Solicitation_Attachments.docx

ATTACHMENTS

1. Performance Work Statement (PWS)

1. Equipment Listing

1. Business Associate Agreement

1. Lists of Acceptable Documents to Establish U.S. Citizenship

1. CAP (Firm Fixed Price)

Attachment 1: Performance Work Statement (PWS) Pharmacy Dispensing System Support Services

1. GENERAL. The Defense Health Agency (DHA) Pharmacy Operations Division (POD) has a requirement for a service contract for pharmacy equipment, as identified in Attachment 2, Equipment Listing.

2. SCOPE. The Contractor shall provide preventative and corrective maintenance services as outlined below for all equipment identified in Attachment 2, Equipment Listing. The Contractor shall maintain the equipment within the original manufacturer’s specifications, in accordance with Federal, State, and Local laws and regulations, United States (U.S.) Navy and DHA regulations, instructions, and Joint Commission requirements.

2.1 Maintenance shall include regularly scheduled preventative maintenance, inspections, calibrations, and corrective maintenance tasks, and unlimited emergency repair actions.

2.2 The aggregate number of equipment covered under this contract shall fluctuate throughout the term of the contract. This fluctuation may result from the removal of aged, non-repairable, past service life, or past useful life equipment from the service contract, and the addition of new, warranty free equipment or equipment currently on inventory. The aggregate requirement and level of effort will remain relatively constant over the life of the contract. The scope of this contract covers all Naval Medical Treatment Facilities (MTFs), both Contiguous United States (CONUS) and Outside Continental United States (OCONUS); Naval MTFs may be added or removed from this contract when their relevant equipment is purchased or removed, respectively. Once equipment is added or removed, the contract will be modified and the unit price will be adjusted accordingly. To remain within scope of the contract, additional equipment shall represent not more than 20% of the total contract price.

2.2.1 The Contractor shall provide a line item monthly price breakdown for each piece of equipment under contract.

2.3 The Contractor shall comply with the theater and country clearance requirements described herein, see Section 8, for services provided at OCONUS locations.

3. SERVICE VENDOR PERSONNEL QUALIFICATION.

3.1 All work shall be performed by service personnel with original equipment manufacturer (OEM) service training on the products for which they will perform service. Service personnel shall have sufficient experience to demonstrate proficiency in maintenance of the products.

3.2 The Contractor and its personnel shall comply with Section 5.9. Personnel Security and User Access Control.

4. DEFINITIONS.

4.1 Calibration. This activity should be the procedures for the mechanical adjustments of the device to ensure consistent, standardized performance or output as per the original equipment manufacturer recommendations.

4.2 Contracting Officer (KO). A warranted representative of the federal government who has the express authority to enter into, administer, and/or terminate contracts and make related determinations and findings. The KO is the only person authorized to approve changes to any terms, conditions, or requirements of the contract.

4.3 Contracting Officer’s Representative (COR)/Alternate COR. A Government employee appointed by the KO and responsible for the inspection, evaluation, and acceptance of products and services provided in accordance with the terms and conditions of the contract.

4.4 Corrective Maintenance. Repair, adjustment, calibration, software manipulation, or other action taken to return a piece of equipment to original manufacturer specifications following a failure, damage, or other incident that causes the product to no longer perform within the original specifications.

4.5 Downtime. That time, during the pharmacy’s normal business hours, when the equipment is not available for production use due to instrument malfunction, ongoing preventative and/or corrective maintenance, or safety concerns.

4.6 Normal Business Hours (NBH). Those hours, Monday through Friday, (excluding Federal holidays) at each individual pharmacy’s local time, during which the pharmacy is typically open, conducting business, and a service technician would have access to equipment. Federal holidays include New Year’s Day, Memorial Day, Independence Day, Labor Day, Thanksgiving, the day after Thanksgiving, Christmas Eve, Christmas, and New Year’s Eve.

4.7 Preventative Maintenance. Those periodic and “as required” services necessary to maintain equipment in an operating condition which minimizes corrective maintenance, including but not limited to calibration, adjustment, lubrication, updating and upgrading software for security, safety, compliance, and compatibility issues, as well as that testing required to maintain a safe environment of care which includes electrical safety testing, output testing, replacement of batteries and other shelf life components on a scheduled basis (which becomes corrective maintenance if the component fails due to lack of preventative maintenance).

4.8 Quality Assurance (QA). Actions, including inspections performed by the Government, to determine whether products and services conform to contract requirements.

4.9 Quality Control (QC). Actions, including inspections and preparation of inspection records, performed by the Contractor to ensure that products and services conform to contract requirements.

4.10 Update. Modification to current software which provides new features or improves performance or security. Updates are often software patches.

4.11 Upgrade. Replacement of hardware, software, or firmware with a newer or better version, in order to bring the system up to date or to improve its characteristics, provide new capabilities, improve performance, or bring systems into compliance with requirements. Upgrades are often new software versions and hardware components. With the exception of the Windows upgrade described herein, upgrades cannot be determine in advance and should not be included in the monthly rate. Upgrades are considered within the scope of this contract. As the need for an upgrade(s) arises, pricing will be negotiated separately and if agreed upon, will be incorporated into the contract via a written modification. The Contractor shall not provide any upgrades until a written modification is executed and funding is provided.

4.11.1 When offered commercially, the Contractor shall upgrade the Operating System to Windows 10 and Windows Server 2016. The current target completion date for this upgrade is January 2018.

4.12 Uptime. That time, during the pharmacy’s normal business hours, when equipment is available for production use without restrictions to the quality of the results, and without safety hazards to the staff or visitors.

5. PERFORMANCE REQUIREMENTS. The Contractor shall provide telephone help desk support, online support, remote support, and onsite field support for diagnostic services, repair services, and corrective and preventative maintenance. The Contractor shall provide maintenance service on all required equipment, including associated servers and workstations. The Contractor shall provide for all-inclusive parts, labor, materials, travel, personnel, supervision, and shipping costs necessary to perform all maintenance actions covered under this contract, unless otherwise specified, for all equipment identified.

5.1 Response Time. All support requests shall be categorized as either Level 1 or a Level 2. Level 1 indicates a more serious malfunction—typically that the unit is out of service, not labeling or counting. Level 2 indicates a less serious malfunction, where the unit is still functional for filling prescriptions.

5.1.1 For CONUS and Hawaii sites, field technicians will be on site within twenty four (24) hours of a Level 1 call and within forty eight (48) hours of a Level 2 call, excluding Federal holidays. Field dispatches will take place only within the on-site coverage hours (8:00 a.m. through 9:00 p.m., local time, seven (7) days per week excluding Federal holidays).

5.1.2 For all other OCONUS sites, field technicians will be on site within forty eight (48) hours of a Level 1 call and within ninety six (96) hours of a Level 2 call, excluding Federal holidays. Field dispatches will take place only within the on-site coverage hours (8:00 a.m. through 9:00 p.m., local time, five (5) days per week excluding Federal holidays).

5.1.3 The Contractor shall respond to service calls and restore the system according to the following table for various severity levels and service levels:

OCONUS: Remote response within 6 hours of receipt of first call. System restored on 98% of calls within 48 hours of the time the call is opened.

CONUS: System restored on 99% of calls within 24 hours of the time the call is opened, inclusive of any remote troubleshooting

OCONUS: System restored on 99% of calls within 48 hours of the time the call is opened, inclusive of any remote troubleshooting.

CONUS: 90% of calls resolved within 24 hours of the time the call is opened.

OCONUS: 90% of calls resolved within 48 hours of the time the call is opened.

90% of calls resolved within 48 hours of the time the call is opened, inclusive of any remote troubleshooting

CONUS: 90% of calls resolved within 48 hours of the time the call is opened, inclusive of any remote troubleshooting OCONUS: 90% of calls resolved within 96 hours of the time the call is opened, inclusive of any remote troubleshooting

5.2 Uptime. If the Contractor equipment experiences a significant downtime in a given month, the Government will receive discounts for the service fees for that month. The downtime will be verified by the on-site Biomedical Equipment Technician (BMET) and validated by the COR. The support discounts will increase proportionally with the downtime quantity. The following tables provide the support discounts per number of downtime hours according to site location:

Product Operational Downtime – All MTFs, CONUS and OCONUS

To be proposed by the contractor

5.3 Telephonic Support. The Contractor shall provide telephone support between 8:00 a.m. and 11:00 p.m. Eastern Time (ET) each day, seven (7) days per week, excluding Federal holidays. Government calls during off hours shall be directed to Contractor call center and returned by Contractor representative the next day. The Contractor shall document all issues reported by the Government, as well as the means attempted to resolve the issues. Documentation shall be part of the Monthly Status Report, as described in Section 5.5.5 below.

5.4 Remote/Online Support. The Contractor shall provide remote support via a Department of Defense (DoD) Business to Business (B2B) Gateway. The remote support shall include diagnostic services to evaluate system performance and provide appropriate troubleshooting.

5.4.1 The Contractor shall complete all tasks related to the documentation and implementation of B2B Gateway telecommunications links. Tasks include:

5.4.1.1 Coordination among the POD, MTFs, and other contractors as required.

5.4.1.2 Completion of all B2B required documentation.

5.4.1.3 Virtual Private Network (VPN) or related equipment procurement and configuration.

5.4.1.4 Initiation and completion of all testing and implementation activities.

5.5 On-Site Support. If a service problem cannot be resolved during a telephone or remote service sessions within four (4) hours, the Contractor shall initiate a field dispatch service call. During the service visit, the technician shall perform the service without severely impacting the workflow of the department.

5.5.1 Check-In/Out.

5.5.1.1 Check-In. Upon arrival on-site, prior to performing any work, the Contractor shall physically check-in at the Biomedical Department service desk during normal working hours. The biomedical equipment technician (BMET) on duty may accompany the Contractor as an observer during any work performed on-site. If the Contractor arrives on-site after hours, the Contractor shall check in with authorized command personnel such that the site is aware the Contractor is on-site performing services.

5.5.1.2 Check Out. Upon completion of on-site service, the Contractor shall physically check-out at the Biomedical Department. If the Contractor departs after hours, the Contractor shall check in with authorized command personnel such that the site is aware the Contractor is on-site performing services. The Contractor shall supply a service report summarizing the work completed as described in Section 5.5.5 below.

5.5.2 Preventative Maintenance (PM).

5.5.2.1 The Contractor shall perform two (2) annual preventative maintenance visits per MTF. If necessary, the Contractor may combine a preventative maintenance service visit with an onsite service visit. Preventative maintenance service visits shall occur not less than four (4) nor more than eight (8) months from the date of the prior preventative maintenance service visit. Upon arrival, the Contractor shall provide an initial assessment of the operational condition of the system. At the conclusion of the visit and prior to check out, the Contractor shall provide a report detailing the findings and corresponding actions to the site Biomedical Department.

5.5.2.2 The Contractor shall schedule preventative maintenance visits with the Biomedical Department in conjunction with the Pharmacy Department.

5.5.2.3 The Contractor shall provide two (2) staff refresher training sessions, one during each of the preventative maintenance visits, at no additional cost to the Government.

5.5.2.4 PM Sticker. The Contractor shall affix a PM sticker to each piece of equipment upon PM completion which includes the name of the technician who completed the PM and the date of the PM. The PM stickers will be placed upon each piece of counting automation equipment and each server.

5.5.2.5 Equipment in Use. If, for reasons beyond the Contractor’s control, equipment is not made available for maintenance, the Contractor shall immediately notify the COR and the on-site representative it checked in with.

5.5.2.6 Equipment Unable to Locate (UTL). If the Contractor is unable to locate an item within the maintenance window specified, the Contractor shall immediately notify the COR and the on-site representative it checked in with. The COR or on-site representative will determine the availability of the equipment. Equipment which the COR or on-site representative determines to be missing, lost, or stolen shall be exempt from maintenance.

5.5.3 Corrective Maintenance. The Contractor shall provide for any corrective maintenance services necessary to maintain equipment within OEM specifications. Corrective maintenance shall include repair to equipment that results from unintentional damage, whether by the Government or Contractor, for example: component part failures, environmental issues, normal wear and tear, etc. Specifically excluded from coverage are force majeure events and environmental hazards such as fires, floods, acts of nature (earthquakes, hurricanes, tornados, etc.), unregulated power, gas/atmosphere contamination, and physical damage that is not in the normal course of instrument operation.

5.5.4 Parts. The Contractor shall provide service that is all-inclusive of parts, labor, materials, travel, personnel, supervision, and shipping costs necessary to perform all maintenance actions covered under this contract, unless otherwise specified, for all equipment identified and for all equipment that may be added to the contract at a later date.

5.5.4.1 The Contractor shall only use OEM-approved replacement parts.

5.5.5 Service Event Documentation. At the conclusion of every service visit, the Contractor shall provide a report detailing the findings/actions and the corresponding actions accomplished to close each of them. These reports shall be provided to both the Biomedical Department and the Site Project Officer (usually the PharmD) and included with the monthly status report (MSR). For each service work order a report will be facilitated to display:

Name of Contractor;

Contract Number;

Name of Contractor Field Service Technician performing service;

Contractor Log/Control Number (i.e., Work Order Number);

Date, time (beginning and ending), and hours on-site for service call;

Description of problem reported by user;

Equipment identification factors to include: Equipment manufacturer, Model number, serial number, local Equipment Control Number (ECN);

Description of problem identified by the contractor;

Description of service performed, parts used, corrective action taken;

Problem resolution or pending action;

Estimated billing price; and Signature:

Contracting Field Service Technician Signature – performing services; and Authorized Local Site Personnel Signature – verifying service rendered

5.5.5.1 The Contractor shall obtain the Biomedical Department Representative signature if the Biomedical Department is located at the same site as the equipment being serviced. If the equipment be located off-site, the Contractor may email the documentation for signature.

5.5.6 Removal of Equipment. In the event of a non-repairable condition, the Contractor shall provide a system replacement, if needed, unless the replacement is due to local staff abuse, misuse, vandalism, modification, alteration or repairs not performed in accordance with the provided training. All preparations to necessitate hardware replacement, including packing and transportation of the asset shall be performed by the Contractor at no additional cost to the Government. The Contractor shall provide a report to Biomedical Department documenting the following information on any equipment replaced at the site:

Date of removal Make, model number, serial number, and Equipment Control Number (ECN), if available Reason for removal Contract Number Make, model number, and serial number of replacement equipment

5.5.6.1 Any repair necessitated by local staff abuse, misuse, vandalism, modification, alteration or repairs not performed in accordance with the provided training is not part of the scope of this contract. The Contractor shall work with the applicable MTF to determine resolution and if necessary, a proper contract arrangement.

5.5.6.2 The Contractor shall not remove system hard drives from the premises. If hard drives are to be replaced, they should be left at the facility for the Information Technology (IT) Department to dispose of.

5.6 Recalls and Updates.

5.6.1 The Contractor shall provide and install mandatory updates within three (3) business days upon OEM recall or alert notification. The Contractor shall provide documentation of such installation and mandatory updates. The Contractor shall provide hardware, software, drug information, virus protection and operating system updates in order to maintain operational reliability. When hardware updates are required, the Contractor shall dispatch field service technicians to install, test, and support the new hardware elements if the remote support through the B2B has been determined unacceptable or unable to facilitate the corrective action.

5.6.2 The Contractor shall provide minor software updates free of charge. Minor software updates are defined as patches, engineering updates, and software bug fixes. The Contractor shall provide software updates and all other remote software/hardware support via a B2B gateway.

5.6.3 The Contractor shall provide recommended central processing unit (CPU) and server life cycle refresh for P2K (Parata 2000) workstations.

5.6.4 The Contractor shall test critical Windows updates on a monthly basis. The Contractor shall apply applicable Windows updates to the production environment within fifteen (15) calendar days of testing. Customers may request that certain critical Windows patches be tested and validated for use with Contractor products. Critical patch testing requests shall be processed within thirty (30) calendar days.

5.7 Reporting. The Contractor shall provide a MSR for all maintenance services to the COR by the 5th calendar day each month. The report shall include:

1. The raw data supporting the report in an Excel spreadsheet.

1. Information about open, closed, and outstanding service requests.

1. The information provided regarding the services should be in narrative form and not reported as a number or percentage.

1. The information in this report shall be sufficient for the Government to fully understand the issues reported by the MTFs and the contractor's actions.

1. An analysis of the data is required and shall include any trends or patterns as well as proposed reasonable solutions.

1. The Contractor shall include each month an archive of the consolidated Service Reports to coincide with all referenced corrective/preventative events.

1. The MSR will also report and summarize the engineering support to include; HBSS (Host Based Security System), Information Assurance Vulnerability Management (IAVM), Staffing Plan, B2B Gateway Management, as well as any risks, issues, or escalations required addressing them.

1. The MSR will report and summarize any OCONUS operations, including individual travel reports.

5.8 Cybersecurity. Department of Defense Instruction (DoDI) 8500.01 “Cybersecurity” requires that DoD Information Technology (IT) that receives, processes, stores, displays, or transmits DoD information will be acquired, configured, operated, maintained, and disposed of consistent with applicable DoD cybersecurity policies, standards, and architectures. DoDI 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT)” requires the system to be Assessed and Authorized (A&A) once every three (3) years. The results of an annual review or a major change in the cybersecurity posture at any time may also indicate the need for reassessment and reauthorization of the system. This A&A ensures the effective safeguarding of Controlled Unclassified Information (CUI) against unauthorized modification, disclosure, destruction, and denial of service, as directed by the Department of Defense (DoD). The Contractor shall comply with DoDI 8500.01 and DoDI 8510.01, as well as emerging DoD Cybersecurity policy designed to address evolving threats. The Contractor shall perform security control selection in accordance with Committee on National Security Systems (CNSS) Instruction No. 1253, “Security Categorization and Control Selection for National Security Systems”. The Contractor shall implement security controls in accordance with the DoD implementation and validation requirements specified in the Risk Management Framework (RMF) Knowledge Service (KS). The Contractor shall store and maintain the system registration and artifacts in the DHA instantiation of the Enterprise Mission Assurance Support Service (eMASS). The Contractor shall support reciprocity, by providing all directed information to the government. The Contractor shall ensure that United States Cyber Command issuances and Information Assurance Vulnerability Management (IAVM) issuances are assessed, implemented and maintained throughout sustainment.

5.8.1 The Contractor shall provide software security modules for patch management, antivirus definition updates, and software updates. The Contractor shall provide software updates via the B2B gateway.

5.8.2 When applicable, active Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) accreditations shall transition to RMF during the first assessment conducted after 1 October 2016.

5.8.3 Additional information on the Cybersecurity process is included in the attached file:

5.9 Federal Information Security Management Act. The Office of Management and Budget (OMB) Memorandum M-09-29 asserts that agencies are responsible for ensuring information technology acquisitions comply with the information technology security requirements in the Federal Information Security Management Act (44 U.S.C. 3544), OMB’s implementing policies including Appendix III of OMB Circular A-130, and guidance and standards from the National Institute of Standards and Technology (NIST). The Contractor shall, in accordance with DoD regulations, create and deliver to the government, a report consisting of the results of the quarterly and annual Federal Information Security Management Act (FISMA) assessment

5.10 Ports and Protocols. The Contractor shall follow all current DoD and Defense Information Systems Agency (DISA) standards and requirements for acceptable Ports, Protocols, and Services (http://www.disa.mil/Network-Services/Enterprise-Connections/PPSM). Any requests for exception to using the current DISA Ports, Protocols, and Services standards requires a request for exception sent through the COR to the Authorizing Official (AO).

5.11 Public Key Infrastructure Authentication and Encryption. The Contractor shall follow the DoD standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication including authentication to DoD private web servers or applications. Where interoperable PKI is required for the exchange of unclassified information between DoD and its contractors, industry partners shall obtain all necessary certificates when they are not eligible for a DoD Common Access Card (refer to http://iase.disa.mil/pki/eca/ and http://www.cac.mil/). Contractors shall turn over to the Government all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support.

5.11.1 The Contractor shall utilize the latest version of the DHA Authentication Security Plan (ASP) template to detail the implementation of a technical solution for the system and applicable users. Full implementation of the PKI solution must be completed no later than 1 April 2018.

5.12 Disposing of Electronic Media. The Contractor shall follow the DoD standards, procedures and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum, “Disposition of Unclassified Computer Hard Drives,” June 4, 2001. DoD guidance on sanitization of other internal and external media components are found in DoD 5220.22-M, “Industrial Security Program Operating Manual (NISPOM),” Chapter 8.

5.13 Host Based Intrusion Detection The Host Based Security System (HBSS) application monitors, detects, and counters against known cyber-threats to the DoD Enterprise. The HBSS solution will be attached to each host server in the DoD network. The system will be managed by local administrators and configured to address known exploit traffic using an Intrusion Prevention System (IPS) and host firewall. Further information on HBSS can be found at www.disa.mil/Services/Information-Assurance/HBS/HBSS. The Contractor shall follow the DoD standards and procedures and use approved products to install HBSS on the IS/networks involved in the operation of its solution to prevent, detect, track, report, and remediate malicious computer-related activities and incidents.

5.14 Internet Protocol version 6.

5.14.1 The Contractor shall provide commercially available off-the-shelf (COTS) solutions that are Internet Protocol version 6 (IPv6) capable systems or the solution shall be capable of receiving, processing, transmitting, and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to that of IPv4. Specific criteria to be deemed IPv6 capable are:

5.14.1.1 Conformance to the DoD Information Technology Standards Repository (DISR) developed DoD IPv6 Standards Profile.

5.14.1.2 Systems being developed, procured or acquired shall comply with the Global Information Grid Architecture and DISR standard IPv6 Capable definition.

5.14.1.3 An IPv6 Capable system must meet the IPv6 base requirements defined in the “DoD IPv6 Standards Profile”

5.14.1.4 Maintenance of interoperability with IPv4. Systems being developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities

5.14.1.5 Systems should implement IPv4/IPv6 dual-stack and should also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with

5.14.1.5.1 When either protocol is possible, systems should employ IPv6

5.14.1.5.2 Evidence of a migration path and commitment to upgrade all applications and product features (IPv6 Reporting)

5.14.1.5.3 Availability of Contractor IPv6 technical support for system development, implementation, and management

5.14.2 DoD IPv6 security guidelines, standards, and solutions shall be utilized and adhered to when available.

5.15 Personnel Security and User Access Control. Contractor personnel performing work under this contract shall have the appropriate level background investigation for the life of the contract. The Contractor shall abide by the attached “Defense Health Agency, Office of Administration, Support Services Division, Personnel Security Branch Instructions for Contractor Access to DoD IT Systems” (for personnel security requirements to determine appropriate background investigation level for Contractor’s personnel.

5.16 Physical Security. The Contractor shall employ physical security safeguards for Information System (IS)/networks involved in the operation of its systems to prevent the unauthorized access, disclosure, modification, destruction, use, etc., of DoD Sensitive Information (SI) and to otherwise protect the confidentiality and ensure the authorized use of SI. In addition, the Contractor shall support a Physical Security Audit performed by the Government of its internal information management infrastructure.

5.17 Safety Requirements. The Contractor shall take safety precautions as the facilities and/or pharmacy representative may determine to be reasonably necessary to protect the lives and health of occupants of buildings in which work is being performed. The pharmacy representative shall notify the Contractor of any non-compliance with the foregoing conditions and the action(s) to be taken. The Contractor shall, after receipt of such notice, immediately correct the conditions to which attention has been directed. If Contractor refuses to comply promptly, the COR or on-site representative may stop all or any part of the work for safety reasons. Under such circumstances, the KO can hold the service vendor in contract default. Nothing in this section shall be construed so as to limit the Contractor or his sub-contractors responsibilities to comply with any existing law, nor to switch jurisdictions.

5.18 Standards of Conduct. The Contractor shall maintain and enforce standards of conduct for contract employees. The Contractor shall take appropriate corrective action in cases of violation of standards of conduct.

6. Unless otherwise specified, all financial, statistical, personnel and/or technical data which is available to the Contractor during the performance of this contract are considered confidential business information and shall not be used for purposes other than performance of work under this contract nor be released by the Contractor without prior written consent of the COR. Any presentation of any statistical or analytical materials, or any reports based on information obtained from the studies covered by this contract, will be subject to review and approval by the COR before publication or dissemination.

7. ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING APPLICATION (ECMRA)

7.1 The Contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this Contract for the Navy via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

7.2 Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

8. THEATER AND COUNTRY CLEARANCE REQUIREMENTS

8.1 The Contractor shall ensure all U.S. citizen or U.S. resident contractor employees and sub-contractor employees performing services under this contract comply with the training and Theater/Country Clearance requirements listed in the Government Foreign Clearance Guide for the country in which they will be employed. The requirements can be found at https://www.fcg.pentagon.mil/fcg.cfm. Verification of the training shall be made available to the KO or COR upon request.

8.2 The Contractor shall follow specific guidance for the combatant command in whose area the Contractor will be performing services or delivering supplies. This guidance is contained on the respective combatant commander’s operational contract support webpage, which is linked to the procedures at http://www.acq.osd.mil/dpap/pacc/cc/areas_of_responsibility.html, at the weblink for the combatant command for the area in which the contractor will be performing services or delivering items. These pages list prevailing regulations, policies, requirements, host nation laws, orders/fragmentary orders, combatant commander’s directives, unique clauses, and other considerations necessary for contract performance in, or delivery of items to, that combatant commander’s area of responsibility.

9. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

9.1 This QASP serves as the principal basis for assessing the overall quality of the Contractor’s performance. It provides the methodology by which the Contractor's performance will be monitored to determine compliance with required performance objectives and to determine if acceptable quality levels have been met. The plan is designed so that surveillance is limited to that which is necessary to verify that the Contractor is performing at an acceptable level.

9.2 Performance Requirements Summary Table:

9.3 If performance is within acceptable levels, it will be considered to be satisfactory. If not, overall performance may be considered unsatisfactory.

9.4 The COR provides an annual report on Contractor Performance (CPARS or other annual report). The Contractor’s failure to achieve satisfactory performance under the contract/task order, reflected in the COR’s annual report, may result in termination of the contract/task order and may also result in the loss of future Government contracts/task orders. The Contractor’s failure to achieve satisfactory performance under the contract/task order may result in the non-exercise of available options.

9.5 For each item that does not meet acceptable levels, the Government may issue a Contract Discrepancy Report (CDR). CDRs will be forwarded to the Contracting Officer with a copy sent to the Contractor. The Contractor must reply in writing within five (5) calendar days of receipt identifying how future occurrences of the problem will be prevented. Based upon the Contractor’s past performance and plan to solve the problem, the Contracting Officer will determine if any further action will be taken.

9.6 In accordance with contract clause FAR 52.212-4, the Contractor will be incentivized to provide quality products in a timely manner since the Government can require the Contractor, at no additional cost, to replace or correct work that fails to meet contract requirement.

Attachment 2: Equipment Listing The following listing is current as of February 2017:

M-MAX ZONE A PRM+

Attachment 3: Business Associate Agreement

This Business Associate Agreement (BAA) incorporates HIPAA/HITECH Act requirements under the HHS Final Omnibus Rule (78 FR 5566, published 25 Jan 2013), effective 23 Sep 2013. This BAA is for use by MHS components outside of DHA.

Business Associate Agreement

Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where 12 Nov 2013 Page 2 of 10 persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the contractor.

Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the Government facility(s) and office(s) that are supported under this contract.

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

DoD HIPAA Issuances means the…