FY26.SOW.HE.Stainer.pdf

Statement of Work

1. General Description.

1.1. Provide Martin Army Community Hospital (MACH), USAMEDDAC Fort Benning, Georgia laboratory with a supply contract to lease an automated hematoxylin and eosin tissue staining system for the period of performance 1 October 2025 through 30 September 2026, or date of award. The vendor is responsible for providing delivery and installation of analyzer, reagents, supplies, service, preventive maintenance, training, and analyzer removal at the end of the contract. This analyzer will be in the histology section under the management of the Department of Pathology.

Funding will be allocated annually and is subject to the availability of funds.

2. Physical Security.

2.1. Personnel or any representative of the contractor entering Fort Benning shall abide by all security regulations and shall be subject to security checks. Contractor and all associated sub-contractor’s employees shall comply with applicable installation/ facility access and local security policies and procedures (provided by Government representative as needed). The contractor shall also provide all information required to meet installation access requirements if required including background checks to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9 (Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

2.3. Ensure personnel report to the Equipment Management Suite located in room GC-122 on the ground floor to sign in and obtain a temporary vendor security badge PRIOR to commencing all on-site visits, preventive maintenance service, support or repairs to equipment in the laboratory and any BMACH outlying site that has equipment installed under this contract.

2.4. Ensure that any requirement to remove, exchange, or add contractor’s equipment during the performance of this contract is coordinated through the government representative and must also include the site OIC/NCOIC, Chief EMB and the Property Book Officer.

3. Hours of Operation.

3.1. Normal Hours. Normal hours of operation are 8:00am to 3:00pm EST, Monday through Friday.

3.2. Recognized Holidays. Facility observes all federal holidays. Federal Holidays are as follows:

1 Jan New Year’s Day 3rd Monday in Jan Martin Luther King Jr. Birthday 3rd Monday in February President’s Day Last Monday in May Memorial Day 4th July Independence Day 3rd Thursday Juneteenth 1st Monday in Sep Labor Day 2nd Monday in Oct Columbus Day 11 Nov Veteran’s Day 4th Thursday in Nov Thanksgiving Day 25 Dec Christmas Day NOTE : When any of the above holidays fall on a Saturday it will be observed on the preceding Friday; holidays that fall on a Sunday will be observed on the following Monday. Any holidays declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above.

4. Vendor Deliverables.

4.1. LIS Interface: The contractor shall furnish interface assistance to ensure that the system is interfaced with the LIS prior to departure. If purchase of additional equipment such as computer monitor, computer processing unit, and printer are required to maintain the LIS system interface, the vendor must provide them, upgrade them and maintain them throughout the contract period at no cost to the government. Replacements must be made as needed at no cost to the government. The system must have barcode capabilities and be fully interfaced to the Cerner and electronic health record MHS Genesis.

4.2. Furnish all materials required to perform maintenance, repairs, or service. Any costs associated with travel, lodging or meals to conduct services or preventive maintenance will be at the cost of the contractor.

4.3. Upon completion of services, a written service report will be provided to the Biomedical Maintenance / Clinical Engineering Manager. The service report shall be completely filled out, provide detailed information regarding the cause of equipment malfunction and corrective action taken, to include the time required to complete the work, price of labor (hourly rate), and a list of parts replaced with a price for each part. In the event all information is not available to contractor’s representative when services are performed, the initial service report shall include all information stated above except for price. Contractor shall provide the balance of the required information in writing to the Biomedical Maintenance Branch, Ms. Pamela Francis at pamela.t.francis.civ@health.mil, within ten days after the services are completed.

4.4. Provide new and/or refurbished parts that are certified and documented to meet Original Equipment Manufacturers (OEM) specifications on all manufacturers’ mandatory modifications and apply recalls by FDA.

4.5. Contractor will provide new or updated user manuals when changes are made at no additional cost.

4.6. Furnish all applicable SDS for reagents, equipment and supplies utilized under this contract at no additional cost.

4.7. Deliver an automated hematoxylin and eosin tissue staining system with the following Components:

Command Center

Sample Management Center Barcode Sample Identification Unit

Reagent Management Unit Incubator Unit Mixing Units Reading Unit

Sample Input Unit Sample Output Unit Coverslipper unit

Powerware/ UPS On Board Computer with Printer Software Operator‘s Manual Maintenance Manual

5. Specific Tasks.

5.1. Provide on-site technical support and all reagents and supplies required for installation, validation/correlation of analyzers to bring to a fully operational status is included.

5.2. Ensure that if system requires a water purification/ filtration system it, installation, service, maintenance and supplies required throughout the period of performance to operate the filtration system is included at no additional charge.

5.3. Ensure proper packaging of reagents, supplies, and equipment and that they are shipped at proper refrigerated or frozen temperatures according to manufacturer specifications.

5.4. Ensure all shipments arrive Monday through Friday between the hours of 8:00am and 3:00pm EST, excluding holidays and weekends according to paragraph 3.2 above.

5.5. Respond to phone calls regarding shipment discrepancies the same day of notification and discrepancy will be corrected within 24 hours.

5.6. Provide customer notification of updates on any reagents in writing within 5 business days and ensure continuity of services and availability of reagents during reagent revision when required.

5.7. Ensure reagents meet quality control guidelines set forth by manufacturer.

5.8. Provide all software upgrades at no additional

cost.

5.9. Notify the laboratory if there is a recall on any reagents or equipment within 24 hours.

5.10. Respond to service calls within four hours after notification. If it is after 5:00pm Monday through Friday respond on the next duty day. Deficiencies should be corrected within 24 hours after arrival on-site.

5.11. Perform all on-site scheduled service as specified by the manufacturers published maintenance manual as necessary to keep system in good condition including lubrications, cleaning (other than those performed at the operator’s level), calibrations, and diagnostics, during the lease period at no additional cost.

5.12. Provide 24-hour telephonic troubleshooting support.

5.13. Provide web-based software license subscription that interface with 25 Abbott i-STAT analyzers and 25 Abbott Precision Xceed Pro/ Abbott Freestyle Precision Pro Glucometer point of care analyzers, LIS Cerner and electronic health record MHS Genesis.

5.14. Provide computer based eQuiz training and recertification module

6. Payments.

6.1. Create a combo invoice document using the government’s Wide Area Workflow (WAWF) electronic internet-based System. WAWF is required. The website is https:// wawf.eb.mil. Contractor shall invoice in accordance with

DFARS 252.232-7003.

6.2. When it is necessary to resubmit an invoice for payment that the same invoice number listed on the original document with a letter after the number is used and that a new invoice number will not be generated for a previous shipment. (Example: Invoice # 100473, 100473A, 100473B, etc.).

6.3. Contractor will submit invoices in WAWF within 7 days of shipping date but no later than 30 days of shipping date.

6.4. Contractor ensures payments start only after the analyzer is fully operational, validated/ correlated, and live for patient testing.

7. U.S. Army Cybersecurity and Risk Management Framework (RMF) Requirements.

7.1. System Security Requirements.

7.1.1. The vendor shall submit to the Government, included in the quote, the blue section of the Medical Device Cybersecurity Assessment (Questionnaire) provided by government and Nessus Scans. Nessus scanner is to be procured by the vendor, at their own cost, in order to comply with RMF requirements.

7.1.2. Vendor agrees to comply with security regulations and guidance listed in attached Appendix A and all Risk Management Framework (RMF) requirements.

7.1.3. Failure to meet the requirements may result in termination of the delivery order for cause, in accordance with FAR 52.212-4(m).

7.1.4. The vendor device or system shall pass pre-validation screening (Vulnerability scans utilizing Nessus and SCAP scans), at contract award that will be conducted by Government, and must meet criteria listed below:

(a). No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx (b). No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx (c). No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

(d) No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

7.1.5. The vendor shall mitigate all Very High, High, and Moderate Severity/CAT I and CAT II vulnerabilities discovered during the Assessment and Authorization (A&A) process according to a schedule published by Government.

7.1.6. The vendor shall appoint a vendor point of contact responsible for the cybersecurity of the vendor device or system throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials, and meet required deliverable timelines.

7.1.7. The vendor shall obtain a recommendation of Authority to Operate (ATO) as determined by a Government appointed third party validator within twelve (12) months of contract award.

7.1.8. The vendor shall not make any delivery and shall not receive payment for the system until the ATO is granted.

Receiving the ATO document from the U.S. Army shall constitute permission to perform on the order and to proceed with delivery. All delivery dates shall be reset in accordance to contract and in days after the date the ATO is communicated in writing to the vendor. Delivery may take place prior to ATO only if written permission is provided by the DLA Contracting Officer.

7.1.9. Pursuant to subsequent warranty period and Service Maintenance Agreements (SMA), the vendor shall, after the award of an ATO, ensure that the vendor’s device or system maintains its ATO for as long as the equipment is operated by Government.

