Attachment_1_Minimum_Requirements_Specifications.pdf

MINIMUM REQUIREMENTS SPECIFICATIONS

RADIO FREQUENCY IDENTIFICATION (RFID) – ASSET TRACKING AND

MANAGEMENT SOLUTION

1. Introduction/Objective:

Nellis Air Force Base, 99th Medical Group, is seeking to acquire a Radio Frequency Identification (RFID) based asset tracking system to supplement Defense Medical Logistics Standard Support (DMLSS) system, the primary support system for all military logistics functions associated with Medical Treatment Facilities (MTF) worldwide. The need for this system is to increase the ability to identify, locate and track assets through facilities; ensuring timely scheduled preventive maintenance, accurate inventory capture, and efficient allocation of assets for patient care/training/etc.

2. Scope of Work:

a. The selected Contractor shall provide an integrated asset tracking solution (all hardware, software, licenses, asset tags, installation, configuration, training, testing and maintenance of system) which incorporates passive RFID (pRFID) and barcode tracking capability.

b. Although RFID technology lends itself to many use cases, this effort is for asset tracking within the MTFs; assets include medical, IT and facility equipment. Other use cases for RFID are outside the scope of this effort.

c. This work will be conducted at Nellis Air Force Base’s 99th Medical Group, which consists of the following buildings/clinics, all of which are on the same Wireless Network:

(Buildings 60, 340, 1033, 1300, 1301, 1302, 1303. The approximate sq. footages are 5,000, 75,144, 7,034, 360,604, 34,143, 3077, and 916 respectively.

d. The total number of assets that require tags is 5,000.

3. DELIVERY SCHEDULE:

a. The contractor shall deliver and provide training on all equipment within 60 days of contract award.

4. GENERAL SYSTEM REQUIREMENTS:

a. The system shall:

i. Be locally hosted and client/server-based

ii. Provide administrators with a thick client and web-based interface

iii. Have local and remote administration and management

iv. Be capable of leveraging a virtual infrastructure. If this is not a current ability, provide a plan of action and milestones (POAM) to show how and when the proposed system can leverage a virtual infrastructure

v. Leverage the MTFs Local Area Network (LAN) for server and application administration

vi. Primarily leverage the MTFs WLAN for active asset tracking communication

4.a.vi.1. MTFs WLAN operates on WLAN 802.11n and later specification 4.a.vi.2. MTFs WLAN consists of Aruba.

4.a.vi.3. RFID services will only operate on channels 1,6, 11 or a subset of those channels 4.a.vi.4. Supplemental RFID technologies (Infrared, Ultrasound, etc) for active tracking will not be leveraged for this effort.

vii. Use ports and protocols deemed approved for use on DoD networks. Refer to www.disa.mil for approved ports and protocols.

viii. Be IPV6 capable

ix. Be Public Key (PKI) enabled and Client Access Card (CAC) enforced

5. GENERAL SYSTEM CAPABILITIES:

a. The system shall:

i. Be able to track and manage up to 25,000 assets per MTF (including its outlying buildings and remote sites)

ii. Have alert options that display and/or send alerts

iii. Track passive tags and have the ability to integrate Defense Medical

Logistics Management System (DMLSS) and AIMS (Asset Information Management System) (and/or other) records.

b. Be capable of providing zone tracking, such as when tags pass a system-defined boundary or through an ingress/egress point

i. Have multiple alert options if a tag passes through these areas

c. Provide variable levels of resolution based on the intended function of an area.

i. Provide room-level accuracy for active tracking with resolution within a

10-foot radius

6. FUTURE SYSTEM CAPABILITIES.

a. Be capable of the following for possible future implementations:

i. Provide additional asset intelligence such as asset operational status, in use/not in use etc. that supports the effective utilization of assets

ii. The system must be capable of supporting sterilizable tags

iii. Provide Active Wi-Fi Tracking.

7. SOFTWARE:

a. The software shall:

i. Provide users with a full featured web-based interface

ii. Support approximately 20 concurrent users per MTF

iii. Allow for equipment location queries, searches, displays and custom or automated reports

iv. Support the creation of custom reports that include but are not limited to

HTML, Excel and Adobe PDF formats

v. Provide an assets location, at a minimum, by equipment nomenclature or device class, serial number, Equipment Control Number (ECN), floor, or room

vi. Filter information, at a minimum, by building, department, floor, and room

vii. Show last known location and historical location data for at least a 12-month period, for any given tagged asset

viii. Be capable of a bi-directional interface with DMLSS and AIMS http://www.disa.mil/

ix. Support role-based administration and asset management that allows for various levels of software access, including at a minimum read-only, edit and full administrator access

