PIAS_-_ADC_-_PWS_-.docx

PERFORMANCE WORK STATEMENT (PWS)

FOR

Pharmacy Inpatient Automation Solution - Automated Dispensing Cabinet

(PIAS - ADC)

PERFORMANCE-BASED WORK STATEMENT

TABLE OF CONTENTS

DESCRIPTION OF SERVICES

The Contractor shall provide a comprehensive Pharmacy Inpatient Automation Solution (PIAS) - Automated Dispensing Cabinets (ADCs) for Department of Defense (DOD) Military Treatment Facility (MTF) pharmacies, clinics, inpatient wards, etc. The Contractor shall provide PIAS - ADC capabilities including, but not limited to storage, administration, interfacing, reporting, data analysis, support, training, and maintenance.

PERIOD OF PERFORMANCE

The period of performance shall be one 12-month Base Period and four 12- month Option Periods. The Periods of Performance read as follows:

· Base Period: Date of award through 12 months

· Option Period I: End of Base Period through 12 months

· Option Period II: End of Option Period I through 12 months

· Option Period III: End of Option Period II through 12 months

· Option Period IV: End of Option Period III through 12 months

SPECIFIC REQUIREMENTS

The Contractor shall comply and meet the specific PIAS - ADC requirements defined in this Section.

Functional Requirements

0. The solution shall be able to store and dispense controlled and non-controlled medications and products in various packaging forms, sizes, and types, including but not limited to the following:

· Ampules

· Bags (e.g. intravenous (IV) bags, TPN bags, IV piggyback, Ready-To-Use IV bags, premixed IV bags)

· Bottled medications (e.g. oral liquids, spray, canister, droppers)

· Box (e.g. dose packs, inhalers, cream, ointment)

· Refrigerated medications

· Syringes up to 60ml (e.g. oral syringes, intravenous (IV) syringe)

· Unit dose packaged medications (e.g. blister packs, liquid cups)

· Vials (e.g. single-dose, multi-dose) The solution shall be configurable to support different equipment in clinical settings, including but not limited to clinics, inpatient wards, pharmacies, or other ambulatory services.

The solution shall be configurable to support local sites’ capacity needs (i.e. minimum storage capacity per equipment in clinical settings of 120 line items and configurable up to 300+ line items).

The solution shall be configurable by local sites to allow separate equipment in clinical settings to share common stocks (e.g. floor stock from Ward 3A can be used (dispensed) by users from Ward 3B).

The solution shall display and utilize equipment in clinical settings specific patient list and a global patient list for medication administration.

The solution shall alert the user whenever a product is not available (e.g. temporarily out of stock) and direct the user to nearby equipment in clinical settings with available stock.

The solution shall allow physical access to the medications, via manual lock and key, during power failure and outages.

The equipment in clinical settings shall be configurable to operate as a stand-alone or interconnected environment (e.g. main unit only or main unit attached to auxiliary cabinets).

The solution shall allow for the electronic issuance and receipt of controlled medications between different equipment located in separate equipment in clinical settings.

The solution shall be capable of transaction continuity by allowing users to start transactions on equipment in one clinical setting and allow completion of that transaction on equipment in a different clinical setting (e.g. start transaction on equipment located in Ward 3A and complete transaction on equipment located in Ward 3B).

The solution shall be configurable by local sites to automatically log users out of the system (e.g. the session times out after three minutes of inactivity).

The solution shall be configurable by local sites to provide temporary access (e.g. user name/password) for on-call or floating users.

The solution shall be configurable by local sites to prompt users to verify the inventory during transactions (e.g. loading, refilling, dispensing).

The solution shall be configurable by local sites to suspend user credentials due to system access inactivity (e.g. user has not logged-in within the 30 days).

The solution shall allow authorized users to perform system activity functions remotely and locally.

The solution shall support the importing of external configuration data (e.g. drug files, user database, formulary data, equipment in clinical settings) from an external source file (e.g. database, spreadsheet, text file).

The solution shall be configurable by local sites per medication to require verification via second authorized user during transactions.

The solution shall be configurable by local sites per user role access to require a second authorized user during transactions.

The solution shall be configurable by local sites to require review of all medication orders by a pharmacist prior to dispensing.

The solution shall utilize industry standards including but not limited to barcoding (1D and 2D) and Radio Frequency Identification (RFID) technologies for transactions.

The solution shall be configurable by local sites to prevent dispensing of medications due to predetermined conditions (e.g. expired medication, incorrectly stocked, user access level).

