1. SOW_DCRI_12-12-2025 revised.docx

STATEMENT OF WORK:

TeleRadiology (Off-site) Program (TRP) Radiology and Imaging Sciences Diagnostic Support

SECTION I - SCOPE:

The Contractor shall provide non-personal professional diagnostic radiology services at Contractor facilities using approved secure broadband connections to transmit radiology images and data. The services are required to provide image interpretation and reports by board certified radiologists in support of basic assistance with case volume and on-call scenarios throughout RADIS. The Contractor must be authorized to connect to and transmit data to RADIS and have computer hardware that is capable of receiving Digital Imaging and Communications in Medicine (DICOM) compliant diagnostic imaging studies from RADIS and to return a final interpretation report that will automatically upload into the patient’s Electronic Health Record (EHR).

SECTION II - REQUIRMENTS:

2.1. GENERAL DESCRIPTION OF WORK. The Contractor shall perform procedures and duties that are within the scope of commercial remote teleradiology services. The Contractor shall perform only those services for which privileges have been granted by RADIS. All diagnostic radiology study interpretations shall be performed in the United States (i.e., within the 50 states and/or District of Columbia (D.C.)) or U.S. Territory. The Contractor shall perform and provide diagnostic image interpretations of radiology studies and consultations related to diagnostic imaging to members of the medical staff. The Contractor shall be capable of interpreting radiography, ultrasound, CT, MRI, nuclear medicine, bone densitometry, and optionally PET/CT.

2.2. DIAGNOSTIC IMAGING STUDIES. The Contractor shall interpret diagnostic imaging studies to include: Radiography, Ultrasound, Computed Tomography (CT), Magnetic Resonance Imaging (MRI), nuclear medicine, bone densitometry, and PET/CT (Optional). In accordance with American College of Radiology (ACR) practice parameters, Contractor shall review prior imaging for comparison to the maximum extent possible, if prior images are available.

2.2.1 The Contractor shall provide technical assistance in all diagnostic imaging studies and participate in protocoling an exam if input is necessary for administration of contrast agent or other issues.

2.2.2. Interpretation shall consist of medical evaluation of diagnostic imaging studies consistent with the American College of Radiology’s “Practice Parameter for Communication of Diagnostic Imaging Findings”. The Contractor shall provide interpretation and dictation on a daily basis for all services performed.

2.3. REPORTING STANDARDS

2.3.1. STAT REPORTS. For STAT studies, the Contractor must provide a final diagnostic report into the Government EHR within one hour (60 minutes) of receipt of the transmitted images.

2.3.2. ROUTINE (NON-STAT) REPORTS. For routine studies, the Contractor must provide a final diagnostic report into the Government EHR within 24 hours (1440 minutes) of receipt of the transmitted images.

2.3.3. CONTINGENCY REPORTING. In the event a failed network connection prevents report transfer into Government EHR, a final report can be sent by facsimile, secure e-mail or other communication acceptable by RADIS within 24 hours and a final report placed into Government EHR by the Contractor within 12 hours after the network connection is reestablished. The Contractor shall still provide ALL telephonic reporting.

2.3.4 CONSULTATION. Upon request, the Contractor shall be available telephonically to provide professional recommendations to RADIS staff during coverage times and during normal business hours. The Contractor shall provide telephone numbers where the radiologist(s) can be reached if consultation is required. The radiologist shall respond to any request for consultation via telephone within 15 minutes of initial notification. Answering services, answering machines, texting, electronic mail, and pagers are not acceptable. Examples of consultation services that shall be provided by the Contractor include, but are not limited to, the following:

2.3.4 (a) Consultation with RADIS ordering providers to discuss imaging options and pre-study concerns.

2.3.4 (b) Consultation with RADIS imaging technologists and RADIS radiologists.

2.3.4 (c) Consultation with ordering and treating RADIS providers to discuss diagnostic imaging study interpretations.

The Contractor shall review images and provide final interpretations in a written text report utilizing standard reporting format in accordance with the ACR Practice Parameter for Communication of Diagnostic Imaging Findings. The name of the interpreting radiologist shall be clearly noted on all reports. The radiologist shall electronically sign and finalize reports. The Contractor shall transmit and upload the final report.

SECTION III - TERM OF CONTRACT:

Period of Performance is one (1) year.

1FEB2026 through 31JAN2027

SECTION IV – SECURITY REQUIREMENTS:

Information Security: The Contractor and their personnel shall be subject to the same Federal laws, regulations, standards, and policies as CC personnel, regarding information and information system security. The Contractor shall adhere to requirements set forth in the appendices of this PWS, which outline Federal information security and privacy policies, regulations, and guidelines.

Physical Security: The Contractor shall adhere to requirements set forth in the appendices of this PWS, which outline physical security requirements. The Contractor shall be responsible for safeguarding all Government equipment, information, and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

APPENDIX A: REMOTE ACCESS REQUIREMENTS

The following requirements apply only when the vendor or Contractor will need remote access to NIH’s data, networks. These options and associated processes are acceptable and approved methods of remote access into Clinical Center (CC) Information Technology (IT) and medical systems. Responsible parties requesting remote access must meet all required security requirements as listed per the selected option.

Option 1: SecureLink The use of SecureLink is the preferred method for remote access for persistent and continuous/ongoing access to CC IT and medical systems. External parties who provide monthly maintenance, support, and troubleshooting shall utilize the CC’s SecureLink instance, which provides monitoring and recording of remote access sessions in addition to the proper access controls to CC systems. Note: if this is not a viable option, the Contractor shall provide justification on why SecureLink cannot be used.

Option 1 Requirements:

· CC department must complete the SecureLink Access Request Form, which must be signed by the system owner and department head.

· CC CIO or designee reviews and approves use of SecureLink.

· All individuals from the external party must sign a non-disclosure agreement (NDA).

· SecureLink agent is installed on CC system.

· CC SecureLink Administrators onboard the system into the CC SecureLink server.

· System POC performs annual user certification of external users.

· An interconnection security agreement (ISA) is required for vendor remote access to CC systems.

· Service Account is setup within CC SecureLink and on the respective hosts.

· PIV or individualized NIH Active Directory (AD) account is not required. When the external user is logged in via SecureLink, the Service Account previously mentioned is used to log the user in to the system without the external user having to know the credentials.

· External users do not require sponsoring in the NIH Enterprise Directory (NED).

Option 2: Non-Persistent Remote Access (e.g., Teams, Zoom, etc.)

This option is for ad-hoc or as needed communications that may be needed within NIH or between NIH and external parties where a persistent/continuous connection is not required.

Option 2 Requirements:

· CC staff must initiate the connection with the external party, monitor activities, retain a log of the external party’s name, date/time, and purpose of the connection, and terminate the connection when activities are completed.

· NIH technical representative will need to be available for initiating, monitoring, and terminating the connection.

· No interconnection security is needed to document connections between systems.

· PIV or NIH Active Directory (AD) account is NOT required.

· Non-business Hours Access via Systems Monitoring Staff:

In the event that a department requires vendor access to their system during non-business hours, a Service Level Agreement (SLA) shall be signed between the CC department and DCRI stipulating who from the vendor is allowed to contact the DCRI Systems Monitoring staff, who will initiate, monitor, and terminate the session. The CC Customer Relationship Manager (CRM) is responsible for documenting the service level agreement (SLA) between DCRI and other departments/ICs. DCRI Systems Monitoring shall be provided with a list of servers/IP addresses that the vendor is allowed to access and will notify the departmental POC of when access is requested during non-business hours. All requests to leverage DCRI Systems Monitoring staff for non-business hour remote access shall be approved by the Deputy Chief Information Officer (CIO), Chief Technical Officer and CC CIO and stored on the CC SharePoint.