8. TAGS (QTY: 5,000):

a. Shall have options for permanent and temporary mounting of tags

i. Tags permanently mounted shall not be able to be easily removed

b. Shall be able to be cleaned via typical equipment infection control methods (i.e.

wiped down with disinfectant)

c. Shall be able to be mounted on multiple types of materials, including but not limited to plastics and metals

i. Examples of medical equipment to be tagged include but are not limited to:

infusion pumps, electrocardiographs, ventilators, mobile radiographic units, beds, and wheelchairs

d. Passive tags:

i. There shall be at least one type of tag that is no larger than 1 inch x 3 inches (length by width)

ii. Shall have a minimum read range of 6 feet from Fixed RFID readers

9. HANDHELD READER (QTY: 4):

a. Shall have scanning capability for passive RFID and barcode

b. Shall have a docking capability to upload data into system

c. Shall have a DoD approved OS if applicable

10. IMPLEMENTATION:

a. The Contractor shall have the capability to conduct a Wi-Fi heat map assessment at each MTF prior to implementation.

b. Miscellaneous implementation

i. The Contractor shall import all provided DMLSS and AIMS records into the system to create the original database. Additional sources for records may also be provided in Excel format.

ii. The Contractor shall import all provided floor plans into the system database

iii. The Contractor shall work with MTF staff for server installation and network implementation

iv. MTF hours of operation: Normal MTF hours of operation are Monday through Friday, excluding Federal holidays. Contractor access and work hours shall be coordinated with each specific MTF

c. System acceptance testing

i. The Contractor shall conduct system acceptance testing and provide test result documentation to the government

11. TRAINING:

a. The Contractor shall provide initial on-site classroom-based training, to include all necessary student training materials, on the installed RFID system prior to system acceptance. The training must cover all User levels (General to Administrative)

b. The Contractor shall document the type of training and attendees names and provide to the government upon completion of each training class

12. SUPPORT REQUIREMENTS:

a. The Contractor shall provide 5 days of support immediately following delivery of the equipment to help the facility determine how they will tag their own assets.

b. The Contractor shall provide at least a one-year warranty on all Contractor provided system components

c. The Contractor shall be capable of providing technical phone support for each of the MTFs at least during normal duty hours, 8:00AM to 5:00PM, Monday through Friday, excluding Federal recognized holidays.

d. The Contractor shall provide at a copy (CD) of relevant user manuals for all hardware and software components, regardless of original equipment manufacturer (OEM)

e. The Contractor shall provide updated documentation for all system components throughout the lifecycle of the system

13. INFORMATION ASSURANCE (IA) REQUIREMENTS:

a. All DoD IT that receives, processes, stores, displays, or transmits DoD information will be acquired, configured, operated, maintained, and disposed of consistent with applicable DoD cybersecurity policies, standards, and architectures defined in DoDI 8500.01 CyberSecurity http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf and DoDI 8510.01, Risk Management Framework (RMF) for DoD IT http://dtic.mil/whs/directives/corres/pdf/851001_2014.pdf.

i. Systems with initiated Defense Information Assurance Certification and

Accreditation Process (DIACAP) activity must follow RMF initial transition timeline and instructions as defined in DoDI 8510.01.

ii. Systems with an existing DIACAP system accreditation decision must also follow RMF initial transition timelines as defined in DoDI 8510.01.

b. PERSONNEL SECURITY AND USER ACCESS CONTROL

i. The Contractor shall comply with, DoDD 5400.11, “DoD Privacy

Program”, DoD 6025.18-R, DoD Health Information Privacy Regulation and DoD 5200.2-R, “Personnel Security Program Requirements”.

ii. The Contractor shall initiate, maintain and document personnel security investigations appropriate to the individual’s responsibilities and required access to Sensitive Information (SI).

iii. Immediately report to the appropriate POC and deny access to any automated information system (AIS), network, or information if a Contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate government for security reasons.

http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf http://dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

v. To ensure that medical systems maintain data confidentiality, integrity, and availability levels consistent with industry best practices, the use of current

DOD accepted Operating Systems (OS) along with the required Security Technical Implementation Guide (STIG) settings is required.

vi. If applicable, the Contractor will be required to demonstrate if the solution can integrate with Directory Services and support LDAP authentication.

vii. The Contractor shall create a single local administrative/root level user account on the system strictly for the sole purpose of conducting system repairs and maintenance. This account shall be separate and distinct from the built-in local administrative/root account provided by the Operating System and shall comply with DOD policy.

