N6809418R6103_(01).pdf

N6809418RC25108

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to add the Statement of Work as show n in the summary of changes.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 5

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 28-Aug-2018

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X N6809418R6103

X 9B. DATED (SEE ITEM 11)

28-Aug-2018

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

28-Aug-2018

CODE

NAVAL HOSPITAL CAMP PENDLETON

MATERIAL MGMT DEPT CODE 06B

NAVAL HOSPITAL, BOX 555191

CAMP PENDLETON CA 92055-5191

N68094 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

N6809418R6103

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 30 - BLOCK 14 CONTINUATION PAGE

The following have been added by full text:

STATEMENT OF WORK

Naval Hospital Camp Pendleton has a requirement for one (1) endoscopy data management information system. The system shall:

Be capable of storing and retrieving images from digital camera and other digital imaging systems that are used for endoscopic procedures.

Be capable of collecting, recording and annotating images and video from Olympus processors and endoscopes; Olympus double-balloon endoscopes; Boston Scientific Spyglass coledochoscopes; Halo transrectal ultrasound transducer; and, fluoroscopes made by Simens and

Philips.

Be capable of capturing and storing HD video clips.

Be capable of capturing and reporting quality and safety data to calculate/ track cecal intubation rates, rates of gastrointestinal (GI) tract lesions, complication rates, implanted medical devices and time to next procedure with a reminder system. The quality and safety data shall have a summary report capability, capable of being sorted by field including but not limited to endoscopist, gender, age, and indication.

Be accommodative of database queries.

Be compatible with scope tracking software.

Be certified with GI quality Improvement Consortium registry.

Be capable of bidirectional communication with Cerner Millennium including but not limited to importing patient identifiers, demographic information, pathology/ cytology results and, exporting reports and images.

Be capable of exporting procedural reports with text and images to the Armed Forces Health

Longitudinal Technology Application (AHLTA) Healthcare Artifact and Image Management

Solution (HAIMS).

Be capable of patient scheduling and tracking from arrival to discharge.

Include two (2) procedure room stationary workstations with combined image capture and report writing capability, including software to enhance medical transcription and report generation.

Include 1 (1) mobile workstations capable of being used in any area in the hospital, with combined image capture and report writing capability, including software to enhance medical transcription and report generation. All work stations shall have at least 22” monitors, an uninterruptible power supply, and image capture footswitch.

Include all software, hardware, and licensing required for full functionality.

Be capable of allow review capability for a minimum of ten (10) user, accessible from any workstation on the hospital network.

Be capable of remote login by physicians to review reports.

Be capable of regular, frequent backup.

Be capable of data migration from Olympus Endoworks to the proposed solution.

Be within manufacture support life for at least five (5) years from date of system acceptance.

The contractor shall include initial onsite training for all potential system users including but not limited to endoscopists, nurses, corpsmen, and technicians. The power requirement is 120 VAC, 60 Hz.

All equipment shall be new from the manufacturer. Vendor shall be an Original Equipment Manufacturer (OEM) authorized dealer, authorized distributor or authorizes reseller for the proposed equipment/ system such that OEM warranty and service are provided and maintained by the OEM. All software licensing, warranty and service associated with the equipment/ system shall be in accordance with the OEM terms and conditions.

All equipment shall be compliant with Food and Drug Administration (FDA) requirement to market and deliver medical equipment for use in the United States of America; even should delivery be requested outside of the United

States. The claims made for the product shall comply with regulations of the FDA with respect to products for marketing and delivery of a medical product for use in the United States of America, even should delivery be requested outside of the United States. Enhancing factors for NHCP systems:

A single unlimited site license

Server virtualization

CYBERSECURITY REQUIREMENTS

Risk Management Framework (RMF)

The contractor shall comply with RMF requirements, as specified by the Defense Health Agency (DHA) that meet appropriate DoD, DHA and Navy Cybersecurity requirements. The contractor shall initiate the process by providing the required documentation necessary to submit their system to Authorizing Official (AO) for assessment and authorization (A&A) for all orders delivered against this contract. The requirements shall be met before the contractor’s processes, stores, displays or transmits DoD data. The contractor shall ensure the proper contractor staff is available to participate in all phases of the RMF process. This includes, but not limited to;

Attending and supporting RMF and A&A meetings with Navy and DHA cybersecurity representatives as required.

Support/ conduct vulnerability mitigation to comply with cybersecurity controls listed in National Institute of

Standards and Technology (NIST) Special publication (SP) 800-53; Security and Privacy Controls for Federal

Information Systems and Organizations and DHA Administrative Instruction 77. In order for a system to be authorized, there shall be zero Category 1 findings.

Support the A&A Team during system security testing.

Once the system has been authorized, the contractor shall maintain an acceptable security baseline consistent with the authorizing granted by the AO throughout the life of the system. This includes ensuring that all vulnerabilities affecting the operating system, primary application, database and all third party software have validated and applied within 30 days.

Cybersecurity

The vendor shall establish appropriate administrative and technical safeguards to protect any and all data, to ensure the confidentiality, integrity, and availability of Government data under their control. At a minimum, this shall include provisions for vendor personnel security and electronic security.

The proposed system shall be capable of supporting the use of Defense Information System Agency (DISA) approved antimalware application. The Navy uses McAfee Host Based Security System (HBSS) as their solution.

The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support, either fully or partially the operation without performance degradation of medical system/ device. In case where the operation of HBSS is not technically achievable, the vendor shall provide detailed justification and Plan of Actions and Milestones (POA&M) describing steps toward compliance with this requirement.

The vendor must provide their Antivirus (AV) policy and list of AV expectations (if applicable) to the NMLC prior to Av installation on the system/ device. AV must be installed on all devices before they are placed on the Navy network.

Systems shall be configured in such a way to allow for the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operation system, real-time processes), by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

Vulnerability Management

Vulnerability mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating systems, servers, development platforms and the application being delivered to the Navy shall be in compliance with all known applicable guidelines. The vendor shall agree to be proactive in working with the Navy to mitigate new threats as they emerge.

All vendor validated and approved patched, up to and including the date of install, must be loaded on the system prior to system go-live. Security scans will be run during government acceptance testing. All category Ⅰ (CAT Ⅰ) findings must be remediated prior to government acceptance of system. A CAT Ⅰ vulnerability is any vulnerability, the exploitation of which will, directly and immediately result in loss of Confidentiality, Availability, or Integrity.

There shall be no more than 10 category Ⅱ (CAT Ⅱ) findings at the time of Government acceptance. CAT Ⅱ vulnerabilities are any vulnerability, the exploitation of which has a potential to result in loss of Confidentiality, Availability, or Integrity.

Domain Name System Realm/ Directory Services

Contractor will be required to provide technical evidence, if applicable, whether client/ server topology based medical system can integrate with Directory Services and support LDAP authentication.

Local Privileged and Administrative User/ Local System Accounts

Contractor shall create a single local user account with administrative/ root level privileges for purposes of conducting system repairs and maintenance only. This account shall be separate and distinct from the built-in local administrative/ root account provided by the Operating System and shall comply with DoD policy. All factors required to complete successful identification, authentication and authorization against built-in local Administrative/

Root level account shall be provided to the MTF Biomedical Engineering Department.

Complete administrative system rights shall be provided to the government System Administration for the purpose of conducting device vulnerability scans as needed.

DHA Business to Business (B2B) Gateway. All contractor system that will communicate with DON Systems will interconnect through the established DHA Business to Business (B2B) Gateway.

Contractors will connect to the B2B gateway via a contractor procured Internet Service Provider (ISP) connection and assume all responsibilities for establishing and maintaining their connectivity to B2B Gateway. This will include acquiring and maintaining the circuit to the B2B Gateway and acquiring a Virtual Private Network (VPN) device compatible with the DHA VPN device. Maintenance and repair of contractor procured VPN equipment shall be the responsibility of the contractor.

Contractors shall configure their network to support access to government systems (e.g., configure ports and protocols for access).

Contractors shall provide full time connections to a TIER1 or TIER2 ISP. Dial-up ISP connections are not acceptable.

Contractors will comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies prior to accessing DoD/ DHA networks. All contractors will be requires to complete a DISA Form 2875, System

Authorization Access Request form (SAAR) and submit it to the Navy PACS Office for processing. Contractor personnel will be required to complete applicable DoD cybersecurity training.

IPv6 The proposed system shall be Internet Protocol version 6 (IPv6) capable or vendor shall provide a detailed project, migration or planning documentation to show when the proposed system shall be IPv6 capable.

Minimum IPv6 capabilities include:

Conformant with the IPv6 standards profile contained in the DoD IT Standards Registry (DISR);

Maintaining interoperability in heterogeneous environments with IPv4;

Commitment to upgrade as the Ipv6 standard evolves;

Availability of vendor IPv6 technical support.

The contractor shall be able to demonstrate or provide documentation to prove that their product is

IPv6 capable

Health Insurance Portability and Accountability Act (HIPAA)

The contractor shall comply with the HIPPA Act of 1996 (Public Law 104-191) requirements, specifically the administrative simplification provisions of law and the associated rules and regulations published by the Secretary, Health and Human Services (HHS). This includes the Standards for Electronic Transactions, the Standards for

Privacy of Individually Identifiable Health Information and the security Standards.

Applicable References:

DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT)

NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems of February

2010, as amended

NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations, of 30 April

2013, as amended

DoD Instruction 500.01 of 14 March 2014, DoD Cybersecurity

DHA Administrative Instruction 77 of 28 May 2015

DoD Instruction 6025.18-R, DoD Health Information Privacy Regulation

DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

(End of Summary of Changes)