7.1.10. The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

7.1.11. The vendor shall notify the Information Owner and Contracting Officer POCs in writing with any inabilities to comply with DoD security requirements. Vendor will provide anticipated costs and timelines required to address vulnerabilities in question.

7.1.12. The vendor shall contact the IA/RMF Office Representative, no later than 5 days after delivery order selection or contract award, to start the process. Failure to do so would be considered a vendor caused delay.

7.2. RMF Timeframes.

The following table provides an overview of the entire Process to obtain approval under Army Cybersecurity requirements. Vendor actions must start as cited in the number of days after date of order column noted below and be completed in the number of days listed below in the Duration column.

ID Step Name (Action or Deliverable)

Duration (Days) Number of Days After Date of Award

Responsible Party

1 1. Categorization 22 Total Days

1.1 Vendor RMF Kickoff Meeting

(Vendor must contact the RMF Office Rep) 1 5 GOVERNMENT

1.2 EDMS Paperwork and Account

Creation 10 5 GOVERNMENT

4 1.3 EDMS Functionality Briefing 1 5 GOVERNMENT

1.4 Documentation Templates to

Vendor 1 1 GOVERNMENT

1.5 Hardware/Software Document

Production 5 5 VENDOR

7 1.6 STIG Review 2 10 GOVERNMENT

8 1.7 System Catergorization 2 12 GOVERNMENT

9 1.8 Categorization Memo Approval 5 17 GOVERNMENT

1.9 Security Assessment Plan

Creation 3 12 GOVERNMENT

11 1.10 SAP Sent to Vendor 0 15 GOVERNMENT

12 1.11 Contact 3rd Party IV & V 0 15 GOVERNMENT

13 2. Control Selection 6 Total Days

14 2.1 System eMASS Registration 1 12 GOVERNMENT

15 2.2 eMASS Control Selection 1 12 GOVERNMENT

16 2.3 Implementation Plan Completion 5 17 GOVERNMENT

17 3. Implementation 130 Total Days

3.1 Documentation Creation and

Review GOVERNMENT

3.1.1 Vendor Control and Artifact

Documentation 90 5 VENDOR

20 3.1.2 PMO Control Documentation 55 40 GOVERNMENT

3.1.3 Documentation 100%

Complete (Confirm iV and V) 0 95

GOVERNMENT

22 3.2 Scanning 120 16 VENDOR

23 3.2.1 Vendor Initial Scan 10 16 VENDOR

3.2.2 ICS Review of Scans and

Vulnerability Report 2 26 GOVERNMENT

25 3.2.3 Vendor Technical Remediation 110 27 VENDOR

26 3.3 DHA Registration 60 77 GOVERNMENT

27 3.3.1 DHA A&A Request 1 77 GOVERNMENT

3.3.2 Submit Security Plan for

Approval 10 77 GOVERNMENT

3.4 Submission to IV and V Team;

Submit IV and V Request Through Portal 0 137 GOVERNMENT

30 4. Assess 65 Total Days

31 4.1 Packet Review by IV and V Team 29 138 GOVERNMENT

32 4.2 Coordination Meeting 0 165 GOVERNMENT

33 4.3 Onsite I&V 5 168 GOVERNMENT

34 4.4 SCA-V Packet Review 30 173 GOVERNMENT

35 4.5 SCA-V SAR Issuance 0 203 GOVERNMENT

36 5. Packet Authorization 60 Total Days

37 5.1 Vendor Remediation 30 173 VENDOR

38 5.1.1 SAR Review/ Concurrence 10 203 GOVERNMENT

39 5.2 Submit to SCAR 10 213 GOVERNMENT

40 5.3 Submit to SCA 5 223 GOVERNMENT

41 5.4 Submit to AO 5 228 GOVERNMENT

42 5.5 AO Signature 0 233 GOVERNMENT

7.3. Assessment and Authorization (A&A).

7.3.1. The vendor shall submit all RMF required documentation, as specified by Government Reps for review and approval, no later than four (4) months after request by the Government.

7.3.2. The vendor shall obtain approval from the Government, any vendor developed policies, plans, and procedures prior to implementation.

7.3.3. The vendor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of request by the Government.

7.3.4. The vendor shall provide technical scans within one (1) month of the A&A kickoff meeting.

7.3.5. The vendor shall provide updated technical scans monthly, on the 10th day of each month until an ATO is granted.

7.3.6. The vendor shall ensure that the vendor device or system can support the use of DISA approved intrusion detection and prevention, antivirus, and antimalware applications. The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. DLP, IPS, Antivirus, etc.) without performance degradation of the medical system/device.