The solution shall allow authorized users to monitor and perform administrative functionalities including but not limited to:

· assigning and managing of medications to specific location within a equipment in clinical settings (e.g. main cabinet or auxiliary cabinet, modify par level, and inventory)

· reset/restart of equipment in clinical settings

· manage database (e.g. users, formulary, drug files) The solution shall be capable of accurately crediting and debiting the inventory during user transactions (e.g. dispensing, returning, wasting, refilling).

The solution shall provide unique qualifiers within drug properties configurable by local sites to include but not limited to high alert, locally controlled, sound-a-like/ look-a-like, override medications.

The solution shall be configurable by local sites to print patient specific medication labels (e.g. IVs, cream/ointment, eye drops, syringes, unit dose).

The solution shall be capable of automatic documentation of transactions, including but not limited to date, time, drug, patient, dose, quantity, username, witness information (when applicable), user IDs.

The solution shall display operational status of locally deployed network connected equipment in clinical settings equipment.

The solution shall be capable of presenting a list of medications due for administration for the selected patient.

The solution shall be configurable by the local site to withhold medications that are not due for administration based on site defined time-frame.

The solution shall serially dispense medications (e.g. allow users to withdraw one medication at a time).

The solution shall be capable of cross-referencing when performing medication searches within the system (e.g. user search using brand name, the solution displays the generic name for reference).

The solution shall be configurable by local sites to allow the return of unused and sealed controlled medication(s) to a secured integrated bin.

The solution shall allow users to suspend or cancel an in-progress transaction.

The solution shall be configurable by local sites to define and assign user roles and access to the equipment in clinical settings equipment.

The solution shall be capable of using and displaying multiple unique patient identifiers (e.g. patient name, DOD ID, date of birth).

Interface Requirements The PIAS - ADC shall support interface connections to external systems. The PIAS - ADC Contractor shall maintain and update the Interface Control Document (ICD) for all of the connections with the PIAS – ADC.

Composite Health Care System / PIAS - ADC Interface The Composite Health Care System (CHCS) is a medical/pharmacy information system that automates and integrates clinical and demographic data and facilitates access to and delivery of, health care services from a military medical/pharmacy or dental treatment facility (MTF). There are currently 101 hosts running the CHCS software in support of MTF’s worldwide. Each CHCS host may support multiple MTF pharmacies. There are approximately 550 MTF pharmacies.

The PIAS - ADC Contractor shall implement, maintain, and update an interface between PIAS - ADC and each CHCS host. The CHCS supports industry standards (Health Level 7/ HL7).

Defense Medical Logistics Standard Support (DMLSS) / PIAS - ADC Interface The Defense Medical Logistics Standard Support (DMLSS) is an information technology system within the Defense Medical Logistics – Enterprise Solution (DML-ES) portfolio. The DML-ES portfolio provides a continuum of medical logistics support for the Defense Health Agency. DMLSS delivers an automated and integrated information system with a comprehensive range of medical materiel, equipment, war reserve materiel and facilities management functions. DMLSS allows customers to select and order medical supplies for the best value, implement just-in-time logistics, eliminating large stocks of inventory, which assists hospitals and clinics manage facilities and maintain medical equipment.

The PIAS - ADC Contractor shall implement, maintain and update an interface between PIAS - ADC and DMLSS system.

Defense Healthcare Management System Modernization (DHMSM) Electronic Health Record / PIAS – ADC Interface The Defense Healthcare Management System Modernization (DHMSM) Electronic Health Record (EHR) is a commercial off-the-shelf system that consists of an inpatient, outpatient, and dental solution currently being designed to be deployed across the Department of Defense (DOD) enterprise. The DHMSM EHR will replace functionality of core legacy systems (AHLTA, CHCS, and Essentris, among others), and will be deployed to both fixed medical treatment facilities and operational medicine facilities all over the world. The DHMSM EHR will communicate via existing DOD IT Networks as well as DHA infrastructure to support the solution. The Medical Community of Interest (Med-COI) network provides this infrastructure backbone and supports the legacy EHR capability as well as the new DHMSM EHR. In addition to network infrastructure, the DHMSM EHR solution will have a hosting infrastructure in which to deploy the solution, store data generated by the system, and provide any server-side application processing.

The PIAS - ADC Contractor shall implement, maintain, and update an interface between PIAS - ADC and DHMSM EHR system.

B2B / MTF Support The Contractor shall complete all task related to the documentation and implementation of Business-to-Business (B2B) Gateway telecommunications links. Tasks include:

· Coordination among the POD, MTFs, and other contractors as required.