c. Anti-malware

i. Systems that make use of a file system under direct control of an operating system instance whether physical and/or virtual shall be capable of supporting antimalware applications, within tolerable specifications, that support the use of DISA approved McAfee, and/or Symantec solutions. Systems shall be configured as to allow for the update of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, real time processes), by default. Exemption from this requirement is applicable to medical systems which make use of a proprietary file system and/or operating system for which no commercially available antimalware application exists.

d. Information Assurance Vulnerability Management (IAVM)

i. IAVM is focused on maintaining a secure platform as new vulnerabilities and exploits are discovered and released through various software developers and security agencies. The core tool of successful IAVM is the Information Assurance Vulnerability Alert (IAVA). The DOD releases IAVAs for local action on the various platforms across the enterprise network. Each Facility is responsible for managing their local network. Most DoD IAVAs originate from a real world event such as a patch release or vulnerability notification from a software Contractor (e.g. Windows or Sun patch release), or a US-CERT released from the CERT Coordination Center at Carnegie Mellon University. To have an effective IAVM program, Contractors must be proactive in monitoring emerging threats. Some recommended sources for IAVM support are:

13.d.i.1. General Vulnerability alerts, all platforms, http://www.cert.org/nav/index_red.html 13.d.i.2. Microsoft security resources, http://www.microsoft.com/technet/security/bulletin/notify.mspx 13.d.i.3. SUN Microsystems Security resources:

http://sunsolve.sun.com/pub-cgi/show.pl?target=security/sec

ii. As part of the IAVM program, the Contractor shall provide technical support for vulnerability mitigations.

iii. Any Contractor interested in meeting this requirement shall have a documented process to demonstrate an organizational culture embracing security throughout the system lifecycle. The processes shall clearly demonstrate security’s role in the product development phase, and the processes the Contractor employs to react to vulnerabilities, validate required patches, communicate status and required actions to their customers, and the follow up service support to address patch implementation.

iv. The Contractor shall comply with the Health Insurance Portability and Accountability Act (HIPAA) of 1996 (P.L. 104-191) requirements, specifically the administrative simplification provisions of the law and the associated rules and regulations published by the Secretary, Health and Human Services (HHS). This includes the Standards for Electronic Transactions, the Standards for Privacy of Individually Identifiable Health Information and the Security Standards.

v. In accordance with DOD 6025.18-R “Department of Defense Health Information Privacy Regulation” the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the (HIPAA) Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

14. CONTRACTOR PERSONNEL REQUIREMENTS:

a. Contractor employees shall comply with all safety procedures and practices associated with the command. Contractor personnel shall be required to abide by applicable Joint Commission, Occupational Safety and Health Administration (OSHA), and National Fire Protection Agency (NFPA) 99:

Health Care Facilities Code regulations. Additional site-specific requirements shall be stated in the future. Contractor employees shall identify themselves as Contractor personnel by introducing themselves or being introduced as Contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, Contractors shall identify themselves as Contractor employees in telephone conversations and in formal and informal written correspondence.

b. The services rendered by the Contractor are rendered in the capacity of an independent Contractor. The Government will evaluate the quality of services for purposes of contract inspection and acceptance. The Contractor shall be solely responsible for any and all liability caused by the acts or omissions of its agents or employees. The Contractor shall not in any manner represent or infer that it is an instrumentality or agent of the United States Government. The

Contractor shall recognize that the Commander maintains administrative and operational responsibility for all activities within the Command and may take such actions as necessary to preserve and maintain the integrity of the Command, subject to the limitations prescribed by law and U.S. DOD Regulations.

c. The Contractor shall obtain all necessary licenses and/or permits required to perform this work. He/she shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract. He/she shall be responsible for any injury to himself/herself, his/her employees, as well as for any damage to personal or public property that occurs during the performance of this contract that is caused by his/her employees fault or negligence, and shall maintain personal liability and property damage insurance having coverage for a limit as required by the laws of the State of in which the work is being conducted. Further, it is agreed that any negligence of the Government, its officers, agents, servants and employees, shall not be the responsibility of the Contractor hereunder with the regard to any claims, loss, damage, injury, and liability resulting there from.

d. The Contractor shall comply with Section 508 of the Rehabilitation Act of

1973 (29 U.S.C. 794d). Specifically, the procurement, development, maintenance, or integration of electronic and information technology (EIT) under this contract must comply with the applicable accessibility standards issued by the Architectural and Transportation Barriers Compliance Board at CFR part 1194.

14. CONTRACTOR PERSONNEL REQUIREMENTS: