support, Systems analysis, Database and code administration, Database upgrade and maintenance, Application/code installation, Application upgrade and maintenance, System administration, Change control and testing, Documentation, Security maintenance and all security activities Trouble-shooting and problem resolution support including root cause analysis, Configuration management Period of Performance (PoP) Table 1: Period of Performance

Duration
Date Range
Base Period (12 months):
03 September 2025 – 02 September 2026
Option Period 1 (12 months):
03 September 2026 – 02 September 2027
Option Period 2 (12 months):
03 September 2027 – 02 September 2028
Option Period 3 (12 months):
03 September 2028 – 02 September 2029
Option Period 4 (12 months):
03 September 2029 – 02 September 2030
Option to Extend Services (6 months, Optional):
03 September 2030 – 02 March 2031

Transition: Transition-in/transition-out period Transition-in period The period between the award date and full performance start date constitutes the transition in period. Full performance start date is defined as 30 calendar days after contract start. During the transition-in period, the contractor shall prepare to meet all contract requirements and ensure incoming personnel are functionally trained and qualified on the full performance start date. The Government will make all facilities, equipment, and materials accessible to the contractor during the transition-in period. The Contractor shall provide a Transition-In Plan (Deliverable 2), due in accordance with (IAW) the Deliverables Schedule, Section 7.0. The Contractor shall coordinate with the Government in planning and updating the plan to ensure a complete transition to the Contractor's support model. The Government will designate a transition period for the incoming Contractor to coordinate and work with the incumbent Contractor. This Transition-In Plan shall include, but is not limited to:

a) Coordination with Government representatives,

b) Review the evaluation and transition of current support services,

c) Transition of historic data to new Contractor or Government system,

d) Government-approved training and certification process,

e) Transfer of hardware warranties and software licenses,

f) Transfer of all System/Tool documentation to include system administration manuals, training materials, disaster recovery manual, requirements traceability matrix, configuration control documents and all other documents required to operate, maintain, and administer systems and tools,

g) Transfer of Government owned source code, to include all versions, maintenance updates and patches,

h) Orientation phase and program to introduce Government personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes,

i) Distribution of Contractor purchased Government owned assets, including facilities, equipment, furniture, phone lines, computer equipment, etc.,

j) Transfer of Government Furnished Equipment (GFE) and Government Furnished Information (GFI), and

k) GFE inventory management assistance,

l) Coordinate with the Government to account for Government keys, ID/access cards, and security codes.

Optional Transition-out period The period of time 30 calendar days prior to the end of the award date. Transition-out performance is defined as the Period of Performance (PoP) where the incumbent contractor will orient the successor to project status, including all standard procedures/processes and functional design capabilities. This period will run concurrently with the final days of the PoP. The Contractor shall provide a Transition-Out Plan (Deliverable 2), due in IAW the Deliverables Schedule, Section 7.0. This transition may be to a Government entity, another Contractor or to the incumbent Contractor under a new contract/order. In accordance with the Government-approved plan, the Contractor shall assist the Government in planning and implementing a complete transition from this Contract and/or orders issued under this Contract to a successor provider. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of copies of existing policies and procedures, and delivery of metrics and statistics. This Transition-Out Plan shall include, but is not limited to:

a) Coordination with Government representatives,

b) Review the evaluation and transition of current support services,

c) Transition of historic data to new Contractor system,

d) Government-approved training and certification process,

e) Transfer of hardware warranties and software licenses,

f) Transfer of all necessary business and/or technical documentation,

g) Transfer of Government owned source code, to include all versions, maintenance updates and patches,

h) Orientation phase and program to introduce personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes,

i) Disposition of Contractor purchased Government owned assets, including facilities, equipment, furniture, phone lines, computer equipment, etc.,

j) Transfer of Government Furnished Equipment (GFE) and Government Furnished Information (GFI), and GFE inventory management assistance,

k) Turn-in of all Government keys, ID/access cards, and security codes.

Administrative specifications Place of Performance To successfully fulfill the requirements of this contract, the Contractor and the Government must work as an integrated team. Due to facility constraints on available Government space, the work to be performed under this contract will be conducted remotely at Contractor facilities by access into the EIRB hosting environment via virtual private network (VPN) using GFE. The EIRB shall be hosted within a government controlled secure virtualized hosting environment (e.g., DHA Enterprise Infrastructure, DISA, FedRAMP Compliant Cloud, etc.). The Contractor may require access to the DHA Network/DoD Systems to perform work under this task.