· Completion of all B2B required documentation

· Virtual Private Network (VPN) or related equipment procurement and configuration

· Initiation and completion of all testing and implementation activities Contingency Operations The solution shall maintain transaction data upon loss of network connectivity.

The solution shall automatically reconcile transaction data upon reestablishment of network connectivity.

The solution shall back-up and restore transaction data per site based on Government defined time frame (e.g. 30 days, 45 days, or 60 days).

The solution shall be capable of rebuilding damage/lost files during data recovery process using database back-up data.

The solution shall be configurable by local sites to setup the parameters for incremental database back-up data.

The solution shall store, archive, and readily retrieve historical data for a minimum of five years.

Reporting and Data Analysis Tool Requirements The solution shall be configurable by local sites to connect to a network printer (e.g. inkjet, laser, thermal) for printing reports (e.g. user report, inventory, system reports).

The solution shall maintain logs, including but not limited to activity logs, issue logs, technical logs.

The solution shall be configurable by local sites to generate scheduled pre-determined and ADHOC reports. The pre-determined reports shall include, but not limited to the following:

User activity reports (e.g. load, refill, unload, remove, return, waste, override, log-in attempts) Inventory reports (e.g. load list, refill list, expired list, inventory list) System reports (e.g. user database, formulary, data dictionary, data schema, maintenance report, failed drawer/pocket, system status) The solution shall be configurable by local sites to export reports into multiple file formats (e.g. database, spreadsheet, text file).

The solution shall allow a third party reporting tool (e.g. Business Objects) and analytical tools (e.g. Statistical Analysis Software (SAS, Tableau, OpenRefine) using, but not limited, Structured Query Language (SQL) to access the data to create customizable reports.

The solution shall be capable of providing descriptive statistical analysis reports including, but not limited to average usage, frequency distribution, standard deviation The solution shall be capable of creating visual representation of descriptive statistical analysis reports including, but not limited to histograms, bar charts, frequency tables.

The solution shall be capable of generating reports in real-time without negatively affecting system performance.

The solution shall be capable of automatically using archived data for reporting purposes.

Support Requirements The Contractor shall provide diagnostic and repair services, as well as preventive maintenance via onsite or remote support (e.g. telephone, B2B, email).

The Contractor shall document a Service Event Report (SER) with the following information about each service event.

· Name of Contractor;

· Contract Number;

· Name of Field Service Technician performing service;

· Contractor log/Control # (i.e. Work Order #);

· Date, time (beginning and ending), and hours on-site for service call;

· Description of problem reported by user;

· Equipment identification factors to include: original and replacement

· Equipment

· Manufacturer

· Model

· Serial number

· Local Equipment Control Number (ECN);

· Description of problem identified by the Contractor;

· Description of services and tests performed, parts used, corrective action taken;

· Problem resolution or pending actions; and Names;

· Field Service Technician Signature – performing services; and

· Authorized MTF personnel or department (e.g. Biomed Department)

· Representative Signature – verifying service rendered.

The Contractor shall provide SERs (PWS Section 1.2.6.2) to authorized local site personnel upon completion of each service event.

The Contractor shall physically check-in and check-out with the authorized local site personnel.

The Contractor shall maintain a Hot Swappable List (HSL) (Deliverable 10) of furnished/forward staged replacement parts required for all repairs performed by Contractor trained authorized local site personnel.

Training Requirements Training Plan The Contractor shall plan and conduct formal training for all levels of users (e.g. system administrators, pharmacy, nursing).

The Contractor shall develop a training program to specify training approaches, methods, schedules, tools, and curricula (Deliverable 11).

The Contractor shall train authorized local site personnel to perform minor maintenance and repair services including but not limited to

· Drawer recoveries

· Light bulb replacement

· Button bar replacement

· Drawer solenoid replacement

· Bio-ID reset/replacement

· Shelf reconfigurations

· Keyboard replacement

· CPU fan replacement

· Ribbon cable replacement The Contractor shall allow authorized local site personnel to order HSL parts (PWS Section 1.2.6.5), and create and manage service events via the customer portal (PWS Section 1.2.8).

Training materials The Contractor shall develop mutually agreed upon training materials (Deliverable 12), to include course objectives, teacher guides, student guides, course materials, training manuals, distance learning tools, and computer- based tools. The Contractor shall deliver training materials in reproducible electronic format (i.e. Adobe Acrobat, Standard Microsoft Office Product Suite).

The MHS will make available to local site users the training and implementation materials to include user guides and answers to frequently asked questions (FAQs) via public-facing and/or internal DoD hosted websites.

Training Presentation The Contractor shall plan, schedule, and conduct mutually agreed upon training programs to the MTF staff during initial implementation as well as provide an ongoing training program. The Contractor shall work with the Government on the appropriate means of training. The training shall include at a minimum, ongoing training on a quarterly basis via Defense Collaboration Services (DCS) using a train-the-trainer or training students approach. Following completion of the training, the Contractor shall document lessons learned in the next monthly status report (Deliverable 2) and modify the training plan (Deliverable 11) and resources as appropriate.

Customer Portal The Contractor shall provide a Customer Portal that allows authorized personnel to access, at minimum, dashboards to include deployed equipment, connectivity/availability status, performance metrics, number of open service events selectable by category and timeframe, and training materials (PWS Section 1.2.7.2) as well as current status on installation project management and/or other system capabilities offered by the contractor.

Maintenance Requirements The Contractor shall coordinate on-site maintenance visits with authorized local site personnel (e.g. Medical Repair customer service desk, Pharmacy department).

The Contractor shall provide authorized local site personnel an initial assessment of the operational condition of the solution upon arrival for maintenance.

The Contractor shall provide a SER (PWS Section 1.2.6.2) at the conclusion of the each maintenance visit.

The Contractor shall affix a maintenance sticker to each piece of equipment upon completion, which includes the date and name of the technician.

The Contractor shall immediately notify the onsite authorized personnel for local support if the Contractor is unable to locate an item within the maintenance window specified and shall escalate to the COR when the authorized personnel are unavailable or unresponsive.

The Contractor shall provide maintenance and repair visits that include preventive and corrective maintenance, inspections, replacement of defective and worn parts, and testing services in accordance with Contractor Original Equipment Manufacturer (OEM) specifications.

The Contractor shall be specifically excluded from coverage related to external causes (e.g. abuse, misuse, vandalism, unauthorized repairs), environmental hazards such as fires, floods, acts of nature (earthquakes, hurricanes, tornados), unregulated power, gas/atmosphere contamination, and physical damage that is not in the normal course of instrument operation.

The Contractor shall perform all preparations to necessitate hardware replacement, including packing and transportation of the asset at no additional cost to the government.

The Contractor shall only use OEM-approved replacement parts for maintenance and repairs.

Quality Control Requirements The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is the means to ensure that work complies with the requirement of the contract.

The Contractor shall prepare and adhere to a Quality Control Plan (QCP) (Deliverable 1). The QCP shall document how the Contractor will meet and comply with the quality standards established in this statement of work. At a minimum, the QCP must include a self-inspection plan, an internal staffing plan, and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, customer satisfaction, and any other requirements set forth in this solicitation.

Quality Assurance Surveillance The government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP) (PWS Attachment 2). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards throughout the contract term. It defines how the performance standards (PWS Section 3) will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

The Government will review monthly performance and progress reports and will attend regular performance review meetings with the Contractor to survey quality of products and services.

Further, the QASP provides the Contacting Officers Representative (COR) with a proactive way to avoid unacceptable or deficient performance, and provides verifiable input for the required Past Performance Information Assessments. The QASP will be finalized immediately following award and a copy provided to the Contractor after award. The QASP is a living document and may be updated by the Government as necessary.

Monthly Status Report (MSR) The Contractor shall prepare and deliver a Monthly Status Report (Deliverable 2), in accordance with a mutually agreed upon format between the Government and the Contractor.

The MSR should outline deliverables submitted with problems encountered, and schedule deviations to include but not limited to helpdesk support logs, monthly system availability report, SER (PWS Section 1.2.6.2) and maintenance report (PWS Section 1.2.9.3). The MSR shall measure the Contractor’s schedule performance as mutually agreed upon by the Government and the Contractor.

The Contractor shall perform root cause analysis for issues and repairs involving hardware, software, or procedural problems that causes substantial operational difficulty, and prevents a system from dispensing medications, causing system downtime to include remote connectivity.

Progress Meetings The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contractor shall also plan and conduct regular, routine meetings (via teleconference) with frequency not less than quarterly with the Government to review progress and status of activities under this contract. Each review shall provide insight into staffing, progress, risks, and status (when applicable) of Government Furnished Equipment (GFE), including Contractor acquired, Government owned property (CAP). The Contractor shall provide project briefings addressing, schedule, performance, and status of this contract, noting any problems or risks and alternative and recommended solutions. These meetings shall be at no additional cost to the government. The Contractor shall ensure that meeting agendas (Deliverable 3) and meeting materials (Deliverable 4) are provided to Government participants prior to the meeting and that data presented at program reviews is current within not more than ten (10) days.

Key Personnel The following Contractor personnel are considered key personnel by the government: Project Manager and Information System Security Officer.

Project Manager The Contractor shall provide a Project Manager who shall be responsible for daily operations to include performance of work. The name of this person who shall act for the Contractor shall be designated in writing to the Contracting Officer. The Project Manager shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The Project Manager shall have the following experience:

· Progressive experience (minimum 10 years) in Program Management of Information Technology (IT) projects requiring integration, implementation, and training

· Experience in schedule management, quality assurance, and cost management accounting

· Project Management Professional (PMP) Certification preferred

· Bachelor's Degree (BA or BS) required Information System Security Officer The Contractor shall provide an Information System Security Officer (ISSO) who shall be responsible for the Information Assurance and Cybersecurity program for the PIAS - ADC. The name of this person who shall act for the Contractor shall be designated in writing to the Contracting Officer. The ISSO shall have full authority to act for the Contractor on all cybersecurity matters relating to this contract. The ISSO shall have the following experience:

· Experience with DoD cybersecurity policies, procedures, and regulations

· Experience (minimum 5 years) in the DoD Certification and Accreditation (C&A) process

· Nationally recognized cyber security certification required (e.g. CISSP, CISA, etc.)

· Bachelor’s Degree (BA or BS) required Substitution of Key Personnel The Contractor shall provide complete resumes for proposed substitutes of Key Personnel and any additional information requested by the Contracting Officer. Proposed substitutes should have comparable qualifications to those of the persons being replaced and be assigned to the PIAS - ADC a minimum of 90 days. The Contracting Officer will notify the Contractor within 15 days after receipt of all required information of the consent on substitutes. No change in fixed unit prices may occur as a result of Key Personnel substitution.

Incoming Transition In accordance with this contract, the Contractor shall provide a draft plan for 365 calendar day’s incoming transition from contract to contract. The Contractor shall coordinate with the Government in planning and implementing a complete transition to the Contractor's support model. The Contractor shall collaborate with the Government to develop and deliver an Incoming Transition Plan (Deliverable 5). The Government will designate a transition period for the incoming Contractor to coordinate and work with the incumbent Contractor. This transition plan shall include, but is not limited to:

· Coordination with Government representatives

· Review, evaluation and transition of current support services

· Government-approved training and certification process

· Orientation phase and program to introduce Government personnel, programs, and users to the contractor’s team, tools, methodologies, and business processes

· When applicable, Transfer of Government Furnished Equipment (GFE) and Government Furnished Information (GFI), and GFE inventory management assistance management assistance. When applicable, coordinate with the Government to account for government keys, identification (ID) / access cards, and security code.

Solution Deployment The Contractor shall coordinate with the designated COR and other Government representatives to plan and schedule solution deployments. This shall include development of detailed, integrated deployment schedules (Deliverable 6). Schedules shall identify all elements of the planning, preparation, shipping, installation, integration, checkout, and operational capability to include post deployment evaluation and modification.

Site Surveys / Information Collection The Contractor shall coordinate with the designated COR and other Government representatives to plan and schedule site surveys / information collection to support the configuration and deployment of solution materials, (e.g. equipment, software, and systems) to the designated sites. The Contractor shall compare existing site capabilities (e.g. server rack size, wired or wireless capability, floor space) and features with site requirements for system, software, and equipment. The Contractor shall compile a list of site modifications/additions required to support (Deliverable 7).

Shipment, Receipt and Installation The Contractor shall coordinate with designated commercial and Government shipping organizations to plan the shipment of materials and equipment to designated deployment sites. The Contractor shall use industry best practices to ensure the most efficient and effective shipping means are utilized. This shall include ensuring appropriate packaging and packing, providing for necessary insurance, ensuring ability to track shipments, and coordinating to accommodate international customs processing. The Contractor shall receive, unpack, dispose of packing materials, configure, setup, and ensure the system is functioning properly to comply with planned and approved configurations.

Outgoing Transition In accordance with this contract, the Contractor shall provide a plan (Deliverable 8) for 270 days outgoing transition for transitioning work from an active contract to a follow-on contract or Government entity. This transition may be to a Government entity, another Contractor or to the incumbent Contractor under a new contract. In accordance with the Government-approved plan, the Contractor shall assist the Government in planning and implementing a complete transition from this Contract issued under this Contract to a successful provider. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of copies of existing policies and procedures, and delivery of required metrics and statistics. This transition plan shall include, but is not limited to:

· Coordination with Government representatives

· Review, evaluation and transition of current support services

· Furnished Information (GFI), and GFE inventory management assistance

· Turn-in of all government keys, ID / access cards, and security codes Contract Management Plan The Contractor shall develop a Contract Management Plan (Deliverable 9) to manage, track and evaluate the project or task performance. The Contract Management Plan shall consist of control policies and procedures in accordance with standard industry practices for project administration, execution, and tracking. The Contract Management Plan shall include the following:

· Identification of milestones where Government information, activity, equipment, material, facilities, etc. is required and timeline dependencies or prerequisites for subsequent Contractor activities;

· An Integrated Master Management Plan (IMMP) describing the Contractor’s overall management approaches, policies and procedures including suggested project metrics; and,

· A detailed staffing plan with Key Personnel

· A Subcontract Management Plan outlining plans and goals for use of subcontractors.

Cybersecurity DoDI 8500.01 “Cybersecurity” requires that DoD Information Technology (IT) that receives, processes, stores, displays, or transmits DoD information will be acquired, configured, operated, maintained, and disposed of consistent with applicable DoD cybersecurity policies, standards, and architectures. DoDI 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT) requires the system to be Assessed and Authorized (A&A) once every three 3 years. The results of an annual review or a major change in the cybersecurity posture at any time may also indicate the need for reassessment and reauthorization of the system. This A&A ensures the effective safeguarding of Controlled Unclassified Information (CUI) against unauthorized modification, disclosure, destruction, and denial of service, as directed by the Department of Defense (DoD). The contractor shall comply with DoDI 8500.01 and 8510.01, as well as emerging DoD Cybersecurity policy designed to address evolving threats. The contractor shall perform security control selection in accordance with Committee on National Security Systems (CNSS) Instruction No. 1253, “Security Categorization and Control Selection for National Security Systems”. The contractor shall implement security controls in accordance with the DoD implementation and validation requirements specified in the Risk Management Framework (RMF) Knowledge Service (KS). The contractor shall store and maintain the system registration and artifacts in the DHA instantiation of the Enterprise Mission Assurance Support Service (eMASS). The contractor shall ensure that United States Cyber Command issuances and Information Assurance Vulnerability Management (IAVM) issuances are assessed, implemented and maintained throughout sustainment. The contractor shall support reciprocity, by providing all directed information to the government.

General Security In accordance with the Government's Program Protection Plan which demonstrates that the program adequately protects the technology, components, and information throughout the acquisition process during design, development, delivery and sustainment, the Contractor shall identify as security-critical those core items (hardware, software, or business process) whose failure could lead to a breach of system security. The Contractor shall develop a security assurance strategy to assure that the requirements, design, implementation, and operating procedures for the identified product minimize or eliminate the potential for breaches of system security. The Contractor shall record the strategy in the Security Management Plan (Deliverable 13), implement the strategy, and produce evidence, as part of required software products, that the security assurance strategy has been carried out.

Personnel Security Contractor personnel performing work under this contract shall have the appropriate level background investigation for the life of the contract. The Contractor shall abide by the attached “Defense Health Agency, Office of Administration, Support Services Division, Personnel Security Branch Instructions for Contractor Access to DOD IT Systems” (PWS Attachment 1) for personnel security requirements to determine appropriate background investigation level for Contractor’s personnel.

Physical Security The Contractor shall employ physical security safeguards for Information System (IS)/networks involved in the operation of its systems to prevent the unauthorized access, disclosure, modification, destruction, use, etc., of DOD Sensitive Information (SI) and to otherwise protect the confidentiality and ensure the authorized use of SI. In addition, the Contractor shall support a Physical Security Audit performed by the government of its internal information management infrastructure Ports Protocols and Services The Contractor shall follow all current DoD and Defense Information Systems Agency (DISA) standards and requirements for acceptable Ports, Protocols, and Services. Any requests for exception to using the current DISA Ports, Protocols, and Services standards requires an request for exception sent through the COR to the Designated Approval Authority (DAA).

Public Key Infrastructure Authentication and Encryption The Contractor shall follow the DoD standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication including authentication to DoD private web servers or applications. Where interoperable PKI is required for the exchange of unclassified information between DoD and its Contractors, industry partners shall obtain all necessary certificates when they are not eligible for a DoD Common Access Card (refer to http://iase.disa.mil/pki/eca/ and http://www.cac.mil/). The Contractor shall turn over to the Government all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support.

Disposing of Electronic Media The Contractor shall follow the DoD standards, procedures and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum, “Disposition of Unclassified Computer Hard Drives,” June 4, 2001. DoD guidance on sanitization of other internal and external media components are found in DoD 5220.22-M, “Industrial Security Program Operating Manual (NISPOM),” Chapter 8).

The Contractor shall not remove solution hard drives from the premises of the local site. If hard drives are to be replaced, they should be left at the local site for the appropriate authority (i.e. Information Management Division (IMD)) to dispose.

Host Based Intrusion Detection The Host Based Security System (HBSS) application monitors, detects, and counters against known cyber-threats to Department of Defense (DoD) Enterprise. The HBSS solution will be attached to each host server in the DoD network. The system will be managed by local administrators and configured to address known exploit traffic using an Intrusion Prevention System (IPS) and host firewall. Further information on HBSS can be found at www.disa.mil/Services/Information-Assurance/HBS/HBSS The Contractor shall follow the DoD standards and procedures and use approved products to install HBSS on the IS/networks involved in the operation of its solution to prevent, detect, track, report, and remediate malicious computer-related activities and incidents.

Enterprise Architecture (EA) The Contractor shall work with the DHA Enterprise Architecture team to provide formal input and support for the development of operational, system, data, and technical architectures.

Internet Protocol version 6 (IPv6) The Contractor shall provide COTS solutions that are capable. An IPv6 capable system or product shall be capable of receiving, processing, transmitting and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to that of IPv4. Specific criteria to be deemed IPv6 capable are: Conformance to the DoD Information Technology Standards Repository (DISR) developed DoD IPv6 Standards Profile. Systems being developed, procured or acquired shall comply with the Global Information Grid Architecture and DISR standard IPv6 Capable definition. An IPv6 Capable system must meet the IPv6 base requirements defined in the “DoD IPv6 Standards Profile v6.0” dated July 22, 2011.

· Maintenance of interoperability with IPv4. Systems being developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities. Systems should implement IPv4 / IPv6 dual-stack and should also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with. When either protocol is possible, systems should employ IPv6.

· Evidence of a migration path and commitment to upgrade all applications and product features (Deliverable 14).

· Availability of Contractor IPv6 technical support for system development, implementation, and management.

DoD IPv6 security guidelines, standards, and solutions shall be utilized and adhered to when available.

Federal Information Security Management Act (FISMA) OMB Memorandum M-09-29 asserts that agencies are responsible for ensuring information technology acquisitions comply with the information technology security requirements in the Federal Information Security Management Act (44 U.S.C. 3544), OMB’s implementing policies including Appendix III of OMB Circular A-130, and guidance and standards from the National Institute of Standards and Technology (NIST).

The Contractor shall, in accordance with DoD regulations, create and deliver to the government, a report consisting of the results of the quarterly and annual FISMA assessment (Deliverable 15).

Data at Rest The Contractor shall provide encryption of Data at Rest in accordance with cybersecurity control ECCR-1 Encryption for Confidentiality (Data at Rest) and Encryption of data in transit in accordance with cybersecurity control ECCT-1 Encryption for Confidentiality (Data in Transit), DoDI 8510.01, DoD Risk Management Framework (RMF) for DoD Information Technology (IT), March 12, 2014 and DoD Memorandum Department of Defense Guidance on Protecting Personally Identifiable Information (PII), August 18, 2006.

Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws Refer to PWS Attachment 4 Protection of Information Dissemination of Information/Publishing There shall be no dissemination or publication, except within and between the Contractor and any subcontractors or specified Integrated Product/Process Team (IPT) members who have a need to know, of information developed under this contract contained in the reports to be furnished pursuant to this contract without prior written approval of the DHA COR or the Contracting Officer. DHA approval for publication will require provisions which protect the intellectual property and patent rights of both DHA and the Contractor.

Non-Disclosure /Non-Use Agreement The Contractor shall ensure that the Non-Disclosure/Non-Use Agreement (PWS Attachment 3) (Deliverable 16) is signed by all staff assigned to or performing on this contract before performing any work, including all subcontractors and consultants. The Non-Disclosure/Non-Use Agreement shall be cosigned by a corporate official (Contractor Project Manager or higher).

The Contractor shall also ensure that all staff understand and adhere to the terms of the nondisclosure statement, protecting the procurement sensitive information of the Government and the proprietary information of other Contractors. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor.

Contingency Operations Plan The Contractor shall develop and submit a Contingency Operations Plan (Deliverable 17) to the Government to specify planning for the remediation of specific systems, equipment, software, and/or operations in the event of critical impact resulting from natural, accidental, or intentional events. The Contingency Operations Plan shall document Contractor plans and procedures to maintain DHA support during an emergency. The Contingency Operations Plan shall include the following:

· A description of the Contractor’s emergency management procedures and policy

· A description of the Contractor’s emergency management procedures/processes to ensure 24/7 days a week operation of the solution for DHA.

· A description of how the Contractor will account for their employees during an emergency

· Planned temporary work locations or alternate facilities

· How the Contractor will communicate with DHA during emergencies

· A list of primary and alternate Contractor points of contact, each with primary and alternate:

· Telephone numbers

· E-mail addresses

· Procedures for protecting Government furnished equipment (when any)

· Procedures for safeguarding sensitive and/or classified Government information (when applicable) Operations during Emergency Situations Individual contingency operation plans shall be activated immediately after determining that an emergency has occurred, shall be operational within twelve (12) hours of activation, and shall be sustainable until the emergency situation is resolved and normal conditions are restored or the contract is terminated, whichever comes first. In case of a life threatening emergency, the COR shall immediately make contact with the Contractor Project Managers to ascertain the status of any Contractor personnel who were located in Government controlled space affected by the emergency. When any disruption of normal, daily operations occur, Contractor Project Managers and Contracting Officer Representatives (CORs) shall promptly open an effective means of communication and verify:

· Key points of contact (Government and Contractor)

· Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

· Means of communication available under the circumstances (e.g. email, webmail, telephone, Fax, courier, etc.)

· Essential work products expected to continue production by priority The Government and Contractor Project Managers must make use of the resources and tools available to continue DHA contracted functions to the maximum extent possible under emergency circumstances.

GENERAL INFORMATION

This is a non-personal services contract for the Pharmacy Inpatient Automation Solution – Automatic Dispensing Cabinet (PIAS - ADC). The Government is not exercising any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

Hours of Operation The Contractor is responsible for conducting business as required to maintain the 24 hour/7 days a week operation of the Solution. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS.

Recognized Holiday No observance of holidays will be recognized.

Place of Performance The work to be performed under this contract will be performed at the Contractor’s facility and Government Facilities.

Type of Contract The government will award a Firm Fixed Price contract.

Identification of Contractor Employees All contract personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed.

Attendance at Meetings Contractor personnel may be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this contract. Contractor personnel make their Contractor status known during introductions.

Use of Military Rank by Contractor Personnel Contractor personnel, while performing in a Contractor capacity, are prohibited from using their retired or reserve component military rank or title in all written or verbal communications associated with the contract under which they provide services.

Contractor Travel Travel is incidental to the primary tasks identified in this PWS. Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the contractor.

Travel Outside of the United States This contract includes activities that may require the Contractor to travel to destinations outside of the United States. The Contractor shall ensure that assigned participants allow sufficient lead-time to obtain valid passports, country clearances, insurance, and immunizations to support project activities. The level of effort for travel is dependent on the Contractor’s solution and architecture (e.g. solution can support multiple facilities within a local geographic area).

Other Direct Costs ODCs shall be billed on a cost reimbursable basis. All ODCs shall be fully supported in compliance with all competition requirements of the FAR, specifically Part 31. All ODCs shall be reported in the Monthly Status Report (Section 1.2.11).

Data Rights The Government has unlimited rights to all documents/material and data produced under this contract. All documents and materials produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Contracting Officer Representative (COR) The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting Contract. Contracting Officers will determine whether the duties and responsibilities of the COR meet the criteria for filing a Confidential Financial Disclosure Report (OGE Form 450) as set forth in Section 2634.904 of Title 5, Code of Federal Regulations (Reference (h)), and Section 7-300 of DoD 5500.07-R (Refer to DoDI 5000.72). CORs designated as OGE Form 450 filers will submit a new entrant report and, if applicable, annual reports thereafter to the supervisor through the Contracting Officer to the ethics counselor for final review and certification.

Contractor Performance Assessment Reporting System The Contractor Performance Assessment Reporting System (CPARS) has been adopted by DHA to electronically capture assessment data and manage the evaluation process.