RFP_08_Jul_15_Final.pdf

RFP - Radiation Dose Monitoring Systems

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in

Subpart 12.6, as supplemented with additional information included in this notice. Also, this acquisition is being conducted under FAR 13.5, Test Program for Commercial Items. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.The solicitation number is N62645-15-R-1020. The solicitation is issued as a request for proposal (RFP).

Provisions and clauses in effect through Federal Acquisition Circular 2005-83 are incorporated. It is the contractor’s responsibility to be familiar with the applicable clauses and provisions. The clauses may be accessed in full text at these addresses: http://acquisition.gov/far/ and http://farsite.hill.af.mil. The

NAICS code is 334510, with a small business size of 500 employees. This is a brand name only requirement; all qualified vendors are encouraged to submit a proposal.

The Naval Medical Logistics Command (NMLC) requests responses from qualified sources capable of providing four (4) radiation dose monitoring systems Brand Name Only basis. One system is required by the US Army, one system is required by the US Navy, and one system is required by the US Air Force.

One (1) system will be included for the Defense Health Agency (DHA) as an option and one (1) system will be included for the Veterans Administration (VA) as an option.

The Brand Name Only source is Bayer Healthcare. Please refer to the Equipment List for details.

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

RADIATION DOSE MONITORING SYSTEM

FFP

Dose Monitoring System

See Equipment List for details

20 US Navy Locations

See Site Information for details

FOB: Destination

MILSTRIP: N6264514RCP3001

PURCHASE REQUEST NUMBER: N6264514RCP3001

NET AMT

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/12.htm#P295_49304 http://acquisition.gov/far/ http://farsite.hill.af.mil/

RADIATION DOSE MONITORING SYSTEM

FFP

Dose Monitoring System

See Equipment List for details

28 US Army Locations

See Site Information for details

FOB: Destination

RADIATION DOSE MONITORING SYSTEM

FFP

Dose Monitoring System

See Equipment List for details

25 US Air Force Locations

OPTION RADIATION DOSE MONITORING SYSTEM

FFP

Dose Monitoring System

See Equipment List for details

1 Defense Health Agency Location

OPTION RADIATION DOSE MONITORING SYSTEM

FFP

Dose Monitoring System

See Equipment List for details

1 Veterans Administration Location

MDRA

FFP

Completed Gold Section returned to Naval Medical

Logistics Command (NMLC) within 7 days after award.

ADMINISTRATIVE INFORMATION

THE POINT OF CONTACT FOR ADMINISTRATIVE CONCERNS FOR THIS ORDER AT NAVAL MEDICAL

LOGISTICS COMMAND, 693 NEIMAN STREET, FORT DETRICK, MD 21702 IS ANDREW A. HAMPTON, 301-619-3115, ANDREW.A.HAMPTON3.CIV@MAIL.MIL.

CONTRACTOR SUPPORT

Notice: Navy Use of Support Contractor for Contract Closeout Functions

Naval Medical Logistics Command (NMLC) uses two private contractors in support of the contract closeout process. Those companies are Contracting Resources Group (CRG) of Federal Hill, MD, doing business under the authority of the Small Business Administration’s 8(a) program and the Ability One Program, doing business under the authority of the Javits-Wagner O’Day Act (41 U.S.C. § 47).

The contract closeout process includes activities such as processing deobligation modifications, obtaining contractor and requiring activity concurrence, preparing the DD-Form 1594 (Contract Completion Statement), and preparing closed files for archiving. Support contractors may perform additional administrative duties, including filing and processing simple administrative modifications. Performing these functions require the contractor employees to have access to the contract file. Therefore, information you provide to the Government or information already in the possession of the Government may be viewed by these support contractors in the course of performing contract close-out functions. The information that may be made available to the contractor may include pricing and technical proposals and performance information.

NMLC has signed Non-Disclosure Agreements with each support contractor employee and has required both contractors to provide a Conflict of interest Mitigation Plan to ensure these employees are firewalled from all business development activity.

By submission of a proposal, the offeror and its subcontractors consent to access of their business sensitive/confidential or proprietary data by the Government’s support contractor personnel in order to perform close out services.

INSTRUCTIONS TO OFFERORS

This is a Brand Name Only requirement. This section specifies the format and content that Offerors shall use in this

Request for Proposal (RFP). Offerors shall submit a proposal that is legible and comprehensive enough to provide the basis for a sound evaluation by the Government. Any proposal which does not provide, as a minimum, that which is required in the solicitation may be determined to be substantially incomplete and not warrant any further consideration.

Proposals shall be submitted by email only as an MS Word or Adobe PDF attachment to Andrew Hampton at andrew.a.hampton3.civ@mail.mil. Proposals are due by 3:00 pm local on 07 August 2015.

Any questions must be addressed to andrew.a.hampton3.civ@mail.mil by email only no later than 3:00 pm local time on 17 July 2015. No phone calls accepted.

All Offerors shall provide the following company details:

Complete company name and address

Company Point of Contact (POC)

Email

Phone Number

Cage Code

DUNS number

Place of Manufacture

Technical

The Offerors shall include information to enable the evaluation of the proposed system and its conformance to the specified brand name by part number, manufacturer and description.

mailto:andrew.a.hampton3.civ@mail.mil.

mailto:andrew.a.hampton3.civ@mail.mil mailto:kasey.l.carroll.civ@mail.mil

The Offerors shall complete the blue section of the Medical Device Risk Assessment (MDRA) located at http://www.med.navy.mil/sites/nmlc/Pages/DBU-RFP.aspx.

Past Performance

Offerors shall provide recent and relevant contracts for the same or similar items and other references for up to five (5) data points within the last three (3) years. Past performance older than three (3) years will be considered not relevant. The Government reserves the right to consider other past performance information at its disposal, in addition to any information obtained from the references provided above.

The data shall for each reference shall include:

o Organization/Location o Valid POC with phone number and email o Contract Number o Contract Date o Total Contract Value o Description of the requirement

The total number of the pages submitted for past performance shall not exceed seven (7) pages, excluding a cover letter. If past performance contains more than seven (7) pages, only the first seven (7) pages will be evaluated.

Price

The Offerors shall provide pricing for all line items and a total contract price (all line items)

The Offerors shall provide acknowledgement of the solicitation and of any amendments.

The proposed price will be evaluated by the Government and must be determined to be fair and reasonable for award.

Other Administrative Instructions

The Offerors shall complete and submit DFARS Provision 252.209-7992 Representation by Corporations

Regarding an Unpaid Delinquent Tax Liability or a Felony Conviction under any Federal Law—Fiscal

Year 2015 Appropriations.

Contractors must be registered in the System for Award Management (SAM) database at time of award.

Registration is free and can be completed on-line at https://www.sam.gov/portal/public/SAM/.

Small Business Subcontracting Plan:

1. If applicable (for other than small business concern offerors under the assigned NAICS code herein), the offeror shall submit a subcontracting plan in accordance with FAR Clause 52.219-9 and DFARS Clause 252.219-7003 (for reference see FAR 19.704 and DFARS 219.704). The subcontracting plan requirement is not applicable to small business concerns qualified as such under the NAICS code assigned to this solicitation. Master subcontracting plans can be included as an appendix to the subcontracting plan.

2. The Contracting officer will review the subcontracting plan for acceptability. If an offeror fails to negotiate a subcontracting plan acceptable to the Contracting Officer within the time limit prescribed by the Contracting Officer, the offeror will be ineligible for award. If the offeror believes there are no subcontracting possibilities, the offeror shall submit documentation sufficient to support its position.

BASIS OF AWARD

This requirement will be evaluated as a Lowest Price Technically Acceptable (LPTA) requirement. Award will be made on the basis of the lowest evaluated price of proposals that meet or exceed the non-price factors. The

Government anticipates award of a firm fixed price (FFP) contract.

The Government intends to evaluate proposals and award a contract without discussions, but reserves the right to conduct discussions if later determined by the Contracting Officer to be necessary. The Government reserves the right to make no award as a result of this solicitation.

http://www.med.navy.mil/sites/nmlc/Pages/DBU-RFP.aspx https://www.sam.gov/portal/public/SAM/

Technical Evaluation Factors

The Offeror with the lowest overall proposed price and determined technically acceptable will receive an award and no further offers will be evaluated.

Conformance to Essential Characteristics

Evaluation shall include the ability to meet the brand name of this requirement. Offerors not meeting all requirements will not be further considered for award unless there are no other technically acceptable

Offerors.

Conformance to IA Requirements

The government will evaluate the capability of the proposed system to meet the Information Assurance

(IA) requirements for the Department of Navy. This evaluation will be based on the information provided in the completed IA documentation. See “Technical” under “Instructions to Offerors”; Medical Device

Risk Assessment (MDRA).

Past Performance

The government will evaluate the offeror's recent relevant past performance record as to (1) the quality and timeliness of delivery that the vendor has supplied to its customers, and (2) a determination whether it is relevant or non-relevant. This determination will be made for each past performance. A relevancy determination may be made based solely on the information provided on the past performance. It will be rated as acceptable or unacceptable.

The Government reserves the right to utilize other information not provided by the vendor and will evaluate information readily available. It is the responsibility of the offeror to ensure names and phone numbers of points of contact are verified and accurate. In the case of an offeror without a record of relevant past performance or for whom information on past performance is not available, the offeror will not be evaluated favorably or unfavorably on past performance (FAR 15.305(a)(2)(iv)). The offeror will receive a neutral rating.

Price

Reasonableness: The degree to which the Offeror’s total proposed price represents a fair and reasonable price, including any additional components that must be purchased to make the system fully functional.

Completeness: Offeror’s have included pricing for all line items, are registered in SAM at time of award and have provided acknowledgement of all amendments.

OTHER CONTRACTING REQUIREMENTS

All Department of the Navy (DON) information systems as defined in Department of Defense Directive (DoDD)

8500.1 shall be certified and accredited (C&A) for operation. C&A is attained via the Defense Information

Assurance Certification and Accreditation Process (DIACAP) and is applicable to all DON-owned or controlled information systems that receive, process, store, display or transmit Department of Defense (DoD) information, regardless of Mission Assurance Category (MAC) classification or sensitivity, except, per DoDD 8500.1 Paragraph

2.3; IT that is considered Platform Information Technology (PIT). Regardless of whether the system or device is considered PIT or whether it is determined that it requires a full accreditation, the following DIACAP artifacts shall be included with your proposal; System Identification Profile (SIP), DIACAP Implementation Profile (DIP), and

Plan of Actions and Milestones (POA&M). A template has been included with this solicitation as “Appendix X”.

Completion of this form in its entirety will satisfy the requirement for the SIP, DIP and POA&M.

The contractor shall establish appropriate administrative, technical, and physical safeguards to protect all government data, to ensure the confidentiality, integrity, and availability of government data under their control. At a minimum, this shall include provisions for personnel, electronic, and physical security.

Navy PIT Designation

Certain medical technologies may be designated as PIT by the Navy Operational Designated Accrediting Authority

(ODAA); however the PIT designation itself does not constitute an Approval to Operate (ATO). The PIT system will require a PIT Risk Analysis (PRA). The DIACAP SIP, DIP, POA&M and Risk Analysis documents are required in order to complete a PRA. Contractors will be required to scan the PIT system for vulnerabilities prior to delivery.

According to DoDD 85001, Paragraph E2.1.16.4; PIT refers to computer resources, both hardware and software, that are physically part of, dedicated to, or essential in real time to the mission performance of special-purpose systems. Medical technologies, and specifically medical imaging and monitoring systems are considered special-purpose mission technologies according to this definition.

The PIT designation issued by the ODAA may be used by the Program Manager (PM) to complete a PRA in order to prove compliance with C&A requirements, but is cautioned that the appropriate IA controls must still be built into the IT to comply with acquisition requirements. The contractor shall work with Navy Program Managers to ensure their systems meet these requirements.

The Contractor will be required to propose an acceptable approach to selecting IA controls starting from the baseline set on DoD Instruction 8500.2 B, commensurate with the system’s Mission Assurance Category (MAC) and Confidentiality Level. For medical devices and systems the MAC level assigned is typically MAC III sensitive.

If the system or device is determined to be PIT, the Contractor shall support Navy

Medicine IA representatives in creation of the PIT designation request packages to include all relevant configuration, software and IA data. The following documents will assist is creating the PIT designation request package;

Digital Imaging and Communications in Medicine (DICOM) Conformance

Statement (if applicable)

Food and Drug Administration (FDA) Certification (510k)

Integrating the Healthcare Enterprise (IHE) Integration Statement

International Organization for Standardization (ISO) Statement (if applicable)

Manufacturer Disclosure Statement for Medical Device Security (MDS2)

A full system diagram to include any PIT to PIT or other interconnections

DIACAP

For those systems that do not meet the requirements for designation as PIT, the contractor shall comply with

DIACAP requirements as specified by the DoD that meet appropriate DoD and Navy IA requirements. The contractor shall initiate the process by providing the required documentation necessary to receive an ATO. The contractor shall make their device or system delivered against this contract available for C&A testing and initiate the process well in advance of a contract delivery order. The requirements shall be met before the contractor's system is authorized to access DoD data or interconnect with any DoD network that receives, processes, stores, displays or transmits DoD data. An ATO, at a minimum, will be required before a device or system is installed. The contractor shall ensure that the proper contractor support staff is available to participate in all phases of the DIACAP process.

They include but are not limited to;

Completing and maintaining all documentation necessary to obtain an ATO.

Attending and supporting DIACAP and C&A meetings with Navy IA representatives.

Supporting/conducting the vulnerability mitigation process to comply with IA controls listed in DoD Instruction 8500.2.

Supporting the C&A Team during system security testing.

Contractors must confirm that their systems are locked down prior to initiating C&A testing.

Post-Accreditation Review

An annual IA review shall be conducted that comprehensively evaluates existing policies and processes to ensure procedural consistency and that the IS continues to operate in the manner to which it was accredited. The annual review process should account for the analysis of projected policy needs, and produce a plan for development or implementation of new policies or processes.

Personnel Security and User Access Control

The contractor shall comply with DoDD 8500.1, “Information Assurance (IA)”, DoD Instruction (DODI) 8500.2

“Information Assurance (IA) Implementation”, DoDD 5400.11, “DoD Privacy Program”, DoD 6025.18-R, DoD

Health Information Privacy Regulation and DoD 5200.2-R, “Personnel Security Program Requirements”.

Contractor responsibilities for ensuring personnel security include, but are not limited to meeting the following requirements:

Follow the Privacy Office guidelines for submittal of IT security clearances and ensure all contractor personnel are designated as IT-I, IT-II or IT-III where their duties meet the criteria of the position sensitivity designations.

Because of the unique circumstances presented by DoD and DON networks, personnel security requirements shall be followed to ensure appropriate precautions are taken prior to allowing vendor personnel access to the network.

Any vendor personnel that will be accessing the medical device/system while installed on the hospital network will be required to have a National Agency Check (NAC) completed. Typically, this requires an investigation to support a “Public Trust Position” and requires the person(s) to complete and submit a Standard Form 85P (SF85P), Questionnaire for Public Trust Positions, via the Electronic Personnel Security Questionnaire (EPSQ). Questions relating to SF85Ps and the EPSQ process may be directed to 1-888-282-7682 or online at http://www.dss.mil/index.htm. Contractor personnel accessing equipment connected to the hospital network will be required to complete a System Authorization Access Request-Navy (SAAR-N) (form OPNAV 5239/14). Copies of this form can be obtained from the Navy PACS Office. Additionally, contractor personnel are required to complete the annual DoD IA training requirements.

The contractor shall initiate, maintain and document personnel security investigations appropriate to the individual’s responsibilities and required access to Sensitive Information (SI).

Immediately report to the appropriate Navy POC and deny access to any automated information system (AIS), network, or information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Navy representative for security reasons.

Ensure that all contractor personnel receive IA training before being granted access to DoD AIS’s.

Access to the medical devices will be limited to authorized users as determined by local policy. Vendors whose systems do not yet meet the requirement for CAC authentication must indicate their willingness to do so, and offer a timeline for compliance.

Complete administrative system rights shall be provided to the government System Administrator for the purpose of conducting device vulnerability scans as needed.

Navy Business to Business (B2B) Gateway

All contractor systems that will communicate with DON systems will interconnect through the established Military

Health System (MHS) Business to Business (B2B) gateway. For all Web applications, contractors will connect to the DISA-established Web DMZ.

Contractors will connect to the B2B gateway via a contractor procured Internet Service

Provider (ISP) connection and assume all responsibilities for establishing and maintaining their connectivity to the B2B gateway. This will include acquiring and maintaining the circuit to the B2B gateway and acquiring a FIPS-140-2 Virtual Private

Network (VPN)/Firewall device compatible with the MHS VPN device. Maintenance http://www.dss.mil/index.htm and repair of contractor procured VPN equipment shall be the responsibility of the contractor.

Contractors shall configure their network to support access to government systems (e.g., configure ports and protocols for access).

Contractors shall provide full time connections to a TIER1 or TIER2 ISP. Dial-up ISP connections are not acceptable.

Contractors will comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies

Prior to accessing DON, all contractors will be required to complete a DISA Form 2875 System Authorization

Access Request form (SAAR) and submit it to NMLC, Code 03, Imaging Informatics Division for processing. The contractor will be required to complete applicable DoD IA training.

IPv6

The proposed system shall be Internet Protocol version 6 (IPv6) capable or the vendor must provide a detailed project, migration or planning documentation to show when the proposed system shall be IPv6 capable.

Minimum IPv6 capabilities include:

Conformant with the IPv6 standards profile contained in the DoD IT Standards Registry (DISR);

Maintaining interoperability in heterogeneous environments with IPv4;

Commitment to upgrade as the IPv6 standard evolves;

Availability of vendor IPv6 technical support.

The contractor must be able to demonstrate or provide documentation to prove that their product is IPv6 capable. As described in the DISR IPv6 standards profile, application vendors are expected to scan and test their code for IPv6 compliance and provide a letter of compliance indicating to what degree they comply. The letter shall be in vendor format and describe the standards used for testing and the results of the scans. IPv6 'capable' is defined as having the capability of receiving, processing and forwarding IPv6 packets and/or interfacing with other IPv6 capable systems/devices and in a manner similar to IPv4. In order to demonstrate IPv6 compliance, the vendor should submit the following documentation:

Provide a diagram showing IPv6 core configuration, to include IPv6 addressing, internal network connectivity and topology, external network connectivity, and IPv6 traffic flow;

Submit a list of core components to include vendor/manufacturer IPv6 compliance;

Submit a report that illustrates testing of IPv6 compliance, to include test scripting, logs and results.

Information Assurance Vulnerability Management (IAVM)

IAVM is focused on maintaining a secure platform as new vulnerabilities and exploits are discovered and released through various software developers and security agencies. The core tool of successful IAVM is the Information

Assurance Vulnerability Alert (IAVA). The DoD releases IAVAs for local action on the various platforms across the enterprise network. Each Navy Healthcare Facility is responsible for managing their local network. Most DoD

IAVAs originate from a real world event such as a patch release or vulnerability notification from a software vendor

(e.g. Windows or Sun patch release), or a US-CERT released from the CERT Coordination Center at Carnegie

Mellon University. To have an effective IAVM program, vendors must be proactive in monitoring emerging threats.

Some recommended sources for IAVM support are:

General Vulnerability alerts, all platforms: http://www.cert.org/nav/index_red.html

Microsoft security resources: http://www.microsoft.com/technet/security/bulletin/notify.mspx

SUN Microsystems Security resources: http://sunsolve.sun.com/pub-cgi/show.pl?target=security/sec

As part of the IAVM program, the contractor shall provide a primary and secondary point of contact for compliance actions. The point of contact shall provide, upon receipt of a vulnerability message, an acknowledgement of that receipt. The vendor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to http://www.cert.org/nav/index_red.html http://www.microsoft.com/technet/security/bulletin/notify.mspx http://sunsolve.sun.com/pub-cgi/show.pl?target=security/sec the system, report compliance. Receipt and compliance messages shall occur within the stipulated time window, as stated in the vulnerability message or other official notification.

Any vendor interested in meeting this requirement shall have a documented process to demonstrate an organizational culture embracing security throughout the system lifecycle. The processes shall clearly demonstrate security’s role in the product development phase, and the processes the vendor employs to react to vulnerabilities, validate required patches, communicate status and required actions to their customers, and the follow up service support to address patch implementation.

Health Insurance Portability and Accountability Act (HIPAA)

The contractor shall comply with the HIPAA Act of 1996 (Public Law 104-191) requirements, specifically the administrative simplification provision s of the law and the associated rules and regulations published by the

Secretary, Health and Human Services (HHS). This includes the Standards for Electronic Transactions, the

Standards for Privacy of Individually Identifiable Health Information and the Security Standards.

Business Associate Agreement

In accordance with DoD 6025.18-R “Department of Defense Health Information Privacy Regulation” the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

(a) Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DODI 6025.18-R.

Individual has the same meaning as the term ``individual'' in 45 CFR 164.501 and 164.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term ``protected health information'' in 45 CFR

164.501, limited to the information created or received by The Contractor from or on behalf of The Government.

Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

Required by Law has the same meaning as the term ``required by law'' in 45 CFR 164.501 and 164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part

164, subpart C.

Terms used, but not otherwise defined, in this Clause shall have the same meaning as those terms in 45 CFR

160.103, 164.501 and 164.304.

(b) The Contractor shall not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

(c) The Contractor shall use appropriate safeguards to prevent use or disclosure of the Protected Health

Information other than as provided for by this Contract.

(d) The Contractor shall use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

(e) The Contractor shall mitigate, to the extent practicable, any harmful effect that is known to the

Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Contract.

(f) The Contractor shall report to the Government any security incident involving protected health information of which it becomes aware.

(g) The Contractor shall report to the Government any use or disclosure of the Protected Health

Information not provided for by this Contract of which the Contractor becomes aware of.

(h) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides Protected

Health Information received from, or created or received by the Contractor on behalf of the Government agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

(i) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides electronic

Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

(j) The Contractor shall provide access, at the request of the Government, and in the time and manner designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

(k) The Contractor shall make any amendment(s) to Protected Health Information in a Designated Record

Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government or an

Individual, and in the time and manner designated by the Government.

(l) The Contractor shall make internal practices, books, and records relating to the use and disclosure of

Protected Health Information received from, or created or received by the Contractor on behalf of, the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner designated by the Government or the Secretary, for purposes of the Secretary determining the Government’s compliance with the Privacy Rule.

(m) The Contractor shall document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

(n) The Contractor shall provide to the Government or an Individual, in time and manner designated by the

Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

General Use and Disclosure Provisions

Except as otherwise limited in this Clause, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health

Information would not violate the Privacy Rule, the Security Rule, DoD 6025.18-R or DoD 8580.02-R if done by the Government.

Specific Use and Disclosure Provisions

(a) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(b) Except as otherwise limited in this Clause, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(c) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

(d) Contractor may use Protected Health Information to report violations of law to appropriate Federal and

State authorities, consistent with 45 CFR 164.502(j)(1).

Obligations of the Government

Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

(a) Upon request the Government shall provide the Contractor with the notice of privacy practices that the

Government produces in accordance with 45 CFR 164.520, as well as any changes to such notice.

(b) The Government shall provide the Contractor with any changes in, or revocation of, permission by

Individual to use or disclose Protected Health Information, if such changes affect the Contractor's permitted or required uses and disclosures.

(c) The Government shall notify the Contractor of any restriction to the use or disclosure of Protected

Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

Permissible Requests by the Government

The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by the Government, except for providing Data

Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

Termination

(a) Termination. A breach by the Contractor of this clause, may subject the Contractor to termination under any applicable default or termination provision of this Contract.

(b) Effect of Termination.

(1) If this contract has records management requirements, the records subject to the Clause should be handled in accordance with the records management requirements. If this contract does not have records management requirements, the records should be handled in accordance with paragraphs (2) and (3) below

(2) If this contract does not have records management requirements, except as provided in paragraph (3) of this section, upon termination of this Contract, for any reason, the Contractor shall return or destroy all Protected Health Information received from the Government, or created or received by the Contractor on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the Protected Health

Information.

(3) If this contract does not have records management provisions and the Contractor determines that returning or destroying the Protected Health Information is infeasible, the Contractor shall provide to the

Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the

Government and the Contractor that return or destruction of Protected Health Information is infeasible, the

Contractor shall extend the protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such Protected Health Information.

Miscellaneous

(a) Regulatory References. A reference in this Clause to a section in DoD 6025.18-R, DoD 8580.02-R, Privacy Rule or Security Rule means the section as in effect or as amended, and for which compliance is required.

(b) Survival. The respective rights and obligations of Business Associate under the ``Effect of Termination'' provision of this Clause shall survive the termination of this Contract.

(c) Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the

Government to comply with DoD 6025.18-R, DoD 8580.02-R, Privacy Rule or Security Rule

SITE INFORMATION

US Navy Sites

MTF PACS Vendor VR Product CT Count (2013) RF Count Other X-ray

NMC Portsmouth Fuji Synapse 4.1 PowerScribe 5.0 17,144

5,206 148,636

NMC San Diego Carestream PACS 11.4 Carestream Native

Reporting

22,635 5,100 152,703

NH Beaufort Agfa Impax 6.3 0 None 1,826 267 19,662

NH Bremerton Fuji Synapse 3.2.1 PowerScribe 5.0 6,233

385 27,355

NH Camp Lejeune Agfa Impax 6.4 Talk Technology 4.0 12,465 1761 72,954

NH Camp Pendleton McKesson Radiology

PowerScribe 5.0 6,731 962 64,847

NH Jacksonville Agfa Impax 6.5 PowerScribe 5.0 6,777 698 49,141

NH Lemoore Fuji Synapse 3.2.1 PowerScribe 5.0 1,384 68 11,136

NH Pensacola Agfa Impax 6.5 Talk Technology 4.0 4,968 265 44,022

NH 29 Palms Agfa Impax 6.3 Talk Technology 4.0 2,018 162 13,428

USNH Guam Fuji Synapse 3.2.1 PowerScribe 5.0 2,396 194 12,922

UNSH Okinawa Fuji Synapse 3.2.1 PowerScribe 5.0 6,917 470 27,402

USNH Yokosuka Fuji Synapse 3.2.1 PowerScribe 5.0 1400 177 21,100

USNH Naples Agfa Impax 6.4 None 883 87 5,348

USNH Rota Agfa Impax 6.4 None 469 46 3,111

USNH Sigonella Agfa Impax 6.4 None 464 16 4,987

NHC Charleston Fuji Synapse 3.2.1 None 840 0 8,035

NHC Cherry Point Agfa Impax 6.4 Talk Technology 4.0 462 152 12,388

NHC Corpus Christi Fuji Synapse 3.2.1 PowerScribe 5.0 0 34 4,478

NHC New England Agfa Impax 6.4 Talk Technology 4.0 0 0 17,410

96,012 16,050 721,065

US Army Sites

MTF PACS Vendor VR Product CT Count Other X-ray

Brooke AMC Ft Sam Houston TX AGFA IMPAX 6.5 PowerScribe 360 41,000 130,000

Blanchfield ACH - Ft Campbell, KY AGFA IMPAX 6.5 PowerScribe 360 11,488 64,274

Eisenhower AMC - Ft Gordon, GA AGFA IMPAX 6.5 PowerScribe 360 14,754 73,528

Moncrief ACH - Ft. Jackson, SC AGFA IMPAX 6.5 PowerScribe 360 3,882 32,206

Winn ACH - Ft Stewart, GA AGFA IMPAX 6.5 PowerScribe 360 5,728 46,346

Lyster ACH - Ft Rucker, AL AGFA IMPAX 6.5 No Servers 822 9,320

Martin ACH - Ft Benning, GA AGFA IMPAX 6.5 PowerScribe 360 10,886 63,291

Reynolds ACH - Fort Sill, OK AGFA IMPAX 6.5 PowerScribe 360 8,630 38,834

Madigan AMC - JB Lewis-McCord, WA Pending selection of new system

PowerScribe 360 27,000 104,000

Bassett ACH - Ft Wainwright, AK Pending selection of new system

(No Servers) 9,100 24,700

Weed ACH - Ft Irwin, CA AGFA IMPAX 6.5 (No Servers) 1,600 8,000

William Beaumont AMC - Ft Bliss, TX AGFA IMPAX 6.5 PowerScribe 360 16,000 77,000

Evans ACH - Ft Carson, CO AGFA IMPAX 6.5 PowerScribe 360 11,500 57,200

General Leonard Wood ACH - Ft

Leonard Wood, MO

AGFA IMPAX 6.5 PowerScribe 360 7,500 39,300

Irwin ACH - Ft Riley, KS AGFA IMPAX 6.5 PowerScribe 360 4,500 33,500

Tripler AMC, Hawaii Fuji Synapse 4.2 PowerScribe 360 13,917 110,732

Brian Allgood ACH - Seoul S. Korea Fuji Synapse 4.3 PowerScribe 360 1,765 27,140

Landstuhl RMC, Germany Fuji Synapse 4.3 PowerScribe 360 7,900 40,000

Womack AMC - Ft Bragg, NC AGFA IMPAX 6.3 PowerScribe 360 18,465 113,453

Ireland ACH - Ft Knox, KY AGFA IMPAX 6.3 PowerScribe 360 6,781 35,194

Keller ACH - West Point, NY AGFA IMPAX 6.3 PowerScribe 360 1,554 9,538

McDonald ACH - Ft Eustis, VA AGFA IMPAX 6.3 PowerScribe 360 1,090 17,471

Kimbrough AHCC - Ft Meade, MD AGFA IMPAX 6.3 PowerScribe 360 1,627 13,322

Carl R Darnall AMC, Ft Hood TX AGFA IMPAX 6.3 PowerScribe 360 13,000 65,000

Munson AHC - Ft Leavenworth KS AGFA IMPAX 6.5 (No Servers) 0 13,000

RW Bliss AHC- Ft Huachuca AZ AGFA IMPAX 6.5 (No Servers) 0 8,000

Guthrie AHC - Ft Drum NY AGFA IMPAX 6.3 PowerScribe 360 0 12,000

Kenner AHC - Ft Lee VA AGFA IMPAX 6.3 PowerScribe 360 0 20,000

224,807 1,286,349

US Air Force Sites

Davis Monthan IMPAX 6.3 Talk 3.2 7,90 9,290

Langley IMPAX 6.3 Talk 3.2 3,902 27,404

Mountain Home IMPAX 6.3 Talk 4.1 549 3,272

Nellis IMPAX 6.3 Talk 3.2 7,672 35,904

Offutt Fuji 3.2 Talk 4.1 1,979 13,090

Tyndall IMPAX 6.3 Talk 3.2 1,020 6,478

Keesler IMPAX 6.3 Talk 3.2 9,470 36,298

Lackland IMPAX 6.3 Powerscribe 5.0 4,987 48,950

Luke IMPAX 6.3 Talk 4.1 2,114 15,776

Maxwell IMPAX 6.3 Not a reading site 844 5,104

Sheppard IMPAX 6.3 Not a reading site 627 4,618

Andrews IMPAX 6.3 Talk 4.1 4,747 23,909

Barksdale IMPAX 6.3 Not a reading site 582 7,057

Eglin IMPAX 6.3 Talk 4.1 7,500 44,031

Wright-Patterson Fuji 3.2 Talk 4.1 9,791 40,581

MacDill IMPAX 6.6 Talk 4.1 1,850 22,198

Scott IMPAX 6.3 Talk 3.2 1,420 10,709

Travis IMPAX 6.3 Talk 4.1 10,018 43,472

Misawa Fuji 3.2 Talk 4.1 667 3,548

Osan Fuji 3.2 Talk 4.1 1,322 9,520

Yokota Fuji 3.2 Talk 4.1 567 3,420

AF Academy IMPAX 6.3 Talk 4.1 2,414 20,958

Aviano IMPAX 6.3 Talk 4.1 180 3,167

RAF Lakenheath IMPAX 6.3 Powerscribe to Talk 4.1 2,258 14,550

Elmendorf Fuji 3.2 Powerscribe 5.0 4,307 70,396

80,787 523,700

Defense Health Agency Site

Fort Belvoir ACH, Ft Belvoir, VA AGFA IMPAX 6.4 Talk Technology 4.1 20,000 70,000

Veterans Administration Site

MTF PACS Vendor VR Product CT Count (2013) RF Count Other X-ray

CAPT James A. Lovell

FHCC

Agfa Impax 6.5 Talk Technology 4.0 N/A

0 20,605

EQUIPMENT LIST

US Navy

ITEM QTY DESCRIPTION UNIT

ME-84969711 1 84969711 - EXP-4 - CT/IR PROCEDURE VOLUME <= 250,000 EA

ME-84969789 1 84969789 - EXP-CRDR - CR/DR PROCEDURES EA

ME-84970019 20 84970019 - EXP-PS - INSTALLATION AND IMPLEMENTATION EA

ME-84283975 20 84283975 - SERVER, INFORMATICS, SMALL TO MEDIUM, R EA

ME-84286907 20 84286907 - Informatics Server Racking Service EA

ME-84970019-A 20 84970019-A - EXP-PS - INSTALLATION AND

IMPLEMENTATION

EA

ME-84970019-B 20 84970019-B - EXP-PS - INSTALLATION AND

IMPLEMENTATION

EA

US Army

ME-84969711 1 84969711 - EXP-4 - CT/IR PROCEDURE VOLUME <= 250,000 EA

ME-84969789 1 84969789 - EXP-CRDR - CR/DR PROCEDURES EA

ME-84970019 28 84970019 - EXP-PS - INSTALLATION AND IMPLEMENTATION EA

ME-84283975 28 84283975 - SERVER, INFORMATICS, SMALL TO MEDIUM, R EA

ME-84286907 28 84286907 - Informatics Server Racking Service EA

ME-84970019-A 28 84970019-A - EXP-PS - INSTALLATION AND

IMPLEMENTATION

EA

ME-84970019-B 28 84970019-B - EXP-PS - INSTALLATION AND

US Air Force

ME-84969711 1 84969711 - EXP-4 - CT/IR PROCEDURE VOLUME <= 250,000 EA

ME-84969789 1 84969789 - EXP-CRDR - CR/DR PROCEDURES EA

ME-84969797 1 84969797 - EXP-MG - MAMMOGRAPHY PROCEDURES EA

ME-84970019 25 84970019 - EXP-PS - INSTALLATION AND IMPLEMENTATION EA

ME-84283975 25 84283975 - SERVER, INFORMATICS, SMALL TO MEDIUM, R EA

ME-84286907 25 84286907 - Informatics Server Racking Service EA

ME-84970019-A 25 84970019-A - EXP-PS - INSTALLATION AND IMPLEMENTATION EA

ME-84970019-B 25 84970019-B - EXP-PS - INSTALLATION AND IMPLEMENTATION EA

Defense Health Agency

ME-84969711 1 84969711 - EXP-4 - CT/IR PROCEDURE VOLUME <= 250,000 EA

ME-84970019 1 84970019 - EXP-PS - INSTALLATION AND IMPLEMENTATION EA

ME-84283975 1 84283975 - SERVER, INFORMATICS, SMALL TO MEDIUM, R EA

ME-84286907 1 84286907 - Informatics Server Racking Service EA

ME-84970019-A 1 84970019-A - EXP-PS - INSTALLATION AND

IMPLEMENTATION

EA

ME-84970019-B 1 84970019-B - EXP-PS - INSTALLATION AND

Veterans Administration

ME-84969711 1 84969711 - EXP-4 - CT/IR PROCEDURE VOLUME <= 250,000 EA

ME-84969789 1 84969789 - EXP-CRDR - CR/DR PROCEDURES EA

ME-84970019 1 84970019 - EXP-PS - INSTALLATION AND IMPLEMENTATION EA

ME-84283975 1 84283975 - SERVER, INFORMATICS, SMALL TO MEDIUM, R EA

ME-84286907 1 84286907 - Informatics Server Racking Service EA

ME-84970019-A 1 84970019-A - EXP-PS - INSTALLATION AND

IMPLEMENTATION

EA

ME-84970019-B 1 84970019-B - EXP-PS - INSTALLATION AND

LOCATIONS

US Navy Sites (20) US Army Sites (28) US Air Force

Sites (25)

Defense Health

Agency Site (1)

Veterans

Administration

Site (1) NMC Portsmouth Brooke AMC Ft Sam

Houston TX

Davis Monthan Fort Belvoir ACH, Ft Belvoir, VA CAPT James A.

Lovell FHCC

NMC San Diego Blanchfield ACH - Ft

Campbell, KY

Langley

NH Beaufort Eisenhower AMC - Ft

Gordon, GA

Mountain Home

NH Bremerton Moncrief ACH - Ft.

Jackson, SC

Nellis

NH Camp Lejeune Winn ACH - Ft Stewart, GA

Offutt

NH Camp Pendleton Lyster ACH - Ft

Rucker, AL

Tyndall

NH Jacksonville Martin ACH - Ft

Benning, GA

Keesler

NH Lemoore Reynolds ACH - Fort

Sill, OK

Lackland

NH Pensacola Madigan AMC - JB

Lewis-McCord, WA

Luke

NH 29 Palms Bassett ACH - Ft

Wainwright, AK

Maxwell

USNH Guam Weed ACH - Ft Irwin, CA

Sheppard

UNSH Okinawa William Beaumont

AMC - Ft Bliss, TX

Andrews

USNH Yokosuka Evans ACH - Ft Carson, CO

Barksdale

USNH Naples General Leonard Wood

ACH - Ft Leonard

Wood, MO

Eglin

USNH Rota Irwin ACH - Ft Riley, KS

Wright-Patterson

USNH Sigonella Tripler AMC, Hawaii MacDill NHC Charleston Brian Allgood ACH -

Seoul S. Korea

Scott

NHC Cherry Point Landstuhl RMC, Germany

Travis

NHC Corpus Christi Womack AMC - Ft

Bragg, NC

Misawa

NHC New England Ireland ACH - Ft Knox, KY

Osan

Keller ACH - West

Point, NY

Yokota

McDonald ACH - Ft

Eustis, VA

AF Academy

Kimbrough AHCC - Ft

Meade, MD

Aviano

Carl R Darnall AMC, Ft

Hood TX

RAF Lakenheath

Munson AHC - Ft

Leavenworth KS

Elmendorf

RW Bliss AHC- Ft

Huachuca AZ

Guthrie AHC - Ft Drum

NY

Kenner AHC - Ft Lee

VA

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government

0002 Destination Government Destination Government

0003 Destination Government Destination Government

0004 Destination Government Destination Government

0005 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC

0001 30-SEP-2015 SEE ATTACHED DELIVERY ADDRESS

SEE ATTACHED

SEE ATTACHED DELIVERY ADDRESS

SEE ATTACHED AA

XXXXXX

0002 30-SEP-2015 (SAME AS PREVIOUS LOCATION)

0003 30-SEP-2015 (SAME AS PREVIOUS LOCATION)

0004 N/A N/A N/A N/A

0005 N/A N/A N/A N/A

CLAUSES INCORPORATED BY REFERENCE

52.203-3 Gratuities APR 1984

52.204-7 System for Award Management JUL 2013

52.204-13 System for Award Management Maintenance JUL 2013

52.209-7 Information Regarding Responsibility Matters JUL 2013

52.212-1 Instructions to Offerors--Commercial Items APR 2014

52.212-4 Contract Terms and Conditions--Commercial Items DEC 2014

52.217-5 Evaluation Of Options JUL 1990

52.219-9 (Dev) Small Business Subcontracting Plan (Deviation 2013-O0014) OCT 2014

52.232-40 Providing Accelerated Payments to Small Business

Subcontractors

DEC 2013

52.247-34 F.O.B. Destination NOV 1991

252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7005 Representation Relating to Compensation of Former DoD

Officials

NOV 2011

252.204-7012 Safeguarding of Unclassified Controlled Technical

Information

NOV 2013

252.204-7015 Disclosure of Information to Litigation Support Contractors FEB 2014

252.205-7000 Provision Of Information To Cooperative Agreement Holders DEC 1991

252.211-7008 Use of Government-Assigned Serial Numbers SEP 2010

252.219-7003 Small Business Subcontracting Plan (DOD Contracts) OCT 2014

252.222-7007 Representation Regarding Combating Trafficking in Persons JAN 2015

252.223-7008 Prohibition of Hexavalent Chromium JUN 2013

252.225-7012 Preference For Certain Domestic Commodities FEB 2013

252.225-7021 Trade Agreements--Basic (Nov 2014) NOV 2014

252.226-7001 Utilization of Indian Organizations and Indian-Owned

Economic Enterprises, and Native Hawaiian Small Business

Concerns

SEP 2004

252.232-7003 Electronic Submission of Payment Requests and Receiving

Reports

JUN 2012

252.232-7010 Levies on Contract Payments DEC 2006

252.243-7001 Pricing Of Contract Modifications DEC 1991

252.243-7002 Requests for Equitable Adjustment DEC 2012

252.244-7000 Subcontracts for Commercial Items JUN 2013

252.247-7023 Transportation of Supplies by Sea APR 2014

CLAUSES INCORPORATED BY FULL TEXT

52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL ITEMS (MAR 2015)

ALTERNATE I (OCT 2014)

The offeror shall complete only paragraphs (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) Web site accessed through http://www.acquisition.gov . If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (p) of this provision.

(a) Definitions. As used in this provision--

“Economically disadvantaged women-owned small business (EDWOSB) concern” means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127. It automatically qualifies as a women-owned small business eligible under the WOSB Program.

“Forced or indentured child labor” means all work or service—

(1) Exacted from any person under the age of 18 under the menace of any penalty for its nonperformance and for which the worker does not offer himself voluntarily; or

(2) Performed by any person under the age of 18 pursuant to a contract the enforcement of which can be accomplished by process or penalties.

“Highest-level owner” means the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offeror. No entity owns or exercises control of the highest level owner.

“Immediate owner” means an entity, other than the offeror, that has direct control of the offeror. Indicators of control include, but are not limited to, one or more of the following: Ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees.

“Inverted domestic corporation,” means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C. 395(b), applied in accordance with the rules and definitions of 6 U.S.C. 395(c).

“Manufactured end product” means any end product in product and service codes (PSCs) 1000-9999, except— http://www.acquisition.gov/

(1) PSC 5510, Lumber and Related Basic Wood…