Final_PWS_-_FAPNet.pdf

U.S. AIR FORCE

Office of the Surgeon General

Air Force Medical Service (AFMS)

AFMOA/SGHW

PERFORMANCE WORK STATEMENT (PWS)

For

Family Advocacy Program and Exceptional Family

Member Program Medical Network (FAPNet)

21 September 2012

TABLE OF CONTENTS

PAGE

1.0 DESCRIPTION OF SERVICES 3

1.1 Background 3

1.2 Scope 3

1.3 Acronyms 3

2.0 SUMMARY OF REQUIREMENTS 5

2.1 Description of Duties 5

2.2 General Contractor Personnel Requirements 10

2.3 Services Summary 12

2.4 Government Furnished Property 13

2.5 Travel 13

2.6 Security Requirements 14

2.7 Deliverables 17

2.8 Data Reporting Requirements 18

3.0 QUALITY CONTROL PLAN 19

4.0 NON PERSONAL SERVICES 19

5.0 CONTRACTOR IDENTIFICATION 20

6.0 HOURS OF OPERATION 20

7.0 APPENDICES 20

7.1 APPENDIX A: Health Insurance Portability & Accountability Act 21

7.2 APPENDIX B: HQ USAF/SGR Organizational Conflict of Interest 30

7.3 APPENDIX C: HQ AF/SG Non-Disclosure 26

7.4 APPENDIX D: Possible Travel Locations 32

7.5 APPENDIX E: Customer Complaint Record 33

1.0 DESCRIPTION OF SERVICES:

1.1 Background

The United States Air Force (USAF) Family Advocacy Program (FAP) and the Exceptional

Family Member Program – Medical (EFMP-M) are managed by the USAF Medical

Operations Agency (AFMOA) located at Lackland-Kelly Air Force Base, San Antonio, Texas. The programs provide policy, guidance, and standards to Military Treatment Facility

(MTF) staff located at 79 Continental United States (CONUS) and Outside Continental

United States (OCONUS) locations. Total personnel supporting these locations is approximately 600; offices range in size from 2 to 20 people. AFMOA provides a suite of applications (Family of Systems) known as FAPNet/Q-base to the 600 end users.

1.2 Scope

The contractor shall provide critical system sustainment and development for the AFMOA

Family of Systems and the modules developed to support them known as FAPNet/Q-base, the suite of systems supporting the FAP and the EFMP-M. System sustainment shall include software maintenance and other technical services. The scope of effort addressed in this

Performance Work Statement (PWS) requires hosting of a development and a test environment located at the contractor‟s site. The final test before deployment and production environments will reside on a virtual server in the Shared Services Department located at the Space and Naval Warfare Systems Center (SPAWARSYSCEN) Atlantic

(LANT), New Orleans Office. The contractor shall work with SPAWARSYSCEN to ensure system sustainment and development actions update to the production and test environments.

1.2.1 References to development and test sites in this PWS are only to ensure critical operational capability of FAPNet, such as "bug" fixes and security patches required to keep the system accessible. Maintenance of the current system is all that will be performed. At no time will the scope of capability that currently exists be changed under this PWS. Also, no additional capabilities will be designed, developed, or implemented.

1.3 ACRONYMS

ACRONYM DEFINITIONS

ADP Automated Data Processing

AF Air Force

AFI Air Force Instruction

AFMOA Air Force Medical Operating Agency

AFMS Air Force Medical Service

CAC Common Access Card

CFR Code of Federal Regulations

CM Configuration Management

CO Contracting Officer

CONUS Continental United States

COR Contracting Officer Representative

CPAR Contractor Performance Assessment Review

CVS Contractor Verification System

DEERS Defense Eligibility Enrollment System

DFAR Defense Federal Acquisition Regulation

DoD Department of Defense

DoDD Department of Defense Directive

DoDI Department of Defense Instruction

EFMP-M Exceptional Family Member Program-Medical

FAP Family Advocacy Program

FAM Functional Area Manager

FAR Federal Acquisition Regulation

FIPS Federal Information Processing Standards

FOUO For Official Use Only

GFE Government Furnished Equipment

GFP Government Furnished Property

GPM Government Program Manager

GTM Government Task Manager

GTR Government Travel Regulations

HIPAA Health Insurance Portability & Accountability Act

HSPD Homeland Security Presidential Directive

IA Information Assurance

IAM Information Assurance Management

IAT Information Assurance Technical

IAW In Accordance With

ID Identification

IM/IT Information Management/Information Technology

IW Information Warfare

LANT Atlantic

MSA Metropolitan Statistical Areas

MTF Military Treatment Facility

NACI National Agency Check with Inquiries

NASC Northwest Association of Schools and Colleges

NCA North Central Association Commission

NDA Non Disclosure Agreement

NEASC New England Association of Schools and Colleges

NLT Not Later Than

NSN National Stock Number

OCI Organizational Conflict of Interest

OCONUS Outside the Continental United States

ODC Other Direct Costs

OPM Office of Personnel Management

PCR Program Change Request

PE Project Engineer

PIR Problem Investigation Request

PKI Public Key Infrastructure

PM Program Manager

PWS Performance Work Statement

QCP Quality Control Plan

SAAR-N System Authorization Access Request Navy

SACS Southern Association of Colleges and Schools

SPAWARSYSCENT Space and Naval Warfare Systems Center

SQL Structured Query Language

USAF United States Air Force

WASC Western Association of Schools and Colleges

2.0 SUMMARY OF REQUIREMENTS:

2.1 Descriptions of Duties: The following paragraphs list required support tasks throughout the contract life. The contractor shall provide necessary resources and knowledge to support the listed tasks. The contractor shall complete all required tasks while controlling and tracking performance and goals in terms of costs, schedules, and resources.

2.1.1 Technical Support

The contractor shall provide technical support for the AFMOA FAPNet/Q-base.

2.1.2 System Engineering and Data Analysis Services

The contractor shall perform systems engineering and data analysis to analyze critical problems associated with system performance, functionality, and system access. The contractor shall design, develop, test, and deploy appropriate corrective solutions.

2.1.3 Help Desk/Customer Support

The contractor shall provide technical support to handle user e-mails generated from the supported Family of Systems. The contractor site shall serve as a second-level call center to provide detailed technical support to end users during normal business hours.

2.1.4 System Sustainment

The contactor shall provide system sustainment for FAPNet, Q-base, and related modules. These systems are web-based systems developed using Microsoft.net and

Xtendable server with Microsoft SQL server 2000 databases operating on Microsoft

Windows 2000 servers. FAPNet and Q-base are hosted on the same hardware suite; and, they are supported by the same Authority to Operate. System Sustainment shall include software maintenance and other technical services as identified throughout Section 2 of this document.

2.1.5 Hosting Requirements

Production and test environments will reside on a virtual server in the Shared Services

Department located at the SPAWARSYSCEN LANT, New Orleans Office. The contractor shall provide all application support to the SPAWAR site system administrators and engineers required to support these environments. The contractor shall also provide any environments on their site required for completion of assigned tasking, and then deployment shall be made to the government hosted environments for acceptance testing and production.

2.1.5.1 Department of the Navy/Application and Database Management System

Because the production and test environments reside on Navy systems, the contractor shall ensure that all networks, servers, or associated devices procured and/or connected to a Navy network complete Department of the Navy/Application and Database Management System registration and receive Functional Area

Manager (FAM) approval. The contractor shall also ensure that no FAM disapproved applications are integrated, installed, or operational on Navy networks.

2.1.6 Software Maintenance

The contractor shall provide subject matter experts to support documentation, completion of Problem Investigation Requests (PIRs), database support, deployment, and testing for defined maintenance to FAPNet/Q-base. Each software PIR deployment effort shall have a minimum of two (2) full weeks of testing open to the user community unless reduced testing requirements are approved by the COR. Identified defects will be provided in writing by the COR. Identified defects shall be resolved by the contractor prior to

Government acceptance within a timeframe agreed upon by the Contracting Officer, AFMOA Government Program Manager (PMs), and the contractor regardless of deployment to production unless otherwise agreed to by AFMOA Government PMs.

2.1.6.1 Software Maintenance Documentation

The contractor shall provide support to finalize requirements and develop documents associated with changes. Documents shall include but are not limited to

Requirements Documentation, Specification Documentation, User Manuals, Training Materials, and other documentation as requested by the Government.

2.1.6.2 FAPNet/Q-base Applications

The contractor shall implement PIRs approved by the AFMOA PMs and

SPAWARSYSCEN LANT, New Orleans Office for the FAPNet and Q-base applications. The contractor shall analyze PIRs, prepare resource estimates and schedules, and effect necessary design and code changes. Changes shall be successfully tested before being released into production to ensure there is no system disruption.

2.1.6.3 Software Change and Release Management

The contractor shall apply engineering analytical disciplines to identify, document, and verify that functional, performance, and physical characteristics of systems, to control changes and non-conformance, and to track actual configurations of systems and platforms. The contractor shall use an automated configuration management

(CM) tool to record all system change requests and trouble reports. The contractor shall maintain disciplined CM practices for version control and system-update releases. Releases shall be coordinated with the appropriate approval authority prior to release including the preparation and submission of Engineering Change

Proposals. The contractor shall complete and/or update all documentation affected by the required change(s) to include user manuals, training materials, and the data dictionary. Change documentation shall reflect changes applied to the system(s) based on modifications made. Anticipated system downtimes will be coordinated with FAP/EFMP-M PMs to allow users to be notified that the systems will be unavailable.

2.1.6.4 Source Code Package

Provide the complete source code package for code developed under this contract, updated with all changes during the period of performance, to the Government PM.

2.1.7 Program Management

The contractor PM shall work closely with the Government PM and support the needs of the program at the sponsor level when applicable. Coordination of meetings, preparing budget drills, developing agenda items, attending high-level meetings, generating minutes, and tracking action items may be required. Other support may require a contractor to recommend policies, doctrine, tactics, and procedures at the federal, state, and local level given their past expert opinion or using analysis of actual outcomes.

Program support may require significant coordination and interface with various DoD and non-DoD activities located in and out of CONUS.

2.1.7.2 Program Management Documentation

The contractor PM shall be responsible for ensuring that program management contract deliverables are tracked and submitted on time throughout the life of contract.

2.1.8 Systems Requirements and Definitions

The contractor shall use the FAPNet and Q-base ticketing systems to obtain high level maintenance requirements. The contractor shall attend scheduled meetings and participate in teleconferences to clarify requirements related to the associated tickets in order to begin development. Technical documentation shall be either paper or digital/electronic form.

2.1.9 Records Administration

The FAPNet/Q-base data system includes Personally Identifiable Information and

Protected Health Information. The contractor shall manage patient administration functions, including protecting medical information, managing health records, preparing and disposition of medical documentation and managing administration activities supporting patients as defined within Air Force Instruction (AFI) 41-210 Health Services

– Patient Administration. This instruction directs collecting and maintaining information subject to the Privacy Act of 1974 authorized by Title 10, United States Code, Section

8014. Reference para 2.2, RELEVANT EXPERIENCE, for requirements.

2.1.10 User Training Instructions and Materials

The contractor shall develop training materials associated with the FAPNet/Q-base and shall be required to provide to the user community on-site and remote web-based training. Following on-site and/or remote web-based training, the contractor shall provide to the COR training evaluations submitted by the attendees.

2.1.11 Design Changes

Any equipment/system installed or integrated into the US Navy hosting platform shall meet the Information Assurance (IA) requirements as specified under Department of

Defense Instruction (DoDI) 8500.2.

2.1.12 Personnel Qualifications

Contractor skills required to support the FAPNet/Q-base system shall include but are not limited to the following: Xtendable, C#, Flash, and Structured Query Language (SQL)

Server database.

2.1.12.1 Personnel assigned to or utilized by the contractor in the performance of this contract shall, at a minimum, meet the experience, educational, or other background requirements set forth below and shall be fully capable of programming, evaluating, recommending corrections, and correcting problems for the computer languages listed in 2.1.12 directly above.

2.1.12.2 The Government shall be able to review résumés of contractor personnel proposed to be assigned, and if personnel is not currently employed by the contractor, a written agreement from potential employee to work shall be included as part of the résumé submittal.

2.1.12.4 The contractor shall have personnel, organization, and administrative control necessary to ensure that the services performed meet all requirements specified. The work history of each contractor employee shall contain experience directly related to the tasks and functions to be assigned.

2.1.12.5 Meeting the minimum educational and experience requirements is essential when determining if a person is qualified. When determining if educational and experience requirements are acceptable, the following criteria are applicable:

2.1.12.5.1 To ensure that postsecondary education possessed by individuals meets an acceptable level of quality, educational degrees shall come from accredited institutions or programs. See www.ed.gov for more accreditation information. At a minimum, to receive credit for a Master and Doctorate, all degrees shall be earned from an institution that has been regionally accredited by one of the six associations: Metropolitan

Statistical Areas (MSA), Northwest Association of Schools and Colleges

(NASC), North Central Association Commission (NCA), New England

Association of Schools and Colleges (NEASC), Southern Association of http://www.ed.gov/

Colleges and Schools (SACS), and Western Association of Schools and

Colleges (WASC.)

2.1.12.5.2 Bachelor‟s of Science or Associate‟s degrees in Applied

Science, Computing, Engineering, and Technology shall be from an

Accreditation Board for Engineering and Technology accredited program

(see www.abet.org).

2.1.12.5.3 When not specified, higher education above a labor category‟s minimum can be credited as years of experience as long as the higher degree is within the same required field of study as the minimum degree required. The following Educational credit applies: a Master‟s degree equals four (4) years of experience and a PhD degree equals five (5) years of experience.

2.1.12.5.4 Technology degrees do not qualify as Engineering or Physical

Science Degrees.

2.1.12.5.5 Engineering Positions require Engineering degrees or written

(vs. grandfathered) State Project Engineer (PE) License.

2.1.12.5.6 Service Component Architecture titles and reference numbers are in accordance with (IAW) Contract Act Directory of Occupations

(Fifth Edition), published in www.dol.gov.

2.1.12.5.7 Applicable for IA/Information Warfare (IW) Labor Categories:

contractor personnel supporting IA functions shall be certified prior to being engaged in IA related work and be in full compliance with DoD

8570.1-M and DoD Directive (DoDD) 8570.1 This includes personnel being certified/accredited at the appropriate levels of Information

Assurance Technical (IAT) I-III and Information Assurance Management

(IAM) I-III as appropriate. This will be verified by the Contracting

Officer Representative (COR) who will ensure that contractor personnel are entered in to the Defense Eligibility Enrollment System (DEERS) or other appropriate database. Contractor personnel not certified within six

(6) months of assignment of IA duties or who fail to maintain their certified status will not be permitted to carry out the responsibilities of the position, and shall be replaced with a contractor personnel who does meet the minimum certification requirements as mandated above.

2.1.13 Key Personnel

The Contractor agrees to assign under the contract those personnel whose credentials, experience and expertise meet the qualification requirements identified in the

Performance Work Statement to fulfill the requirements of the contract.

http://www.abet.org/ http://www.dol.gov/

2.1.13.1 The Contractor agrees that a partial basis of award of this contract will be the key personnel proposed, including those employed by subcontractors, if applicable. Accordingly, the Contractor agrees to assign under the contract those key personnel whose credentials, experience and expertise were provided with the proposal and which meet the qualification requirements of the contract.

2.1.13.2 The Contracting Officer (CO) and Contracting Officer Representative

(COR) shall be notified of any proposed changes at least 30 days in advance. The government reserves the right to reject proposed changes in key personnel. Such notification shall include:

- an explanation of the circumstances necessitating the substitution

- a complete resume of the proposed substitute and

- any other information needed by the CO and COR to enable them to judge that the Contractor is maintaining the same quality of personnel as those included at the time of award.

2.1.13.3 List of Key Personnel

# Labor Category

1 Project Manager

2 Senior Software

Engineer

2.2 GENERAL CONTRACTOR PERSONNEL REQUIREMENTS

2.2.1 Able to communicate clearly, both orally and in writing in English.

2.2.2 Be responsible for Personnel Security. Costs and documentation required for security certification will be the responsibility of the contractor. Contract personnel must have a National Agency Check and Inquiries (NACI) investigation accomplished prior to beginning work. Provide documentation received from the appropriate Government agency as to the verification of contract personnel‟s NACI certification. In case the certification has been requested, but not received, the contractor may provide documentation on any contractor employee where certification has been requested. In the instance, the contractor employee will be able to begin work in areas that would not conflict with Government security issues.

2.2.3 Comply with DoD Directive 8570.1M, Information Assurance Workforce

Improvement Program-25 Feb 2010, Change 2, DoDI 8500.2, Information Assurance

Implementation DoD Instruction 5400.11, DoD Privacy Program, and DoDI 5200.2-R, Personnel Security Program Requirements.

2.2.4 Do not disclose, share, or otherwise make public any network passwords or any information contained in government information management systems to which contractor personnel have been granted access.

2.2.5 Place Of Performance: The primary place of performance for this effort is the contractor‟s facility.

2.2.6 Privacy Act (PA): The Privacy Act of 1974 (5 U.S.C. § 552a), which includes

Public Law 100-503. The Privacy Act of 1974 shall cover all data associated with this requirement. All contractor personnel assigned shall be required to take appropriate actions to prevent disclosure of this information.

2.2.7 Non-Disclosure Agreement (NDA) Statement: All contractor employees shall sign the non-disclosure statement provided in Appendix C of this PWS at the time of acceptance of employment. The contractor must then provide a copy of the signed/dated NDA to the

Contracting Officer Representative (COR) within five (5) work days after the employee‟s signature is accomplished.

2.2.9 Reporting Requirements: Automated Data Processing (ADP) SECURITY

REQUIREMENTS: Contractor personnel shall report to an appropriate authority, any information or circumstances of which they are aware may pose a threat to the security of

DoD personnel, contractor personnel and resources. Contractor employees shall be briefed by their company manager upon initial on-base assignment and as required thereafter.

2.2.10 Physical Security: The Contractor shall be accountable for control of Government property IAW Air Force Joint Instruction (AFJI) 31-102, Physical Security. The

Contractor is also responsible for the protection of any contractor-owned equipment or supplies brought onto the installation IAW AFJI 31-102, Physical Security. Further, the

Contractor shall not remove any Government property from the installation

2.2.11 Data Rights: No Federal Acquisition Clauses will be applied to this contract regarding data.

2.2.12 Release of Medical Information: Contractor personnel are prohibited from releasing any personnel or medical/patient information to include patient/person-level content with personal health information. Documentation of training shall be provided to the COR prior to the contract employee providing services. Information shall be treated In

Accordance With (IAW) the following:

2.2.12.1 Other Military Health Services, AFMOA, Federal and State laws shall also be applicable.

2.2.12.2 Contractor shall provide patient information only to Government employees, Government Contractor, and subcontractors having a need-to-know such information in the performance of their duties for this project.

2.2.12.3 The COR shall be kept abreast of issues dealing with the security clearances and/or certifications. No foreign national candidates shall be utilized within the scope of this contract without prior approval of the Government Program

Manager (GPM) and AFMOA Security Manager.

2.1.12.4 Organizational Conflict of Interest (OCI). Contractor shall provide signed

OCI provided in the PWS Appendix B at the time of the submission of proposal.

(FAR Sub-Part 9.5).

2.2.13 Retrieving Identification Media: The contractor shall retrieve government provided identification media from employees who depart for any reason before the contract expires (e. g., terminated for cause, retirement) and return such media to Pass and

Identification section for proper disposition.