Contractor personnel are authorized to support this contract remotely through the Contractor's facility or in a telework capacity. In the event of a state of emergency or public shutdown, the Contractor personnel shall reference Section 5.2.7 below and continue normal operations to support this contract through any and all measures that can be safely employed, to include teleworking.

Recognized Federal Holidays Table 2: Recognized Federal Holidays Holidays

New Year’s Day
Labor Day
Martin Luther King Jr.’s Birthday
Columbus Day
President’s Day
Veteran’s Day
Memorial Day
Thanksgiving Day
Juneteenth Day
Christmas Day

Independence Day

Hours of Operation The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

Emergency Services On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours. Contractor shall be required to provide emergency, on-call support when users are prevented from accessing EIRB.

Contractor Travel Contractor shall be authorized travel expenses consistent with the cost principles and procedures in Federal Acquisition Regulation (FAR) Part 31.2, Travel Costs and the limitations of funds specified in this contract. All travel requires Government approval/authorization and notification to the Contracting Officer Representative (COR).

Base Period:

FROM
TO
Round Trip (Y/N)
# Trips / Days Each Trip
# Staff
Contractor Location
Falls Church, VA
Y
2 / 4
2

Option Period 1:

FROM
TO
Round Trip (Y/N)
# Trips / Days Each Trip
# Staff
Contractor Location
Falls Church, VA
Y
2 / 4
2

Option Period 2:

FROM
TO
Round Trip (Y/N)
# Trips / Days Each Trip
# Staff
Contractor Location
Falls Church, VA
Y
2 / 4
2

Option Period 3:

FROM
TO
Round Trip (Y/N)
# Trips / Days Each Trip
# Staff
Contractor Location
Falls Church, VA
Y
2 / 4
2

Option Period 4:

FROM
TO
Round Trip (Y/N)
# Trips / Days Each Trip
# Staff
Contractor Location
Falls Church, VA
Y
2 / 4
2

Other Direct Costs (ODC) The Contractor may be required to use ODCs for travel in support any activities related to the EIRB that cannot be resolved remotely including, reproduction, and shipping expenses associated with equipment and training activities and visits to military treatment facilities (MTF)/institutions.

Table 3: Miscellaneous ODCs Description

Miscellaneous costs including but not limited to shipping costs, incidentals for reproducible materials, training, rental of laptops, etc.)

Quality Quality Control (QC) The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is the means by which the work complies with stated requirements.

The Contractor shall prepare and adhere to a Quality Control Plan (QCP) (Deliverable 1). A draft QCP shall be delivered with Contractor’s proposal and shall be updated following contract award. The QCP shall document how the Contractor will meet and comply with the quality standards established in this PWS. At a minimum, the QCP must include a self-inspection plan, an internal staffing plan, and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, customer satisfaction, and any other requirements set forth in this solicitation. The QCP should:

Reflect and demonstrate a collaborative approach between the QCP and successful accomplishment of all QASP metrics.

Identify processes, procedures, and metrics which are likely to result in successful outcome within the time allotted and on schedule.

Provide for crosschecks of quality regarding the clarity, accuracy, validity, and consistency of each deliverable. All deliverables submitted to the government should be submitted in a final state.

Describes the quality control approach to include processes, procedures, metrics, and reporting the metrics.

After acceptance of the Quality Control Plan (QCP) the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. See Part 7, Technical Exhibit 1.

Quality Assurance (QA) The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

Contractor Personnel CAC Requirements For all contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD contractor personnel.

CAC Return The contractor shall return all CACs to the Contracting Officer Representative (COR) upon the departure of the contractor(s).

Contractor Onboarding and Training The contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

Onboarding Checklist The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx Contractor Training The DHA’s contractor training instructions embedded at Part 7 Section 7.1.2. (Government (DHA) requirements development staff must cut/paste onboarding checklist at https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf and embed most up-to-date form in Part 7, Section 7.1.2.)

Onboarding Requirements The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at: https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

New Employee Handbook The DHA’s new employee handbook at Part 7 Section 7.1.3 Physical Security The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government equipment, and materials shall be secured.

Reserved Key Personnel (Contractor) The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the CO. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 4:30 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below:

Program Manager – The Program Manager must have 10 -15 years’ experience managing complex Information Technology projects similar to the EIRB system; high level of experience with personnel, financial, quality and risk management domains. Project Management Professional (PMP) certification is desirable but not required.

EIRB COTS Subject Matter Expert – EIRB COTS SME must have a high degree of expertise with the Cayuse (formerly iMedRIS Data Corporation) iRIS COTS products to support the configuration and implementation of product upgrades, CITI interface, etc.

Key personnel are full-time staff and shall be available during standard east coast business hours. Substitutions of proposed Key Personnel shall not be allowed for a period of six (6) months after award, except under extreme circumstances. Any substitution or replacement Key Personnel should have qualification equal to or greater than the individuals proposed. For temporary and/or permanent replacement of Key Personnel, the Contractor shall provide a resume for each individual to the Contracting Officer (CO). Resumes should be provided at least two weeks (or as mutually agreed upon) prior to making any personnel changes. The Government reserves the right to pre-approve any replacement or substitution of Key Personnel.

Data Rights The Government has unlimited rights to all documents/material produced under this contract in accordance with DFARS 227.4, DFARS 227.7100 and DFAR 227.7200. All documents and materials, to include the source code of any software produced exclusively for the Government under this contract, shall be Government owned and shall be the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer (CO). All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Reporting Contractor Manpower Reporting (CMR)

RESERVED

Non-Disclosure Agreement (NDA) All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA (DHA NDA Form 49) prior to beginning work on the subject contract (Deliverable 3). The contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the Contracting Officer Representative (COR).

Government’s COR The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

Post Award Conference / Periodic Progress Meetings The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

Contractor Identification Contractor Identification Information Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

Meeting Attendance Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

Military Rank Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

Contractor Access to Health Affairs (HA) / DHA Network(s) Facilities Security Officer (FSO) Facilities Security Officer (FSO)/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system. Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

Personnel Security Office Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

Personnel Security Compliance The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

Security Clearance Guidelines Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

Controlled Unclassified Information (CUI) Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

Automated Information System (AIS) Access DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

Section 508 Compliance The Contractor shall comply with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d). Specifically, the procurement, development, maintenance, or integration of electronic and information technology (EIT) under this contract must comply with the applicable accessibility standards issued by the Architectural and Transportation Barriers Compliance Board at Code of Federal Regulations (CFR) part 1194.

Part 2 - Definitions, Acronyms, and Applicable Publications/Instructions

1.

Definitions Category D Information Technology (IT) and Telecommunications Services (called D-Services) Category R Support (Professional/Administrative/Management) Services (called R-Services) Contracting Officer (CO) A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

Contracting Officer’s Representative (COR) An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

Nonpersonal Services Contract A contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

Quality Assurance Surveillance Plan (QASP) An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

Insert additional Definitions here.

If applicable, if not applicable delete item.)

Acronyms Table 4: Acronyms

Acronym
Meaning
ADHCA
Assistant Director for Health Care Administration
ADM
Acquisition Decision Memorandum
AIS
Automated Information System
AM
Acquisition Manager
API
Application Program Interfaces
APL
Approved Products List
AQL
Acceptable Quality Level
ARRT
Acquisition Requirements Roadmap Tool
ASI
Authorized Service Interruption
ATO
Authority to Operate
ATO-C
Authority to Operate with Conditions
B2B
Business-2-Business
CAP
Contractor-Acquired-Government Owned Property
CDRL
Contract Data Requirements List
CFR
Code of Federal Regulations
CIO
Chief Information Officer
CJCSM
Chairman of the Joint Chiefs of Staff Manual
CM
Configuration Management
CMCP
Configuration Management Compliance Plan
CMR
Contractor Manpower
CNSSI
Committee on National Security Systems Instruction
CO
Contracting Officer
CONUS
Continental United States (excludes Alaska and Hawaii)
COR
Contracting Officer’s Representative
COTR
Contracting Officer's Technical Representative
COTS
Commercial Off-The-Shelf
CPARS
Contract Performance Assessment Reporting System
CS
Clinical Support
CS
Contract Specialist
CS
Cyber Security
CSP
Capability Support Plans
CTO
Chief Technology Officer
CUI
Controlled Unclassified Information
CWBS
Contractor Work Breakdown Structure
DA
Days after
DACA
Days after contract award (award of this order)
DAD-A
Assistant Director for Acquisition
DAD IO/J-6
Deputy Assistant Director, Information Operations (DAD IO/J-6) (See PEO MS/CIO J-6)
DAEOM
Days after end of month
DAWIA
Defense Acquisition Workforce Improvement Act
Days
Calendar days, unless otherwise specified
DB
Days before
DBITC
Defense Business Information Technology Certification
DBS
defense business system
DD 254
Department of Defense Contract Security Classification Specification
DFARS
Defense Federal Acquisition Regulation Supplement
DHA
Defense Health Agency
DHHQ
Defense Health Headquarters
DISA
Defense Information Systems Agency
DITPR
Defense IT Portfolio Registry
DMZ
Demilitarized Zone
DoD
Department of Defense
DPCLO
DHA Privacy and Civil Liberties Office
DSA
Data Sharing Agreement
DT&E
Developmental Test and Evaluation
DUA
Data Use Agreement
EIRB
Electronic Institutional Review Board
EIT
Electronic and Information Technology
EXSUM
Executive Summary
FAR
Federal Acquisition Regulation
FedRAMP
Federal Risk Authorization and Management Program
FISMA
Federal Information Security Modernization Act
FRCS
Facility Related Control Systems
FSO
Facility Security Officer
FTE
Full Time Equivalent
GFE
Government Furnished Equipment
GFI
Government Furnished Information
GFP
Government Furnished Property
GSA
U.S. General Services Administration
HIPAA
Health Insurance Portability and Accountability Act
IA
Information Assurance
IAM
Information Assurance Manager
iAS
Identity Authentication Services
IAVM
IA Vulnerability Management
IAW
In Accordance With
IMP
Integrated Master Plan
IMS
Integrated Master Schedule
IPT
Integrated Product/Process Team
IS
Information Systems
IT
Information Technology
IV&V
Independent Verification & Validation
JITC
Joint Interoperability Test Command
JKO
Joint Knowledge Online
MHS
Military Health System
MOA
Memorandum of Agreement
MOU
Memorandum of Understanding
MPR
Monthly Progress Report
MTF
Medical Treatment Facilities
NCA
National Capital Area
NCR
National Capital Region
NDA
Non-Disclosure Agreement
NIST
National Institute of Standards and Technology
NLT
Not Later Than
NMO
Navy Medicine Online
NPV
Net Present Value
OCONUS
Outside Continental United States (includes Alaska and Hawaii)
ODC
Other Direct Costs
OEP
Organizational Execution Plan
OMB
Office of Management and Budget
OOC
out-of-cycle
OPM
Office of Personnel Management
ORD
Operational Requirements Document
OSD
Office of the Secretary of Defense
OTM
Office of Transition Management
OV
Operational Views
PCLO
Privacy and Civil Liberties Office
PEO MS/CIO J6
Program Executive Office Medical Systems/ Chief Information Officer J6 (Previously DAD IO/J-6)
PHI
Protected Health Information
PIEE
Procurement Integrated Enterprise
PII
Personally Identifiable Information
PK
Public Key
PKI
Public Key Infrastructure
DODAF
DOD Architecture Framework
PM
Program Managers
PMBOK
Project Management Body of Knowledge
PMO
Program Management Office
PMP
Program Management Plan
POA&M
Plan of Action and Milestones
POC
Point of Contact
POM
Program Objective Memorandum
PoP
Period of Performance
POR
Program of Record
PSB
Program Support Branch
PSO
Personnel Security Office
PSoW
Performance Statement of Work
PWS
Performance Work Statement
QA
Quality Assurance
QASP
Quality Assurance Surveillance Plan
QC
Quality Control
QCP
Quality Control Plan
QMS
Quality Management System
RA
Risk Assessment
R&A
Review & Analysis
RAV
Requirements Analysis Verification
RFP
Request for Proposal
RFQ
Request for Quotation
RIO
Risk, Issue, Opportunity
RM
Resource Management
RMED
Risk Management Executive Division
RMF
Risk Management Framework
ROMs
Rough Order of Magnitude
RTM
Requirements Traceability Matrix
SAAR
System Authorization Access Request
SDD
Solution Delivery Division
SIT
System Integration Test
SLA
Service Level Agreement
SME
Subject Matter Expert
SOPs
Standard Operating Procedures
SRG
Security Requirements Guides
SRR
Software Requirements Reviews
STIGs
Security Technical Implementation Guides
SVs
System Views
SW
Software
TR
Technical Reviews
TRR
Test Readiness Review
TSB
Technical Support Branch
TVs
Technical Views
UFR
Unfunded Requirement
VA
Veterans Affairs
VPN
Virtual Private Network
WBS
Work Breakdown Structure

Applicable Publications, DHA Administrative Instructions (AI), etc.

(Add all Government publication references here; Example: 2.4.1 DHA-IPM 18-016, Medical Coding of the DoD Health Records.)

Part 3 - Government Furnished Property, Equipment, and Services The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

2.

Services The Government will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

Facilities The Government will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

Utilities The Government will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

Equipment The Government WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below:

The Government will provide computer equipment laptops for use in performance under this contract/task order. This equipment is authorized for transaction of official Government business only and shall not be used for personal business. Computer equipment to include laptops are always subject to communications security monitoring. The Contractor shall maintain a detailed inventory accounting system for Government Furnished Equipment/Material or Contractor-Acquired-Government Owned Property (CAP).