In cases where the operation of security applications is not technically achievable, the vendor shall provide detailed justification and a Plan of Actions and Milestones (POA&M) describing steps towards compliance with this requirement.

7.3.7. The vendor shall ensure that the vendor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

7.4. Privileged User Training and Certification Requirements. If a vendor requires a B2B, access, etc. to government networks to maintain, analyze, etc. their products, they must adhere to the following requirements:

7.4.1. Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army network will meet Army requirements for a privileged-level account before being granted a network account. Requirements include:

7.4.2. Cyber (Information assurance (IA)/information technology (IT)) certification. Per DoD 8570.01-M , DFARS

252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT – II) and be required to meet minimum Professional Baseline certifications at the time of contract award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract is met.

7.4.3. Background Investigation. NACI or above is required. Vendors should email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain guidance on the process.

7.4.4. Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (GSCL, CISM, CISSP, etc.) will satisfy this requirement.

7.4.5. Computer Environment (CE) Certification. Computer Environment (CE) certifications are determined by the role of the contractor and must be met within six months of delivery order issuance. Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a professional certification that coincides with the technology inherent in the system (i.e.

MCSE, CCNA, RHCSE, Microsoft Windows 7 and Windows 10 etc.). The CompTIA A+ certification will also satisfy the CE certification requirement.

7.4.6. IA Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/ Contractors will meet minimum training requirements within six months of contract award.

7.4.7. Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The preferred method for authenticating is the Common Access Card (CAC).

7.4.8. Army Training Certification Tracking System (ATCTS). Contractors with a need for elevated privileged-level access will be defined to ATCTS. https://atc.us.army.mil/iastar/regulations.php.

7.4.9. BMACH Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the ITC One-Stop Shop for contractors requiring on-site access or through the Information Assurance/Cyber Security Branch for contractors requiring remote access to BMACH network. Remote access must be through a Defense Health Agency (DHA) Business-To-Business (B2B) solution. Vendors should email:

usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain remote access through DHA, for Army requirements. The package includes DD Form 2875 – System Authorization Access Request (SAAR). All contractors requiring a BMACH network account will complete the DD Form 2875 to include validation of a Security Background Investigation. Information Assurance Branch will be the sponsor for all contractors requiring elevated privileged-level access. The department chief will sign the DD2875 as the contractor supervisor. Note: contractors requiring a ‘Privileged’ account will check ‘Box 14.’ on the form. The DD2875 SAAR Form is available at the following website:

https://atc.us.army.mil/iastar/docs/DD_Form_2875_System_Access_Agreement_Request.pdf.

7.4.10. Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the Army Standard Acceptable Use Policy (AUP) prior to being granted a Army network account. The Army Standard AUP is available at the following website: https://atc.us.army.mil/iastar/docs/aup.pdf

7.5. Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity Requirements.

7.5.1. Continuous Risk Management

(a). The vendor shall maintain a duplicate of the fielded device, system, or group of configurations falling under one authorization; for testing in a vendor supplied lab environment at vendor location for as long as the system is operated by the Government.

(b). The vendor shall maintain the duplicate system or device in operational condition with the latest security patches installed.

7.5.2. The vendor shall update all ATO required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system.

7.5.3. The vendor shall maintain the authorized security configuration and notify the government within forty-eight

(48) hours of any major changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO. Vendor shall support reauthorizations due to major upgrades.

7.5.4. The vendor shall ensure the vendor’s device or system follows the Department of Defense (DoD) Information Assurance Vulnerability Management (IAVM) program upon each deployment.

7.5.5. The vendor shall ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a lab environment.

7.5.6. The vendor shall make the duplicate device or system available for periodic security reviews, within forty-five

(45) business days of notification by Government. The vendor shall perform monthly vulnerability scans using the most recent and updated version of approved DoD scan tools.

7.5.7. Vendor shall maintain system and update to comply with updated STIGS as made available by the Government within three (3) months of notification by the Government.

7.5.8. The vendor shall provide vulnerability scan and SCAP scan results to Government monthly. Vendor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month.

7.5.9. The vendor shall close all discovered vulnerabilities within three (3) months of discovery.

7.5.10. The vendor shall submit to Government detailed explanations for the inability to close discovered vulnerabilities.

7.5.11. The vendor shall submit to Government for approval of any mitigation that addresses any open vulnerabilities.

7.5.12. The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to Government for approval.

7.5.13. The vendor shall use the Government approved method for remote access administration (DISA B2B) of system or device.

7.6. Cybersecurity Regulations and Guidance. The vendor shall use and comply with the most recent published versions as of the date of contractual agreement of the following references as well as all regulations or guidance referenced within those publications:

7.6.1. United States Law

i. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

ii. The Federal Information Security Management Act (FISMA)

iii. The E-Government Act of 2002

7.6.2. Office of Management and Budget (OMB)

i. The following publications are located at https://www.whitehouse.gov/omb/agency/default

ii. Circular A-130

iii. Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors

7.6.3. National Institute of Standards and Technology (NIST)

i. The following publications are located at http://www.nist.gov/publication-portal.cfm

ii. NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems

iii. NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

7.6.4. Federal Information Processing Standards (FIPS)

i. The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm

ii. FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

iii. FIPS PUB 199 – Standards for Security Categorization of Federal Information and Information Systems

iv. FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

7.6.5. Department of Defense (DoD)

i. The following publications are located at http://www.dtic.mil/whs/directives/

ii. DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

iii. DoD Instruction 8500.1, Cybersecurity

iv. DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

v. DoD Instruction 8510.01, Risk Management Framework Process (RMF)

vi. DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

vii. DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

viii. DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs

ix. DoD Directive 5400.11, DoD Privacy Program

x. DoD Manual 5400.11-R, Department of Defense Privacy Program

7.7. SECURITY CLEARANCES.

7.7.1. Personnel to be assigned to an ADP/IT position must undergo a successful security screening before being provided access to DoD information technology resources. Prior to an employee being granted interim access to DoD sensitive information, Martin Army Community Hospital must receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement must be met by contractors, subcontractors and other who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under HIPAA. Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees must have at a minimum an ADP Sensitivity Designation of Level II to access the DoD Network.

7.7.2. All contractors that use the DoD gateways to access government systems must submit a DISA Form 41 or equivalent in accordance with Contracting Officer guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface. Contractors shall complete and submit to TMA one Form 41 for their organization, attached to which shall be a listing of those individuals for whom background checks have been completed, submitted to the Office of Personnel Management (OPM), and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request must clearly delineate the ports and protocols used for each IP address. The contractor shall complete the form and submit to the government for final processing. All costs for the background investigations are the responsibility of the contractor.

8. BUSINESS to BUSINESS (B2B) REQUIREMENTS for CONTRACTOR.

8.1. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

8.2. Personnel Security.

8.2.1. The contractor shall comply with DoD Directive 8500.1, “Information Assurance (IA),” DoD Instruction 8500.2, “Information Assurance (IA) Implementation,” DoD Directive 5400.11, “DoD Privacy Program,” DoD 6025.18-R, “DoD Health Information Privacy Regulation,” DoD 5200.2-R, “Personnel Security Program Requirements.” AR25-1, “Army Knowledge Management and Information Technology”, AR 25-2 “Information Assurance.” And local regulations as deemed appropriate by the activity Information Assurance personnel.

8.2.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

(a). Follow the Army guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

(b). Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility LAN.

(c). Immediately report to the Martin Army Community Hospital Personnel Security Manager Travis Butler at 762-408- 0308 and deny access to any automated information system (AIS), network, or information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate government representative for any reason.

8.3. Electronic Security.

8.3.1. Disposing of Electronic Media. Vendors shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Vendors are required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

8.3.2. Information Assurance Vulnerability Management (IAVM). The contractor shall implement an information assurance vulnerability management program for all AIS and corresponding subnets that are connected to or intermittently connect to Army networks. The program shall meet the scope and intent of AR25-2 and Martin Army Community Hospital IA policies to provide protection against known threats and vulnerabilities. Compliance with Army IAVM alerts and bulleting is required for these systems and shall be completed within the specified timeframe.

8.4. Information Systems (IS)/Networks Physical Security.

8.4.1. The contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the contractor will support a Physical Security Audit performed by the Government of the contractor's internal information management infrastructure. The MHS Physical Security Audit Matrix is available at:

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls. The contractor shall correct any deficiencies identified by the Government of the contractor's physical security posture.

8.4.2. Special Requirements for Protected Health Information. Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the contractors must notify the Martin Army Community Hospital HIPAA Security Manager, Ms. Beverly Simmons at 762- 408-0032.

8.4.3. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

9. Anti-Terrorism and Operations Security Contract Requirements.

9.1. Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated sub-contractor’s employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

9.2. For contractors that do not require CAC but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

END OF STATEMENT OF WORK

SUPPLEMENT TO THE STATEMENT OF WORK

1. GOVERNMENT HOLIDAYS

The following Government Holidays are observed:

New Year’s Day Martin Luther King Jr.’s Birthday President’s Day Memorial Day Juneteenth Day Independence Day Labor Day Columbus Day Veteran’s Day Thanksgiving Day Christmas Day

Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. If the area in which a contractor is scheduled to perform maintenance is closed due to a holiday declared by an Executive Order and the contractor is not required to report in, contractor shall service equipment on the available day staff will be present. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

2. Invoicing and Payment

The contractor shall submit monthly, in arrears, itemized invoices in accordance with DFARS 252.232-7003 & 252.232- 7006, for services rendered under this contract. Information regarding Wide Area Workflow is available on the Internet at https://piee.eb.mil

3. TOBACCO FREE MEDICAL CAMPUS (TFMC)

The Contractor shall ensure that all contract personnel comply with the U.S. Army Medical Command and MTF smoking policies while performing services under this contract. Smoking restrictions will apply at any location or building where health care activities are performed under this contract.

In accordance with Army Regulation 600-63, paragraph 7-3, 14 April 2015; Operations Order 15-48 (Army Medical Command (MEDCOM) Tobacco Free Living – USAMEDCOM), 8 May 2015; and any Operations Order, regulation or other instruction implementing, defining or otherwise addressing the Tobacco Free Medical Campus (TFMC) on any military installation or DoD-controlled location, Contractor personnel are prohibited from using any tobacco product on or within any TFMC while performing under this contract. TFMCs are established at each installation or DoD-controlled location and include: (1) any property or non-residential building that is operated, maintained or assigned to support medical activities, including but not limited to, hospitals, medical laboratories, outpatient clinics (including medical, dental, and veterinary facilities), or aid stations operating for the primary purpose of delivering medical care and services for DOD eligible beneficiaries and /or meeting the mission of the Army Medical Command; (2) all other facilities in which medical activities or administration take place, to include HQ MEDCOM and Defense Health Headquarters; (3) all internal roadways, sidewalks and parking lots; and (4) all sidewalks, parking lots and grounds external but adjacent to the building or related to the migratory corridors surrounding the medical facility. The contractor shall obtain from the COR any orders, regulations, instructions or other documents implementing, defining or otherwise addressing the TFMC for any given installation or DoD-controlled location where contractor personnel may perform under this contract and shall instruct contractor personnel on the TFMC limitations for installations or DoD-controlled locations where they may perform under this contract.

4. EXCLUSION FROM PARTICIPATION IN FEDERAL HEALTH CARE PROGRAM Exclusion from Participation in Federal Health Care Programs (October 2015)

a. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as “person”) to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at h ttp://oig.hhs.gov/fraud/exclusions.asp, and the TRICARE Sanctioned Provider list at h ttp://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of- H ealthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as “the Lists.”

b. Prior to start of contract performance, the Contractor shall (a) query the Lists to determine whether the name of any person the Contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the Contracting Officer that the Contractor has queried the Lists and no such names appear on either of the Lists.

c. During performance of the contract, and prior to persons other than those whose names were queried in accordance with paragraph 2, above, (hereinafter “new persons”) providing services or items under the contract, the Contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the Contracting Officer that the names of such new persons do not appear on either of the Lists.

d. The Contractor is advised that during performance of the contract, MTF personnel will perform a recurrent recheck of the names of contractor personnel working in the MTF against the Lists, as specified in OTSG/MEDCOM Policy Memo 15-037. The Government will notify the Contractor in the event any contractor personnel working in the MTF appear on either of the Lists.

e. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall (a) in cases where the Contractor identified the person, notify the Contracting Officer, and (b) promptly remove that person from the contract.

f. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

g. The Contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42 USC § 1320a- 7a): There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at h ttp://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

5. Reserved

6. Personally Identifiable Information, Protected Health Information, and Federal Information Requirements (Revised 10/27/2020)

General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

1. DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S.

Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2. Records Management When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B

– Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA) The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION:

Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. Systems of Records In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

5. Privacy Impact Assessment (PIA) If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

6. Data Sharing Agreement (DSA)

6.1 (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data)

The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office.

Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

DSA for De-Identified Data DSA for PHI DSA for PII Without PHI DUA for Limited Data Set

DSAs executed for contract support will…