2.2.14 Network Access. The Contractor(s), with a valid NACI verified through the

Automated Security Clearance Approval Systems roster or validation from the on-site

Contractor‟s security manager, will be provided access to the government unclassified computer networks and their inherent capabilities including, but not limited to: Internet access, electronic mail, file and print services, and dial-in network access. The

Contractor is accountable for all actions that he or she initiates while on the network and shall conduct his or her business IAW with all AF and local base instructions, manuals, and policies. Any conduct that does not adhere to sound or just network usage as stipulated in official guidance will cause revocation of all network privileges. All personnel having access to SPAWARSYSCEN LANT offices/program information will be required to execute non-disclosure and information protection agreements. The

SPAWAR office will supervise the release of data and will designate an individual to oversee and advise the Contractor on all data released and/or exported from the system.

2.2.15 Information Assurance. Contractor employees will have access to both Medical

Quality Assurance and Privacy Act information. Contractor employees are required to protect the integrity of these documents; no unauthorized release of this information is permitted. Unauthorized release is subject to fines as described in applicable statutes.

2.3 SERVICES SUMMARY. The Contracting Officer Representative (COR) is responsible for review and approval of all deliverables and contract performance. The Government will periodically evaluate the contractor‟s performance by appointing a representative(s) to monitor performance to ensure services are received. The Government representative will evaluate the contractor‟s performance through inspection of deliverables and receipt of all complaints from customers. Report schedule delays immediately to the appropriate government representative. It is expected that customer support will receive response to help requests by the next business day

95% of the time and no more than 1 interruption of services of no more than 1 day lost due to products not meeting requirements of the host site. The Government may inspect each task as completed or increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections or because of repeated customer complaints. Likewise, the Government may decrease the number of quality control inspections if performance dictates. The COR shall make final determination of the validity of customer complaints. See Table 1 – Services Summary below:

2.3.1 Services Summary

Performance Requirements

PWS

Paragraph

Performance

Threshold/Standard

Help Desk / Customer

Support 2.1.3

Respond to help desk requests by next business day 95% of the time

Ensure compliance with production environment requirements at

SPAWARSYSCEN LANT,

New Orleans, LA

2.1.5

No more than 1 interruption of services of no more than 1 day lost due to products not meeting requirements of the host site, SPAWARSYSCEN LANT

2.4 GOVERNMENT FURNISHED PROPERTY AND FACILITIES: Most of the tasks issued under this contract shall be performed at the contractor‟s site. However, the contractor may be required, as requested by the GPM, to perform tasks on-site at Government locations.

2.5 TRAVEL/OTHER DIRECT COST (ODC)

2.5.1 Travel: The contractor is required to perform travel within the Continental United

States (CONUS). The contractor will coordinate travel requirements with the

Government PM and COR, ten (10) work days prior to travel date and receive GPM authorization from the office they support for all travel. The contractor shall be responsible for obtaining all passenger transportation, lodging, and subsistence.

Reimbursement of travel costs will be IAW the Joint Travel Regulation and the Federal

Travel Regulations per Federal Acquisition Regulation (FAR) 31.205-46, Travel Costs.

The contractor shall travel using the lower cost mode transportation commensurate with the mission requirements. When necessary to use air travel, the contractor will use the tourist class, economy class, or similar to the extent they are available and commensurate with the mission requirements. Travel shall be reimbursed on a cost reimbursable basis;

no profit or fee will be paid. Travel receipts must be submitted with invoices. Travel to and from work shall be considered a cost of doing business and will not be reimbursable.

See Appendix D for possible travel locations.

2.6 SECURITY REQUIREMENTS

2.6.1 Ensure that IAW AFI 31-501, Personnel Security Program Management, a NACI security clearance must be obtained prior to performance on this contract, maintained, held and reported to the Government Security Manager. Individual contractor personnel fulfilling the tasks under this contract will need to access sensitive information and resources (facilities, equipment), classified up to the level of Favorable (NACI) and requiring ADP Level III access. The following labor categories require a Favorable

(NACI) clearance and require ADP Level III access: Project Manager, Management

Analyst, Senior Subject Matter Expert, Systems Analyst, and Emerging Technology

Expert.

2.6.2 Verification and certification of clearances and eligibility will be required of the contractor, prior to granting access to information or equipment/system resources necessary to perform tasks under this contract.

2.6.3 Individuals assigned by the contractor to support this contract will be required to fulfill administrative requirements for access (to/from government work sites) and government owned/furnished equipment (and its application thereof in support of assigned tasks) as requested by the GPM. This includes, but is not limited to, guidelines and procedures for facility access, key control, equipment access, control and safeguard, and identification badges.

2.6.4 Day-to-day Information and Operational Security Practices: Comply with all Departmental guidelines, instructions and procedures pertaining to the proper safeguarding, handling, storage, transport, distribution, and disposal of government materials marked as or known to be (by definition) Sensitive But Unclassified, For Official Use Only (FOUO) or covered by the Privacy Act. Contractor personnel shall strictly adhere to established standard operating procedures and practices while on contractor‟s and government premises, to include security checks, key control as required, and handling of documents, media, and other materials and equipment.

2.6.5 Security Training and Awareness: The contractor shall ensure that all contractor personnel and staff resources assigned to the project are trained in the appropriate security practices and policies, and attend Orientation/Awareness/Refresher training sessions (within the local commuting area at the expense of the contractor), at such times as identified by the COR.

2.6.6 Physical Access to Government Facilities and Installations

Contractor personnel shall physically access Government facilities and installations for purposes of site visitation, supervisory and quality evaluation, work performed within

Government spaces (either temporary or permanent), or meeting attendance. Individuals supporting these efforts shall comply with the security regulations applicable to the

Government facility/installation.

2.6.6.1 The majority of Government facilities require contractor personnel to have an approved visit request on file at the facility/installation security office prior to access. The contractor shall initiate and submit a request for visit authorization to the COR IAW DoD Manual 5220.22M, Industrial Security Manual for

Safeguarding Classified Information not later than one (1) week prior to visit – timeframes may vary at each facility/installation. For admission to

SPAWARSYSCEN LANT facilities/installations, a visit request shall be forwarded via Space and Naval Warfare Systems Center Atlantic, P.O. Box 190022, North

Charleston, SC 29419-9022, Attn: Security Office, for certification of need to know by the specified COR. For visitation to all other Government locations, visit request documentation shall be forwarded directly to the on-site facility/installation security office via approval by the COR or designated Government representative.

2.6.6.2 Depending on the facility/installation regulations, contractor personnel shall present a proper form of identification(s) and vehicle proof of insurance or vehicle rental agreement. NOTE: Effective 1 Oct 10, SPAWARSYSCEN LANT facilities located on Joint Base Charleston (previously known as Naval Weapons Station

Charleston) require a Common Access Card (CAC) each time physical installation access is required. COR shall contact SPAWARSYSCEN LANT Security Office directly for latest policy.

2.6.6.3 As required, a temporary or permanent automobile decal for each contractor personnel may be issued. The contractor assumes full responsibility for the automobile decal and shall be responsible for the return and/or destruction of the automobile decal upon termination of need or of personnel.

2.6.6.4 All contractor persons engaged in work while on Government property shall be subject to inspection of their vehicles at any time by the Government, and shall report any known or suspected security violations to the Security Department at that location.

2.6.7 Government Badge Requirements

Some contract personnel shall require a Government issued picture badge. While on

Government installations/facilities, contractors shall abide by each site‟s security badge requirements. Various Government installations are continually updating their security requirements to meet Homeland Security Presidential Directive (HSPD-12) identification standards. Contractors are responsible for obtaining and complying with the latest security identification requirements for their personnel as required. Contractors shall submit valid paper work (e.g., site visit request, request for picture badge, and/or SF85P for CAC card) to the applicable Government security office via the contract COR. The contractor‟s appointed Security Officer, shall track all personnel holding local

Government badges.

2.6.8 Common Access Card (CAC) Requirements

Some Government facilities/installations (e.g., Joint Base Charleston) require contractor personnel to have a CAC for physical access to the facilities or installations. Contractors supporting work that requires access to any DoD IT/network also requires a CAC.

Granting of logical and physical access privileges remains a local policy and business operation function of the local facility. The contractor is responsible for obtaining the latest facility/installation and IT CAC requirements from the applicable local Security

Office. When a CAC is required to perform work, contractor personnel shall be able to meet all of the following security requirements prior to work being performed:

2.6.8.1 Eligibility for a CAC – to be eligible for a CAC, contractor personnel‟s access requirement shall meet one of the following three criteria: (a) individual requires access to multiple DoD facilities or access to multiple non-DoD Federal facilities on behalf of the Government on a recurring bases for a period of 6 months or more, (b) individual requires both access to a DoD facility and access to DoD network on site or remotely, or (c) individual requires remote access to DoD networks that use only the CAC logon for user identification

2.6.8.2 Verification of DoD affiliation from an authoritative data source – CAC eligible personnel must be registered in the DEERS through either an authoritative personnel data feed from the appropriate Service or Agency or Contractor

Verification System (CVS).

2.6.8.3 Completion of background vetting requirements according to Federal

Information Processing Standards (FIPS) PUB 201-1 and DoD Regulation 5200.2-

R – at a minimum, the completion of Federal Bureau of Investigation (FBI) fingerprint check with favorable results and submission of a NACI to the Office of

Personnel Management (OPM), or a DoD-determined equivalent investigation.

NOTE: Personnel requiring a CAC under SSC Atlantic shall contact the SSC

Atlantic Security Office to obtain the latest requirements and procedures.

2.6.8.4 Verification of a claimed identity – all personnel will present two forms of identification in their original form to verify a claimed identity. The identity source documents must come from the list of acceptable documents included in Form I-9, OMB No. 115-0136, Employment Eligibility Verification. Consistent with applicable law, at least one document from the Form I-9 list shall be a valid

(unexpired) State or Federal Government-issued picture identification (ID). The identity documents will be inspected for authenticity, scanned, and stored in the

DEERS.

2.6.8.5 When a contractor requires logical access to a Government IT system or resource (directly or indirectly), the required CAC shall have a PKI. A hardware solution and software (e.g., ActiveGold) is required to securely read the card via a personal computer. Prior to receipt of a CAC, all contractor personnel shall be required to complete the mandatory annual IA training and submit a signed System

Authorization Access Request Navy (SAAR-N) form to the contract‟s specified COR.

2.6.9 Installation Entry: Comply with established security procedures for entering the installation and its facilities to include any special security procedures that may be established for entry to Restricted Areas or mission essential or vulnerable areas.

2.7 DELIVERABLES

2.7.1 Criteria for Acceptance. All deliverables shall be submitted in a format mutually agreed upon by the contractor and the COR.

Deliverable PWS

PARA #

Required

Project Management Plan 2.8.6 No later than (NLT) two (2) weeks after meeting finalizing requirements

Software Maintenance (Modified Code)

Release 2.1.6.2

As determined in the Project

Management Plan

Source Code 2.1.6.3 As determined in the Project

Management Plan

Training Evaluations 2.1.10 NLT two (2) weeks after training completed

Requirements Documentation 2.1.6.2 As determined by the Project

Manager

Specification Documentation 2.1.6.2 As determined by the Project

Manager

User Manuals 2.1.6.2 Updated semi-annually, NLT 15 Mar and 1 Sep

Training Materials 2.1.10 NLT three (3) weeks prior to training event

Quality Control Plan 3.0 30-days after award and anytime it is updated

Monthly Status Report 2.8.1 NLT 15 th day of the following month

Meeting Report 2.8.2 NLT 7-working days after meeting

Trip Report 2.8.3 NLT 7-work days after trip completion

Closeout Report 2.8.4 NLT 30-days after contract completion

Contractor‟s Manpower Report 2.8.5 NLT 1 st workday of Oct & Apr

Hours Report 2.8.7 Weekly

Complete Source Code Package 2.1.6.3 NLT last day of the period of performance

2.8 Data Reporting Requirements

2.8.1 Monthly Status Report shall include contract number and project number, brief task description, a narrative review of work accomplished, significant events, problems, anticipated activity for the next period, other relative information, system availability

(include description of problem, time from notification or awareness of problem, and when system was restored), project financial information, i.e. hours billed, hours remaining, the reporting period.

2.8.2 Meeting Reports shall be submitted upon completion of meetings between the

Government PM and Contractor PM shall include contract number, purpose of meeting, discussion of topic and relevant decisions, narrative review of work accomplished, significant events, problem areas, anticipated activity requiring follow-up, and other relevant information

2.8.3 Trip Reports shall be submitted on all official travel associated with this contract.

Trip reports shall be formatted like Meeting Reports in para 2.8.2.

2.8.4 Closeout Report shall be submitted to the Government no later than 30 days after the contract completion date. The report shall include, as a minimum, the following information:

2.8.4.1 Financial data: Breakdown of all costs (labor, travel, material, fee) per invoice, all key personnel that were utilized/charged on the job, specify all work yet to be charged, all remaining funds, and balances available, if any, for return (de-obligation), etc.

2.8.4.2 Deliverable status: Percentage job complete, any outstanding issues, list of any items/services under workmanship/manufacturer warranty, etc.

2.8.4.3 Government Property: The Government‟s rights regarding all code and documentation generated under this contract shall be in accordnace with

Defense Federal Acquisition Regulation (DFAR) 252.227-7014.

2.8.4.4 Government-furnished Property (GFP) provided shall either be consumed or returned to the Government. A final inventory list shall be required accounting for all Government property. The contractor shall incorporate information and receipts obtained from the initial disposition inventory list. For property being returned, the contractor shall include on the inventory list the following minimum information: part numbers, National Stock Number (NSN) nomenclature, quantity, and condition of each item (i.e., Condition A, F, etc.). Paperwork validating official receipt by GPM is required for returned items.

2.8.5 Contract Manpower Report shall be submitted semi-annually NLT the first workday of October and April. This report shall include: contract number; estimated number of Full-Time Equivalents under contract; locations where work was performed.

2.8.6 Project Management Plan. Prepare a Project Management Plan describing the technical approach, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements for this effort. The Project

Management Plan shall detail the products, methods for developing the products, allocation of staff and other resources necessary to produce the products and a revised timeline for producing the products, if necessary. Identify the staffing approach and quality control method to ensure continuous fulfillment of the overall contact requirements and performance objectives. The Government PM shall receive the revised

Project Management Plan in both hard copy and electronic form, Microsoft Word. Based on the Project Management Plan, the Government PM will provide approval to move forward on activities planned. The contractor will request prior approval on all activities not included in the plan or any modifications to the plan after approval has been given.

Contractor shall submit draft Project Management Plan with proposal for the contract.

3.0 QUALITY CONTROL PLAN: The Contractor shall be responsible for quality assurance during the performance of all tasks. All work shall be accomplished using the best commercial practices and be within the Government guidelines. Work and documentation produced by the contract personnel shall be regularly reviewed by the COR to include but not limited to the documents and products listed in the deliverables and services summary table. Only the COR, or

Contracting Officer may accept or reject deliverables provided by the contractor with input from the executive director.

3.1 Quality Control Plan (QCP). The contractor shall provide to the government a QCP at time of proposal and any updates after contractor award. Any update to the QCP must be reviewed by the COR. Establish and maintain a complete QCP to ensure the requirements of this PWS are provided as specified. The contractor‟s QCP shall address risk management to include processes in place to evaluate and ensure system sustainment is met in all cases.

4.0 NON PERSONAL SERVICES

The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the contractor‟s responsibility to notify the CO immediately. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

5.0 CONTRACTOR IDENTIFICATION

In the presence of Government personnel, all contractor/subcontractor personnel shall wear company picture identification badges so as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between

Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks will identify their company affiliation. Where practicable, contractor/subcontractors occupying collocated space with their Government program customer should identify their work space area with their name and company affiliation or as a minimum “Contractor” after their name.

6.0 HOURS OF OPERATION

6.0.1 Weekly contractor work hours shall not exceed forty (40) hours per week. When working on a government installation, a typical work day will be 7:30 AM to 4:30 PM, Monday through Friday; however, weekend duty may be required. The Government reserves the right to change hours of operation or restrict contractor access. Work outside of normal hours must receive the advanced approval by the Contracting Officer.

6.0.2 Government agencies will not be available during scheduled holidays, inclement weather, weekends, after duty hours, or AF “down days”. All chargeable work will be directly attributable to the task performed by individual contractors.

6.0.3 Scheduled Holidays. New Year‟s Day; Dr. Martin Luther King, Jr. Birthday;

President‟s Day; Memorial Day; Independence Day; Labor Day; Columbus Day; Veteran‟s

Day; Thanksgiving Day; Christmas Day.

7.0 APPENDICES:

7.1 Appendix A: Health Insurance Portability and Accountability Act of 1996

7.2 Appendix B: HQ AF/SG Organizational Conflict of Interest

7.3 Appendix C: HQ AF/SG Non-Disclosure Agreement

7.4 Appendix D: Sustainment Locations

7.5 Appendix E: Customer Complaint Record

APPENDIX A: HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY

ACT (HIPAA) OF 1996

HIPAA is comprised of several different sections, each to be implemented by the Dept. of Health and Human Services. The Air Force Medical Service (AFMS) and its components are specifically listed as covered entities (CE) under HIPAA. Currently, HIPAA Privacy and Security Rules, as set forth in the Code of Federal Regulations, are in effect for all AFMS CEs. The specific implementation of HIPAA Privacy for DOD medical facilities is set forth in DOD 6025.18-R, and for HIPAA Security, the requirements for the AFMS are contained in DOD 8580.02-R and AFI

41-217, which also contains additional Information Assurance requirements. DOD 6025.18-R, DOD 8580.02-R and AFI 41-217 are incorporated herein by reference. AFMS organizations are responsible to insure overall compliance with HIPAA requirements, which includes incorporation of certain requirements in contracts entered into or amended after the respective implementation dates.

In accordance with these regulations, the contractor and its employees meet the definition of

Business Associate. Therefore, a Business Associate Agreement is required by law to comply with both the HIPAA Privacy and Security regulations. This clause serves as that agreement for this contract, whereby the contractor and its employees agree to abide by all HIPAA Privacy and

Security requirements regarding health information as defined in this clause, DOD 6025.18-R, DOD 8580.02-R, and AFI 41-217. Additional HIPAA requirements will be addressed when implemented.

Introduction

(a) Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DOD 6025.18-R, DOD 8580.02-R or AFI 41-

217.

Individual has the same meaning as the term “individual” in 45 CFR 164.50 1 and 164.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45

CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term “protected health information” in 45

CFR 164.501, limited to the information created or received by the contractor from or on behalf of the Government.

Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

Required by Law has the same meaning as the term “required by law” in 45 CFR 164.501 and

164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160,162 and part 164, subpart C.

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR 160.103, 160.502, 164.103, 164.304 and 164.501.

(b) The contractor agrees to not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

(c) The contractor agrees to use appropriate safeguards to prevent use or disclosure of the Protected

Health Information other than as provided for by this Contract.

(d) The contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

(e) The contractor agrees to mitigate, to the extent practicable, any harmful effect that is known to the contractor of a use or disclosure of Protected Health Information by the contractor in violation of the requirements of this Contract.

(f) The contractor agrees to report to the Government any security incident involving protected health information of which it becomes aware.

(g) The contractor agrees to report to the Government any use or disclosure of the Protected Health

Information not provided for by this Contract of which the contractor becomes aware of.

(h) The contractor agrees to ensure that any agent, including a subcontractor, to whom it provides

Protected Health Information received from, or created or…