19-C-0007_Atch02_PD-New-Sw_Tumor-Reg.pdf

HT001519C0007

Attachment 2

Product Description Template_JAN_04_2019

RFQ HT0015-19-R-0016

PRODUCT DESCRIPTION (PD)

Defense Health Agency (DHA)

ENTERPRISE MEDICAL SERVICES

CONTRACTING DIVISION

MHS Tumor / Cancer Registry

Date: 09/16/2019

CAE-19-03423

PD Version Number: 1.0.

CAE Number: CAE-19-03423

Contents

1.0 PRODUCT REQUIREMENTS

1.1 SALIENT CHARACTERISTICS

1.2 GRAY MARKET GOODS

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL

INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

PROCUREMENTS (SECTION 508)

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY

(ICT) STANDARDS

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

3.0 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

4.0 Information Technology and Security

5.0 Proof of entitlement or proof of delivery

6.0 SHIPMENT OF HARDWARE OR EQUIPMENT

6.1 SPECIAL SHIPPING INSTRUCTIONS

1.0 PRODUCT REQUIREMENTS

1.1 SALIENT CHARACTERISTICS

The DHA-Medical Affairs Clinical Support Division, Tumor Registry, via the DHA’s Solutions Delivery Division (SDD) Program Office, requires the purchase of software, support, hosting, and upgrade/technical assistance to replace the Automated Central Tumor Registry (ACTUR) application, currently hosted at the Defense Manpower Data Center

(DMDC).

The Annual Software Subscription must meet the following capabilities (Base Year plus 4 Option Years and 6-month extension):

Data Classification is Moderate Level for Oncolog system and required Authority to Operate (ATO) certification for DoD cybersecurity

DoD/Government will host the data Department of Defense (DoD) Risk Management Framework (National Institute of

Standards and Technology (NIST) 800-53) compliance to ensure cybersecurity, protecting healthcare data

Provide a scalable flexible platform adaptable to DOD requirements Software allowing user-defined, custom fields, and data sets Provide a multifacility database for network systems “patient centric” viewpoint Built-in workflow design, data entry shortcuts, streamlined abstracting processes Extensive online help, quality assurance focused Reporting module that includes prebuilt user friendly reports (not raw data from the database) and the ability for ad hoc reporting Available pre-defined reports Integration with Microsoft office and Adobe products The ability to track and organize information needed for regulatory agency surveys Creation of treatment summaries and survivorship care plans Produce required documentation for Commission on Cancer standards Compliance with National Cancer Data Base, Surveillance Epidemiology and Results

Program and other national and state reporting requirements Centralized database, allowing individual reporting at the clinic and to the enterprise Import and rationalization of legacy ACTUR data into Oncolog formatting for reporting

– host, configure, test, and deploy within 60 days of contract release hosting capability y capabilities with MHS GENESIS and legacy systems data such as

HL7 Interface capability for enterprise treatment modalities, Continental United States (CONUS) and Outside Continental United States (OCONUS) locations functionality

-hospital data integration into shared database (DoD cancer data repository) encounter at multiple DoD facilities g, event/exposure tracking

-identified data extraction for research support s organization’s requirements esponse to updates and mandated changes: data inclusions, exclusions in compliance with standards organizations: ACS - CoC; Surveillance, Epidemiology, and End Results program; North American Association of Central Cancer Registries; National Program of Cancer Registries ite licenses with unlimited workstations/users licenses for enterprise l manager, expedited case finding, survivorship plan generation

– hours provided, weekend availability, turn-around time

– 0800 to 1900 EST and emergency on call within 24 hours for questions and/or troubleshoot the system

- and facility-specific

-up and follow up management: creation of patient lists, letters, and labels of National Quality Programs data standards

-up only creating charts and graphs for outcomes analysis, etc.

-time correction or changes to abstract

Compliance

DoD customization previous provided to BAMC facility Flat File Import for enterprise Quality Indicator Module capability

Deathlog (SSDI File Processing Tool) for enterprise Newest Release Oncolog 4.4 version

/Off-site training is available throughout the period of performance (base year plus 4 option years and 6-mon extension). Training will be on software access, patient cancer data entry, patient follow-up, administrative reporting and ongoing physician research, logging and management of patient information, treatment regimens and protocols, toxicities, drug doses and drug-reactions, disease response and adverse events, diagnose, document and analyze treatment patterns, complications and outcomes. Any new functions on the Oncolog application, the Online/Off-site training will be provided by

Oncolog. Computer-based training is available online via help files to assist with user education

First-Year-Only, One-Time Fee for a Locally hosted - onsite installation support:

Included as a costs to the above list.

Data Conversion and Import (Base Year Only):

Transfer 100% data from legacy systems (ACTUR) and the current Oncolog application from Brooke Army Medical Center to the new DHA Oncolog within 120 days

(NIST) 800-53) compliance during the data transfer process to ensure cybersecurity, protecting healthcare data

Training (Base Year Only):

Onco trainers provide on-site user product training at designated cancer centers to the end users and/or cancer center’s trainers for the base year.

Training will be on software access, patient cancer data entry, patient follow-up, administrative reporting and ongoing physician research, logging and management of patient information, treatment regimens and protocols, toxicities, drug doses and drug-reactions, disease response and adverse events, diagnose, document and analyze treatment patterns, complications and outcomes.

References related to the above capabilities are at the following online locations:

DoDI 8510.01 Risk Management Framework for DoD Information Technology – July 28, https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001_2014.pdf NIST Special Publication 800-37 Risk Management Framework for Information Systems and Organization – Oct 2018 (DRAFT) https://csrc.nist.gov/publications/detail/sp/800-37/rev-1/final NIST SP 800-37 “Guide for Applying RMF to Federal Information Systems” – Feb 2010 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-37.pdf NIST 800-53 Security & privacy Controls for Federal Information Systems and Organizations https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf National Institute of Health – National Cancer Institute (NIH-NCI) amendment to the National Defense Authorization Act for Fiscal Year 2013 https://www.congress.gov/bill/112th-congress/house-bill/4310/text Centers for Disease Control and Prevention/National Program of Cancer Registries (NPCR) S.3312 - Cancer Registries Amendment Act https://www.congress.gov/bill/102nd-congress/senate-bill/3312 American College of Surgeons - Commission on Cancer: Cancer Program Standards:

Ensuring Patient-Centered Care (2016 edition) https://www.facs.org/quality-programs/cancer/coc/standards National Institute of Health, Surveillance, Epidemiology, and End Results (SEER) Program https://seer.cancer.gov/tools/codingmanuals/index.html

1.2 GRAY MARKET GOODS

The Contractor must provide only new equipment and new parts for the required products described herein; no used, refurbished, or remanufactured equipment or parts shall be provided under any circumstances. Absolutely no “Gray Market Goods” or “Counterfeit Electronic Parts” shall be provided. Gray Market Goods are defined as genuine branded goods intentionally or unintentionally sold outside of an authorized sales-territory or by non-authorized dealers in an authorized territory. All equipment shall be accompanied by the Original Equipment Manufacturer’s (OEM’s) warranty.

Counterfeit Electronic Parts are defined as unlawful or unauthorized reproduction, substitution, or alteration that has been knowingly mismarked, misidentified, or otherwise misrepresented to be an authentic, unmodified electronic part from the original manufacturer, or a source with the express written authority of the original manufacturer or current design activity, including an authorized aftermarket manufacturer. Unlawful or unauthorized substitution includes used electronic parts represented as new, or the false identification of grade, serial number, lot number, date code, or performance characteristics.

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL

INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all DHA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines)

E204 Functional Performance Criteria

E206 Hardware Requirements

E207 Software Requirements

E208 Support Documentation and Services Requirements

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery.

The Contractor shall be able to demonstrate Section 508 Compliance upon Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule

The Government reserves the right to test for Section 508 Compliance before delivery.

The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

3.0 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005;

Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

The Contractor shall ensure that information technology products are procured and/or services are performed with products that meet and/or exceed ENERGY STAR, FEMP designated, low standby power, and EPEAT guidelines. The Contractor shall provide/use products that earn the ENERGY STAR label and meet the ENERGY STAR specifications for energy efficiency. Specifically, the Contractor shall:

1. Provide/use ENERGY STAR products, as specified at www.energystar.gov/products (contains complete product specifications and updated lists of qualifying products).

2. Provide/use the purchasing specifications listed for FEMP designated products at https://www4.eere.energy.gov/femp/requirements/laws_and_requirements/energ y_star_and_femp_designated_products_procurement_requirements . The Contractor shall use the low standby power products specified at http://energy.gov/eere/femp/low-standby-power-products.

3. The Contractor shall use these products to the maximum extent possible without jeopardizing the intended end use or detracting from the overall quality delivered to the end user.

The following is a list of information technology products for which ENERGY STAR, FEMP designated, low standby power, and EPEAT registered products are available:

1. Computer Desktops, Laptops, Notebooks, Displays, Monitors, Integrated Desktop Computers, Workstation Desktops, Thin Clients, Disk Drives

2. Imaging Equipment (Printers, Copiers, Multi-Function Devices, Scanners, Fax Machines, Digital Duplicators, Mailing Machines)

3. Televisions, Multimedia Projectors

This list is continually evolving, and as a result is not all-inclusive.

http://www.energystar.gov/products https://www4.eere.energy.gov/femp/requirements/laws_and_requirements/energy_star_and_femp_designated_products_procurement_requirements https://www4.eere.energy.gov/femp/requirements/laws_and_requirements/energy_star_and_femp_designated_products_procurement_requirements http://energy.gov/eere/femp/low-standby-power-products

4.0 INFORMATION TECHNOLOGY AND SECURITY

4.1 All work under this contract is [unclassified, confidential PII/PHI]

4.2 The Automated Data Processing/Information Technology (ADP/IT) levels and position sensitivity designation for positions under this contract is: ADP/IT II

4.2.1 ADP/IT II: Non-critical sensitive position (A position where an individual is responsible for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the ADT/IT I category.) The vendor will supply software updates to be applied by DHA HIT personnel. The vendor will not be allowed to access DHA infrastructure and/or MHS data.

4.3 PII/PHI, and Federal information requirements Patient Identified Information (Patient Name, DOB, Personal Health Information-Cancer)

4.4 Training:

4.4.1 Contractor employees performing cybersecurity / cyberspace functions shall comply with the following requirements: DoD cybersecurity requirements

4.4.1.1 Training: All contractor and associated subcontractor employees working Cybersecurity (Information Assurance (IA))/Cyberspace functions must comply with DoD training requirements in Department of Defense Directive (DoDD) 8140.01 and DoD 8570.01-M.

4.4.1.2 Certification: The Contractor shall ensure that personnel accessing information systems have the proper and current IA certification to perform IA functions in accordance with DoD 8570.01–M, IA Workforce Improvement Program. The Contractor shall meet the applicable IA certification requirements, including:

4.4.1.2.1 DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

4.4.1.2.2 Appropriate operating system certification for IA technical positions as required by DoD 8570.01–M.

4.4.1.2.2.1 Upon request by the Government, the Contractor shall provide documentation supporting the IA certification status of personnel performing IAfunctions.

4.4.1.2.2.2 Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing IA functions.

4.4.2 User requirements: All contractor employees that require access to Defense Health Agency Information Technology (DHA IT) must comply with the requirements of DHA-PI 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

4.5 General cybersecurity requirements – Information Systems: Reserved

4.6 Risk Management Framework (RMF) for DoD IT: Not applicable because hosting data in the DoD environment

4.7 Commercial Cloud Computing Services: Reserved

5.0 PROOF OF ENTITLEMENT OR PROOF OF DELIVERY

Before the Government approves an invoice, Contractors will be required to provide a completed Proof of Entitlement or Proof of Delivery forms. The Government will complete the information about the Acceptor on the attachments.

For sensitive licenses, the contractor shall provide a secure file transfer protocol (SFTP) or username and password to a secure license portal (or website).

Deliverable:

A. Proof of Entitlement and / or Proof of Delivery forms as applicable

B. Other Deliverables as applicable to this requirement:

Title Description

#1 Security/ability to accommodate Common Access Card (CAC) software

The Contractor application shall be able to accommodate CAC logins via government supplied security software

#2 Health Information and Portability Accountability Act compliant

0% noncompliance with HIPAA requirements

#3 Data interoperability/interfacing capabilities with Military Health System (MHS) GENESIS and legacy systems

The Contractor shall transfer and allow intake of data from MHS GENESIS and existing legacy systems, ACTUR, Composite Health Care System (CHCS), Armed Forces Health Longitudinal Technology Application (AHLTA), and spreadsheets/flat files

#4 Integrated, scalable system architecture accommodating variance in facility size, treatment modalities, continental US and overseas locations.

The Contractor’s application shall demonstrate the ability to expand for both data storage and data processing, to include new facility

#5 System reliability, ability to accommodate multiple users concurrently without impact to functionality

Contractor shall ensure software multiple users for multiple sites without degradation of service.

#6 System sustainability 24/7 Contractor application shall be available 90% with the exception of scheduled maintenance and upgrade time frames

#7 Hosting provided by Contractor Contractor shall provide a HIPAA/security compliant application and data environment

#8 Multi – hospital data integration into shared database (DOD cancer data repository)

Contractor shall provide an integrated data environment, supporting the entire MHS

#9 Data repository security and access options

Contractor cell ensure positive authentication of users by means of DOD ID and CAC authentication

#10 Ability for multiple users to view common abstract data on patients treated for same encounter at multiple DOD facilities

Contractor shall ensure record continuity across all facilities in the DOD

#11 Clustering, event/exposure tracking, research capabilities

Contractor shall provide the ability to track patients and locations in the software

#12 Data extraction and export capability IAW standard setter requirements

Contractor shall provide the ability for user extraction of data into standard formats

#13 Application(s) to support central cancer registry operations and processes

Contractor shall provide a centralized cancer registry

#14 Timeliness in response to updates and mandated changes:

data inclusions, exclusions in compliance with standard setters:

American College of Surgeons Commission on Cancer (ACoS - CoC) Surveillance, Epidemiology, and End Results program; North American Association of Central Cancer Registries; National Program of Cancer Registries

Contractor shall apply all updates related to mandated reporting and exclusions will be applied within 30 days of posted release dates

#15 Report generation capacity, both internal and external

Contractor shall provide the ability for report generation for internal and external requestors

#16 Ability to share report design across network

The Contractor shall provide the ability for users to share reports

#17 Additional module availability:

patient navigation; protocol manager, expedited case finding

The Contractor shall provide a baseline function as at Brooke Army Medical Center, with the option to purchase additional functional modules as needs evolve.

#18 Technical assistance – hours provided, weekend availability, turn-around time

The Contractor shall have technical assistance available during normal business hours and weekend on-call coverages for break fixes or technical issues

#19 Customer support – hours provided, weekend availability, turn-around time

The Contractor shall provide functional assistance to end users during normal CONUS working hours Monday through Friday and will respond to functional requests on weekends/holidays

#20 User product training The Contractor shall supply local and online training to end users

#21 Continuing education (CE) for Certified Tumor Registrars (CTRs)

The Contactor shall provide CEs for CTRs for appropriate activities

#22 Ability to customize and create user defined fields, both Enterprise- and facility-specific

The Contractor shall allow the users to create custom fields.

#23 Follow-up and follow up management: creation of patient lists, letters, and labels

The Contractor shall enable users to create and print custom products

#24 Inclusion of National Quality Programs (NQP) data standards

The Contractor shall incorporate NQP standards into their product

#25 User friendly ad hoc report writer; available pre-defined reports

The Contractor shall provide the ability for ad hoc and predefined reports

#26 Ability to restrict user access;

view only or follow-up only

The Contractor shall enable role based access and permissions

#27 Ease of use; streamline data design

The Contractor shall meet the basic standards of international software quality evaluation standards that have been established by International Organization for Standardization / International Electrotechnical Commission Joint Technical Committee 1 (ISO/IEC JTC1) SC7

#28 Embedded user resources (manuals); error correction assist

The Contractor’s product shall include embedded help and references for end user assistance

#29 Data quality checks with edit modules

The Contractor’s product shall apply quality checking for incompatible data entry

#30 Ease of creating charts and graphs for outcomes analysis, etc.

The Contractor’s product shall provide the ability to produce graphical charts

#31 Ability to track adverse events and disease response

The Contractor’s product shall provide the ability to record and track adverse events and response to treatment modalities

#32 National Provider Identifier (NPI) number registry

The Contractor’s product shall maintain a current NPI list

#33 Real-time correction or changes to abstract

The Contractor’s product shall provide the ability for correction/changes to abstracted data

#34 Data conversion process and associated costs

The Contractor shall provide technical resources for the conversion/import of data from legacy systems

6.0 SHIPMENT OF HARDWARE OR EQUIPMENT

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary Alternate Name: LCDR Julie Clement Name: N/A

Address: DHA Medical Affairs 7700 Arlington Blvd Falls Church, VA 22042

Address:

Primary Alternate

703-681-0075 Voice:

julie.m.clement2.mil@mail.mil Email:

6.1 SPECIAL SHIPPING INSTRUCTIONS

Prior to shipping, Contractor shall notify Site POCs, by phone followed by email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of Site

POC.

Contractors shall coordinate deliveries with Site POCs before shipment of hardware to ensure sites have adequate storage space.

All shipments, either single or multiple container deliveries, shall bear the DHA Task Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the DHA TO number shall indicate total number of containers for the complete shipment (e.g.

“Package 1 of 2”), clearly readable on manifests and external shipping labels.

Packing Slips/Labels and Lists shall also include the following:

DHA TO #: (The DHA TO number is located in block #4 of the SF 1449)) Project Description: (e.g. Tier I Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

SCHEDULE FOR DELIVERABLES

Note: Days used in the table below refer to calendar days unless otherwise stated.

Deliverables with due dates falling on a weekend or holiday shall be submitted the following Government work day after the weekend or holiday.

Deliverable Description Proof of Entitlement or Proof of Delivery Due: 30 Days after contract award Inspection: destination Acceptance: destination

POINTS OF CONTACT

DHA Program Manager:

Name: see Ship to and Mark for above

Address:

Voice:

Email:

Contracting Officer’s Representative:

Name: see Ship to and Mark for above Address:

Voice:

Email:

Contracting Officer:

Name: Raul Garcia Address: 4130 Stanley Road, Suite 208 Joint Base San Antonio, TX 78234 Voice: 210-221-6122 Email: Raul.J.Garcia4.civ@mail.mil Contract Specialist:

Name: Ed Norton Address: 4130 Stanley Road, Suite 208 Joint Base San Antonio, TX 78234 Voice: 210-295-2780 Email: Edward.L.Norton2.ctr@mail.mil