Procurement Integrated Enterprise (PIEE), GFP Module Application The contractor shall be responsible for obtaining and maintaining access, training, and successful operation of the PIEE/ Government Furnished Property (GFP) Module application for the entirety of the contract/task order PoP. The PIEE GFP Module application is located at the following website: https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the contractor’s responsibilities regarding GFP can be found at the following website: https://dodprocurementtoolbox.com/.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The CO and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded through DHA, in accordance with applicable FAR Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA AI 095 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the Contracting Office and requested within the PIEE/GFP Module system.

Contractor Responsibilities:

A key contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete, and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

The contractor shall report semi-annually 100% inventories, reconciliations, and final disposition of GFP provided by the government. Final invoices will not be paid pending GFP reconciliation. Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245 and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA Administrative Instruction 094 and DHA Guidance. The contractor shall include their GFP inventory as part of their (Deliverable 6: Monthly Progress Report).

Materials The Government will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

Part 4 - Contractor Furnished Items and Services

3.

Services The Contractor will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

General Except for identified Government Furnished Equipment (GFE), the contractor shall furnish all supplies, equipment, facilities, and services required to perform work listed under Section 5 of this PWS.

Secret Facility Clearance Not applicable for this task.

Materials Not applicable for this task Equipment Not applicable for this task Facilities The contractor shall provide all facilities required to support staff assigned to this contract including internet connectivity, office space, furniture, personnel support, etc. All work for this PWS shall be performed using GFE.

Part 5 - Specific Tasks

4.

EIRB Software License Renewal Cayuse (formerly iMedRIS Data Corporation) iRIS management software enterprise license renewal with license agreement with associated software key to maintain current software version. The license agreement covers the COTS Application License Usage and Maintenance for 18,500 Users (Deliverable 4). The Cayuse suite of products that comprises EIRB includes:

Institutional Review Board (IRB) Assistant Institutional Animal Care and Use Committee (IACUC) Assistant Institutional Biosafety Committee (IBC) Assistant Scientific Review Assistant Radiation Safety Assistant Flexboard Assistant for Publication Clearance CITI Interface Task Management The Contractor shall provide sufficient management to ensure that this task is performed efficiently, accurately, on time, and in compliance with the requirements of this document. Specifically, the Contractor shall designate a single manager to oversee this task and supervise staff assigned to this task. The Contractor shall ensure that a Monthly Progress Report is submitted outlining the expenditures, billings, progress, status, and any problems/issues encountered in the performance of this task. The Contractor shall provide the Government with meeting minutes for all meetings related to the performance of this contract, as requested by the Government.

Monthly Progress Report (MPR) – Deliverables 6, 8, 31 The Contractor shall ensure that a Monthly Progress Report (MPR) (Deliverable 6) is submitted outlining the expenditures, billings, technical progress, status, any problems/ issues encountered in the performance of this task, and any perceived risks to the Contractor that might prevent performance of tasks, lessons learned, and fulfillment of requirements included in this PWS.

The Contractor shall include an updated Government Furnished Equipment (GFE) Inventory Report (Deliverable 31) in each MPR that includes the location of all equipment included in the inventory.

The Contractor shall require all subContractors to provide input to the MPR where there are critical or significant tasks related to the prime contract. Critical or significant tasks shall be defined by mutual agreement between the Government and Contractor.

The Contractor shall include a Subcontract Expenditures Report (Deliverable 8) in the MPR that discloses actual subcontract expenditures by company name, business size standard (i.e. Woman Owned Business, Veteran Owned Business, etc.), and other socioeconomic programs (i.e. Indian Incentive Program, Historically Black Colleges and Universities and Minority Institutions, etc.).

Program Management Plan (PMP) – Deliverables 5, 9 The Contractor shall create a PMP (Deliverable 5). A draft PMP shall be delivered with Contractor’s proposal and shall be updated following contract award. Following Government approval of the plan, it shall be applied by the Contractor to manage, track, and evaluate the project or task performance. The PMP shall consist of control policies and procedures in accordance with standard industry practices for project administration, execution, and tracking. The PMP shall include the following:

Identification of milestones where Government information, activity, equipment, material, facilities, etc. is required and timeline dependencies for subsequent Contractor activities.

An Integrated Master Plan (IMP) – Details an event-based technical approach to executing the program, as defined in the contract, and identifies key program events, significant accomplishments, and associated completion criteria.

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .