DRAFT PWS DHA JPSR.docx

Department of Defense Defense Health Agency Performance Work Statement

Joint Patient Safety Reporting (JPSR) Modernization and Sustainment

Program Executive Office – Medical Systems/ J6 Solution Delivery Division – Clinical Support Program Management Office

Solicitation Number:

Version: 1.0 Date: 14 November 2023

DRAFT

PART 1

1.0 GENERAL INFORMATION

1.0. Scope: This award provides DHA and VHA COTS software licenses, code maintenance, configuration management, and application support activities for the joint patient safety reporting application that supports patient safety reporting business requirements of the DHA, VHA, Navy Fleet, and US TRANSCOM hosted in a Defense Information Systems Agency (DISA) Defense Enterprise Computing Center (DECC). This effort includes a modernization and enhancement effort to migrate to a Cloud hosting platform of the government’s choice with added capabilities for conducting comprehensive systematic analysis/ root cause analysis (CSA/ RCA), corrective action plans, and quantitative/ qualitative analysis tools to measure effectiveness of the process and execution of the plans.

1.1. This is a non-personal services contract to modernize and sustain the JPSR information technology solution.

1.2. Description of Services/introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform JPSP Modernization and Sustainment activities as defined in the PWS for the DHA and the VHA except for those items specified as Government furnished property and services. The Contractor shall perform to the standards in this performance work statement.

1.3. Background:

The Patient Safety Reporting (PSR) system was deployed in 2010 as a DOD centric solution for standardized patient safety event reporting, event classification, and investigation data collection and data analysis capability for the DHA direct care facilities and Military Department theater operations. PSR is a COTS software solution comprised of the Datix Web incidents and hotspots modules with analytics and dashboard tools. PSR was updated as the Joint Patient Safety Reporting (JPSR) system in 2015 and deployed to all VHA Medical Centers and subordinate clinics.

JPSR integrates the DHA and VHA patient safety data collection and analysis processes into a single system for quantitative and comparative data analysis in accordance with Public Law (PL) 106-398 (Sec 742).

· JPSR is a collaborative effort between the DHA Patient Safety Program and the VHA National Center for Patient Safety (NCPS)

· JPSR has been configured to be used by Navy Fleet command and US TRANSCOM.

· JPSR application standardizes processes that allow the DHA and VHA hospital and clinic medical teams to identify and document medical errors and near-miss events/ close calls that may occur within their facilities. Event reporting is a key element to help drive high reliability forward and achieve zero preventable harm.

Key Features:

· Confidential user-based access via the world wide web protected data entry by 38 U.S.C. 5705 and 10 U.S.C. 1102 to identify multi-level trends and common issues that require immediate action.

· Includes analytical tools and reports that help develop and implement proper quality control measures.

· Provides dashboards for at-a-glance monitoring, measuring, and analyzing key data.

Key Benefits:

· Provides consistent incident reporting across the Federal healthcare enterprise with anonymous and identified reporting capability.

· Enforces common classification of patient safety events to improve data analysis and reporting.

· Generates cost efficiencies by sharing software licenses and data centers.

· Reduces costs of system maintenance, helpdesk, and training workloads.

1.4. Objectives:

· Provide enterprise software licenses for DHA and VHA for the current Risk Management Framework (RMF) accredited web based JPSR application with incident reporting, investigations, incident classification system, dashboard, and analytic capabilities.

· Provide enterprise software licenses for DHA and VHA for JPSR modernization to a Cloud hosted level 4/5 Federal Risk and Authorization Management Program (FedRAMP) accredited application with incident reporting, investigations, incident classification system, CSA/ RCA, corrective action plans, Business Intelligence (BI) tools for quantitative/ qualitative analytics, timelines, diagraming and dashboards capabilities.

· Provide skilled and knowledgeable resources working with Defense Information Systems Agency (DISA as well as accessing systems hosted within a DISA DECC to support the current JPSR application to include, but not limited to operations and sustainment (O&S), systems engineering, maintenance, configuration management/data management (CM/ DM), cybersecurity, testing, training support, integration, transition of releases to service.

· Provide knowledgeable resources with the DHA and VHA Patient Safety incident reporting, classifications systems, comprehensive systematic analysis investigations workflow, corrective action plans, and analytical processes.

· Maintain and operate a centralized JPSR Service Help Desk in support of DHA and VHA users operating 10 hours per day (0700 - 1800 ET) Monday through Friday, except Federal holidays, utilizing the DHA Global Service Center (GSC) tools as primary method to conduct application support services with the JPSR user community.

· Provide Reliability, Maintainability, and Availability (RM&A) services to maintain JPSR operational availability (Ao) on a 24 hours per day, 7 days per week, 365 days per year basis (24x7x365) with target threshold of 98.5% Ao and objective at 99.5% - excluding scheduled maintenance and Internet communications downtime.

· Provide knowledgeable resources with the DHA Integrated Authorization Service (iAS) to maintain, improve, or resolve account registration and application access issues with DOD Common Access Card (CAC) and VA Personal Identity Verification (PIV) card users.

· Provide skilled and knowledgeable resources working with FedRAMP accredited level 4/5 Cloud hosting platform and infrastructure to install, configure, accredit, implement, and sustain the JPSR application in a Cloud hosting platform of the government’s choice.

· Provide historical data retention/availability following migration from on-prem hosting to Cloud based computing.

· Provide Training services to DOD and VHA patient safety communities.

1.5. Non-Personal Services. This award identifies services that are strictly non-personal in nature.

1.6. Period of Performance (PoP)

1.6.1. Transition: Transition-in/transition-out period: Not applicable to this PWS

1.7. Inherently Governmental Functions. This requirement has been reviewed and contains no services that are inherently Governmental functions.

1.8. Organizational Conflict of Interest (OCI) Category: The FAR Part 9.5 prescribes responsibilities, general rules, and procedures for identifying, evaluating, and resolving Organizational Conflict of Interest (OCI), provides examples to assist Contracting Officers in applying these rules and procedures to individual contracting situations; and implements section 8141 of the 1989 Department of Defense Appropriation Act. The two (2) underlying principles which the FAR seeks to avoid are preventing the existence of conflicting roles that might bias a contractor’s judgment and preventing unfair competitive advantage. An unfair competitive advantage exists where a Contractor competing for award of any Federal contract possesses --

(1) Proprietary information that was obtained from a Government official without proper authorization; or

(2) Source selection information (as defined in FAR 2.101) that is relevant to the contract but is not available to all competitors, and such information would assist that Contractor in obtaining the contract. The following subsections prescribe certain limitations on contracting as the means of avoiding, neutralizing or mitigating organizational conflicts of interest.

It is the Contractor’s responsibility to notify the Contracting Officer of any potential OCI. If an OCI exists, the Contractor shall propose a Mitigation Plan that shall be reviewed and accepted by the Contracting Officer prior to continuance of the work that presents an OCI. Should the proposed Mitigation Plan not be accepted by the Contracting Officer, the Government may terminate this contract, disqualify the Contractor from subsequent related contractual efforts, and pursue any remedies as may be permitted by the law or this contract.

If, under this contract, the Contractor will provide systems engineering and technical direction for a system, but does not have overall contractual responsibility for its development, integration, assembly, checkout or production, the Contractor shall not be awarded a subsequent contract to supply the system or any of its major components, or to act as consultant to a supplier of any system, subsystem, or major component utilized for or in connection with any item or other matter that is (directly or indirectly) the subject of the systems engineering and technical direction. The term of this prohibition shall endure for the entire period of this contract and for two (2) years thereafter.

If, under this contract, the Contractor will prepare and furnish complete specifications covering non-developmental items, to be used in a competitive acquisition, the Contractor shall not be permitted to furnish these items, either as a prime or subcontractor. The term of this prohibition shall endure for the entire period of this contract performance and for either two (2) years thereafter or the duration of the initial production contract whichever is longer. This rule shall not apply to Contractors who furnish specifications or data at Government request or to situations in which Contractors act as Government representatives to help Government agencies prepare, refine or coordinate specifications, provided this assistance is supervised and controlled by Government representatives.

If, under this contract, the Contractor will prepare or assist in preparing a work statement to be used in competitively acquiring a system or services, the Contractor shall not supply the system, its major components, or the service unless the Contractor is the sole source, the Contractor has participated in the development and design work, or more than one Contractor has been involved in preparing the work statement. The term of this prohibition shall endure for the length of this contract.

If, under this contract, the Contractor will provide technical evaluation of products or advisory and assistance services, the Contractor shall not provide such services if the services relate to the Contractor's own or a competitor's products or services unless proper safeguards are established to ensure objectivity.

If, under this contract, the Contractor gains access to proprietary or source selection information of other companies in performing advisory assistance services for the Government, the Contractor agrees to protect this information from unauthorized use or disclosure and to refrain from using the information for any purpose other than that for which it was furnished. A separate agreement shall be entered into between the Contractor and the company whose proprietary information is the subject of this restriction. A copy of this agreement shall be provided to the Contracting Officer.

The Contracting Officer has significant discretion as to the acceptability of any mitigation plan offered.

Contractors are encouraged to present their best strategy for mitigation of any potential OCI under this contract. Contractors shall submit a mitigation plan at the Contract level and update it as often as necessary throughout the life of the Contract.

The Contracting Officer (and when applicable the appropriate program office, acquisition manager, and legal counsel) will review the comparative analysis and, if provided, the Avoidance or Mitigation Plan, in accordance with the requirements of FAR Subpart 9.5 (Organizational Conflict of Interest) to determine whether award to that Offeror would be consistent with those requirements and review as necessary throughout the life of the contract. If it is unilaterally determined by the Contracting Officer that no OCI would arise or that the OCI Avoidance or Mitigation Plan adequately protects the interests of the Government in the event of award to that Offeror, the Offeror will be determined eligible for award. If the Contracting Officer reasonably determines that a Contractor has not provided either a comparative analysis or avoidance/mitigation plan, or both, or that the analyses or plan provided is inadequate, sanctions including elimination from the award process, or termination of the related contract effort already awarded, as well as other appropriate sanctions will be considered.

If the Offeror/Contractor knows of no OCI in accepting work under this contract, it shall certify its OCI status and submit the certification with its proposal and any later award, if awarded the contract. The Contractor shall also obtain a similar certification of OCI status from all sub-Contractors, teaming partners or consultants prior to assigning tasks to any such party under this contract.

For breach of any of the above restrictions or for nondisclosure or misrepresentation of any relevant facts required to be disclosed concerning this contract, the Government may terminate this contract, disqualify the Contractor from subsequent related contractual efforts, and pursue any remedies as may be permitted by law or this contract.

Prior to a contract modification involving a change to the Performance Work Statement, or an increase in the level of effort or extension of the term of the contract, the Contractor shall submit any applicable organizational conflict of interest disclosure or an update of the previously submitted disclosure or representation.

1.9. Administrative specifications

1.9.1. Place of Performance: The work shall be performed at Contractor’s facility supporting operations at any DHA location within the Continental United States (CONUS).

The contractor facility location can be anywhere within CONUS if the location does not present a hardship to complete work required on this task. The contractor shall have real-time communication between the contractor personnel supporting the efforts and Government personnel available at time of award.

1.9.2. Recognized Federal holidays. The Contractor shall provide on-call emergency support on Federal holidays.

Independence Day

1.9.3. Hours of operation. The Contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. The Government anticipates support coverage ten (10) hours per day (Eastern Time, including lunch), five (5) days per week (Monday through Friday, excluding Federal holidays, “10x5”, and two Saturdays per month to support routine maintenance efforts.

1.9.4. Emergency Services. On occasion, services may be required to support an activation or exercise of contingency plans outside other normal duty hours.

1.9.5. 24/7 on-call emergency support, outside normal duty hours, is required to maintain JPSR availability in support of a world-wide user base in additional to requiring support for schedule maintenance activities occurring outside normal duty hours.

1.10. Conduct: Contractor personnel shall adhere to standards of conduct as established by the DHA Commander.

1.11. Contractor travel: Contractor may be required to travel within CONUS and within the National Capitol Region (NCR) to attend meetings, conferences, and training in support of the DHA and/or VHA. The contractor may be required to travel to off-site training locations and to mail training aids to these locations in support of this PWS. The Contractor shall be authorized travel expenses consistent with the cost principles and procedures in Federal Acquisition Regulation (FAR) Part 31.2, Travel Costs and the limitations of funds specified in this contract. All travel requires Government approval/authorization and notification to the Contracting Officer Representative (COR).

$12,500.00

NTE

$12,500.00

NTE

$5000.00

NTE

$5000.00

NTE

$5000.00

VHA

$12,500.00

NTE

$12,500.00

NTE

$5000.00

NTE

$5000.00

NTE

$5000.00

1.12. Other Direct Costs (ODC):

ODCs shall be billed on a cost reimbursable basis. Costs are defined as the purchase price of materials or service plus General and Administrative charges (G&A) or material and handling charges (M&H). All ODCs shall be reported as stated in the Monthly Progress Report (MPR) (Deliverable 1: Monthly Progress Report).

The Contractor may be required to pay postage and other costs associated with obtaining and maintaining the security clearance for each employee assigned to this project.

The Contractor may be required to pay postage and other costs associated with obtaining and maintaining the Government Furnished equipment (GFE) (e.g., laptops.)

The Contractor may be required to pay postage and mailing material costs for securing and maintaining test PIV and CAC cards for end-to-end testing events.

The Contractor may be required to pay an annual subscription fee for a training video development/maintenance environment (e.g., VIMEO)

The Contractor may be required to pay production and postage costs for producing and shipping training materials.

ODC Limitation Notification

Contractors shall monitor Other Direct Costs (ODCs). For this monitoring purpose, ODCs include incidental material, travel, and other non-labor costs (excluding subcontracting and consultant labor cost) required in performance of the service. For any given period of performance, if the cumulative total cost of ODCs exceeds the awarded total cost of ODCs (regardless of any modifications to the awarded amount) by 10%, the contractor shall send notice and for exceeding cost to the COR who will then send a memorandum signed by the PM (or equivalent) to the Contracting Officer documenting the reasons justifying the increase of ODC. The ability of a contractor to monitor ODCs will be observed by the COR.

$3,000.00

NTE

$3,000.00

NTE

$3,000.00

NTE

$3,000.00

NTE

$3,000.00

VHA

$1,000.00

NTE

$1,000.00

NTE

$1,000.00

NTE

$1,000.00

NTE

$1,000.00

1.13. Quality

1.13.1. Quality Control (QC): The Contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The Contractor’s quality control program (QCP) is how the work complies with stated requirements. The Contractor QCP is due within 45 working days after contract award. After acceptance of the Quality Control Plan (QCP) the Contractor shall receive the Contracting Officer’s (CO) acceptance in writing of any proposed change to his QC system (Deliverable: Quality Control Plan).

1.13.2. Quality assurance (QA): The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.14. Contractor personnel: When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.14.1. Common Access Card (CAC) requirements: The Contractor shall complete or provide to the Government all information required per the DHA CAC request process, current version 2.1, January 2018, or more recent when updated. See process attached in Section Part 7.1 of the PWS. A CAC is the standard identification for eligible DoD Contractor personnel.

CAC requirements: For all Contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD Contractor personnel.

The Contractor shall return all CACs to the COR upon the departure of the Contractor(s).

1.14.2. Contractor onboarding and training. The Contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

· DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

· DHA’s Contractor training instructions embedded at Part 7 Section 7.1.2.

· The Contractor shall comply with onboarding requirements of the DHA for Contractors needing to be issued CAC identification, including DoD and DHA directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at: https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

· The DHA’s new employee handbook at Part 7 Section 7.1.4.

1.14.3. Physical Security: The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use. The Contractor shall protect Government information and shall provide compliance documentation validating they are meeting this requirement in accordance with DFARS Clause 252.204-7012. The Contractor and all utilized subcontractors shall abide by the following safeguards:

a. Do not process DoD information on public computers (e.g., those available for use by the public in kiosks or hotel business centers) or computers that do not have access control.

b. Protect information by at least one physical or electronic barrier (e.g., locked container or room, login, and password) when not under direct individual control.

c. Sanitize media (e.g., overwrite) before external release or disposal.

d. Encrypt all information that has been identified as controlled unclassified information (CUI) when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media such as portable hard drives and digital optical disks, using DoD Authorized Data-at-Rest encryption technology.

e. Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

f. Transmit e-mail, text messages, and similar communications using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and Transport Layer Security (TLS). Encrypt organizational wireless connections and use encrypted wireless connection where available when traveling. If encrypted wireless is not available, encrypt application files (e.g., spreadsheet and word processing files), using at least application-provided password protection level encryption.

g. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

h. Do not post DoD information to Website pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to Website pages that control access by user identification or password, user certificates, or other technical means and provide protection via use of TLS or other equivalent technologies. Access control may be provided by the intranet (vice the Website itself or the application it hosts).

i. Provide protection against computer network intrusions and data exfiltration, minimally including the following:

1. Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

2. Monitoring and control of inbound and outbound network traffic as appropriate (e.g., at the external boundary, sub-networks, individual hosts) including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

3. Prompt application of security-relevant software patches, service packs, and hot fixes.

j. As applicable, comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, critical program information (CPI), personally identifiable information, export controlled).

k. Report loss or unauthorized disclosure of information in accordance with contract or agreement requirements and mechanisms.

l. The Contractor shall protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.

m. In accordance with DFAR clause 252.239-7001, DoDD 8570.01 and Secretary of the Navy Manual (SECNAV M) 5239.2, contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking requirements as cited in DoD 8570.01-M prior to accessing DoD information systems.

1.14.4. Key Control: RESERVED

1.14.5. Key personnel (Contractor):

1.14.5.1. The Contractor shall provide an Information Technology Project Manager (PM) who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the manager is absent shall be designated in writing to the CO. The Contractor’s PM or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The Contractor’s PM or alternate shall be available during normal business hours between 0800 to 1700 ET Monday thru Friday except Federal holidays or when the Government facility is closed for administrative reasons.

The follow personnel are considered key personnel by the government:

*Experience migrating Defense Health Agency applications to a FedRAMP level 4/5 accredited Cloud hosting environment is preferred

Substitutions of quoted Key Personnel shall not be allowed for a period of six months after award. Any substitution or replacement Key Personnel shall have qualifications equal to or greater than the individuals quoted. For temporary and/or permanent replacement of Key Personnel, the Contractor shall provide a resume for each individual to the COR. Resumes shall be provided at least two weeks (or as mutually agreed upon) prior to making any personnel changes. The Government reserves the right to pre-approve any replacement or substitution of Key Personnel. Contractor personnel must submit necessary information to be issued a clearance prior to reporting for performance.

1.15. Data rights: RESERVED

1.16. Section 508 Requirement. The Contractor shall comply with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d). Specifically, the procurement, development, maintenance, or integration of electronic and information technology (EIT) under this contract must comply with the applicable accessibility standards issued by the Architectural and Transportation Barriers Compliance Board at CFR part 1194.

1.17. RESERVED

1.17.1. RESERVED

1.17.2. RESERVED

1.17.3. RESERVED

1.18. Reporting

1.18.1. Contractor Manpower Reporting (CMR): RESERVED

1.18.2. Non-Disclosure Agreement (NDA) (Deliverable: Non-Disclosure Agreement): All Contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA Contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The Contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other Contractors. The NDA shall be executed not later than first day of employment. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor. The Contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.18.3. Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notifies both the CO and Contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.18.4. Post award conference/periodic progress meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the CO will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.18.5. Integrated Master Schedule (IMS) (Deliverable 2: Integrated Master Schedule). The Contractor shall establish and maintain an IMS in accordance with the approved format agreed upon between Contractor and the Government following Solutions Delivery Division (SDD) guidance, to be used to verify the attainability of task order objectives, to evaluate progress toward meeting program objectives, and to integrate the program schedule activities with all related components. The IMS shall depict task order milestones, accomplishments, and discrete tasks/activities from task order award to the completion of task order.

1.18.6. Contingency Operations Plan (COP) (Deliverable: Contingency Operations Plan): The Contractor shall develop and submit a Contingency Operations Plan to the Government to specify planning for the remediation of specific systems, equipment, software, and/or operations in the event of critical impact resulting from natural, accidental, or intentional events. The COP shall document Contractor plans and procedures to maintain DHA support during an emergency and include the following:

· A description of the Contractor’s emergency management procedures and policy,

· A description of how the Contractor will account for their employees during an emergency,

· Planned temporary work locations or alternate facilities,

· How the Contractor will communicate with DHA during emergencies,

· A list of primary and alternate Contractor points of contact, each with primary and alternate Telephone numbers and E-mail addresses,

· Procedures for protecting Government furnished equipment (if any), and

· Procedures for safeguarding sensitive and/or classified Government information (if applicable).

1.18.7. Operations during Emergency Situations. Individual contingency operation plans shall be activated immediately after determining that an emergency has occurred, shall be operational within twelve (12) hours of activation, and shall be sustainable until the emergency is resolved, and normal conditions are restored, or the contract is terminated, whichever comes first. In case of a life-threatening emergency, the COR will immediately contact the Contractor Task Manager to ascertain the status of any Contractor personnel who were in Government controlled space affected by the emergency. When any disruption of normal, daily operations occurs, the Contractor Task Manager shall promptly open an effective means of communication with the COR and verify:

· Key points of contact (Government and Contractor).

· Temporary work locations (alternate office spaces, telework, virtual offices, etc.).

· Means of communication available under the circumstances (e.g., email, webmail, telephone, FAX, courier, etc.).

· Essential work products expected to continue production by priority.

The Contractor’s Project Manager, in coordination with the COR, shall make use of the resources and tools available to continue DHA contracted functions to the maximum extent possible under emergency circumstances. The Contractor shall obtain approval from the COR and CO prior to incurring costs over and above those allowed for under the terms of this contract. Regardless of contract type, and of work location, Contractors performing work in support of authorized tasks within the scope of its contract shall charge those hours accurately in accordance with the terms of this contract.

1.18.8. Kick-off Meeting and Program Reviews (Deliverable 3: Program Review Materials). The Contractor shall meet with the Government to present an overview of their approach and establish schedules, procedures, and points of contact necessary to conduct the tasks outlined herein. The primary outcome of this meeting is to come to an agreement on the cost, schedule, and performance baselines.

1.18.9. Integrated Baseline Reviews (IBRs) (Deliverable 3: Program Review Materials). The Contractor shall conduct an IBR to ensure a reliable performance measurement baseline is established. An IBR will be conducted at the beginning of each period of performance, or when contract modifications occur, to ensure the contract baseline covers the entire technical scope to ensure the work is properly scheduled, resources assigned, content and the realism of the related performance budgets, resources, and schedules. The IBR shall provide for a mutual understanding of the inherent risks in Contractors’ performance plans and the underlying management control systems, and it should formulate a plan to handle these risks. The Contractor shall follow the approved SDD PEO IBR Procedure.

1.18.10. Monthly Progress Report (Deliverable 1: Monthly Progress Report). The Contractor shall provide a Monthly Progress Report (MPR) that provides insight into expenditures, staffing, progress, risks, and status of GFE, including Contractor purchased, Government owned items. The Contractor shall provide project briefings addressing cost/price, schedule, performance, and status of each key element of this PWS, noting any problems or risks, and alternative and recommended solutions. The Contractor shall provide a staffing report with the name, credentials, and cybersecurity certification date for each person performing on this contract.

1.18.11. Performance Monitoring (Deliverable 1: Monthly Progress Report). The Contractor shall measure and monitor their performance in executing the requirements as put forth in this PWS. Performance monitoring shall be included as part of the MPR in support of the performance metrics and assigned measurements monthly may include, but not limited to:

· Identification of data tables that have been updated,

· Assessments of the production system modifications and integration activities,

· Releases planned and achieved,

· System Incident Reports (SIRs) by products/components,

· Testing results, e.g., Development Integration Testing, (DIT) , security testing cycles, etc.

· Technology training and certifications,

· Itemization of ODCs billed.

1.18.12. Subcontracting Plan. Not Applicable for this PWS

1.18.12.1. Subcontract Expenditures Report. Not Applicable for this PWS.

1.18.13. Lessons Learned/After Action Report (AAR) (Deliverable 3: Program Review Materials). The Contractor shall provide the Government with Lessons Learned Report and/or After-Action Report (AAR)* as requested by the COR. The document shall include, but not be limited to:

· Incident or accomplishment that occurred,

· Date of occurrence,

· Resolution and root cause,

· Lessons that were learned and how to avoid the incident or repeat the accomplishment in the future, and Lessons learned during the execution of all maintenance activities.

* Note: After Action Reports will follow SDD approved format

1.18.14. Risk Management. (Deliverable: Risk Management Plan) The Contractor shall establish and maintain a Risk Management Program. The risk identification, risk assessments, and risk mitigation strategies shall be documented as part of their Risk Management Plan (RMP). Contractor identified risks shall be documented as part of the Contractor’s MPR. (Deliverable 1: Monthly Progress Report)

1.18.15. Dissemination of Information/Publishing. There shall be no dissemination or publication, except within and between the Contractor and any Subcontractors or specified Integrated Product/Process Team (IPT) members who have a need to know, of information developed under this order or contained in the reports to be furnished pursuant to this order without prior written approval of the DHA COR or the CO. DHA approval for publication will require provisions which protect the intellectual property and patent rights of both DHA and the Contractor.

1.19. Contractor Identification

1.19.1. Contractor personnel performing services in a Contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All Contractor personnel shall identify themselves as Contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The Contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is Contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is Contractor support personnel. Include a title block in all emails that states the fact that the person is Contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is Contractor support personnel.

1.19.2. Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.19.3. Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.20. Contractor Access to Health Affairs (HA)/DHA Network(s)

1.20.1. FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system. Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.20.2. Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.21. Personnel Security

1.21.1. The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.21.1.1. Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.21.1.2. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.21.1.3. DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS/INSTRUCTIONS

2.1. Definitions:

2.1.1. Category D: Information Technology (IT) and Telecommunications Services (called D-Services)

2.1.2. Category R: Support (Professional/Administrative/Management) Services (called R-Services)

2.1.3. Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4. Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated, and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5. Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6. Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2. Acronyms:

2.3. Applicable Publications, DHA Administrative Instructions (AI), etc.

· DHA-Procedures Manual 6025.13 (DHA-PM 6025.13) Volumes 1 – 7 Clinical Quality Management in the Military Health System

· DHA-PM 6025.13 Implementation Guidance for Defense Health Agency Procedures Manual, “Clinical Quality Management in the Military Health System,” Volumes 1-7

· Veterans Health Administration (VHA) Center for National Patient Safety Guide to Performing Root Cause Analysis Version 8.1. Issued January 2023

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property,…