Option 3: CC CITRIX (Casper) The CC Casper/Citrix option meets NIH Information Security Policy Handbook and can be used for remote access to CC systems. CC Citrix can be accessed via: https://cccitrixaccess.cc.nih.gov/. No local desktop storage or local printing options are allowed using Citrix remotely. Citrix is a containerized environment that displays a screen emulation of the virtual machine that resides in the CC Data Center. No processing is done on the local host. The user will login using an NIH Active Directory account and be presented with a virtual Windows desktop. The user will have access to all mapped drives that they are provisioned for such as P: drive, departmental drives, and Isilon (storage of sensitive data) via the Citrix environment. All sensitive data is contained within the virtualized environment and cannot be transferred to the local host that is used to login to the Citrix environment. The Citrix environment is a hardened virtualized desktop and does not allow the installation of any software unless provisioned with a special virtual desktop. The Citrix environment does allow for RDP connections.

Option 3 Requirements:

· Must be sponsored for PIV card, obtain NIH AD account, and have background investigation completed (see option 3 for details). In addition, NIH CC Administrative Account (AA) request must be obtained for remote administration of CC servers (follow CC AA Process) email CCDCRIServiceCenter@mail.nih.gov and request the form.

· Vendor/remote access support personnel must take the required information security and management refresher courses http://irtsectraining.nih.gov/ as part of the onboarding process and on an annual basis.

· If using Government furnished equipment (GFE), contact the CC-DCRI User Support CC-DCRIUserSupport@mail.nih.gov to obtain PIV card reader for user’s workstation/laptop, and configure workstation.

· For non-GFE Contractor/personal computers, guidance for configuration of PIV readers and installation of Active Identity is available at https://ocio.nih.gov/Smartcard/Pages/default.aspx

· Must install Citrix Client Software (Citrix Receiver).

· Must contact CC Citrix Team cccitrixteam@mail.nih.gov to put user in appropriate group to allow for Citrix use for non-CC users.

· May use Citrix to Remote Desktop Protocol (RDP) to access local workstation/server.

· An interconnection security agreement (ISA) is required for vendor remote access to CC systems.

Appendix b: Baseline Security Requirements for Procurements Requiring Information Security and/or Physical Access Security:

Applicability: The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

· Access (Physical or Logical) to Government Information: Contractor (and/or any Sub-Contractor or vendor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to Government information and/or network(s).

· Operate a Federal System Containing Information: Contractor (and/or any Sub-Contractor) will operate a Federal system and information technology containing data that supports the HHS/NIH/CC mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

Requirements for Safeguarding Information and Information Systems:

· All Government information and information systems must be protected in accordance with Federal policies and level of risk. At a minimum, the Contractor (and/or any Sub-Contractor) must protect the:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

· Report any discovered or unanticipated threats or hazards by either the CC or Contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the appropriate CC federal representative(s).

· Adopt and implement all applicable policies, procedures, controls, and standards required by the NIH/CC to ensure the confidentiality, integrity, and availability (CIA) of Government information and Government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CC CO/COR or CC security and/or CC privacy officials.

Confidentiality and Nondisclosure of Information:

· Any information provided to the Contractor (and/or any Sub-Contractor) by NIH/CC or collected by the Contractor on behalf of the Government must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and Sub-Contractors must be under the supervision of the Contractor. Each Contractor employee or any of its Sub-Contractors to whom any NIH/CC records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or Sub-Contractor can be used only for that purpose and to the extent authorized herein.

· The confidentiality, integrity, and availability of such information must be protected in accordance with Federal policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

· 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

· 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

· 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Contractor Non-Disclosure Agreement (NDA) Requirements:

· Each Contractor (and/or any Sub-Contractor) employee having access to non-public Government information under this contract must complete and sign a NIH non-disclosure agreement. Contractors (and/or Sub-Contractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under the acquisition.

Incident Response Requirements:

· The Contractor (and/or any Sub-Contractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIHIRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

· In the event of a suspected or confirmed incident or breach, the Contractor (and/or any Sub-Contractor) must:

· Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

· NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send NIH approved notifications to affected individuals.

· Report all suspected and confirmed information security and privacy incidents and breaches to the NIH Information Security Program, IRT Hotline (301.881.9726) COR, CO, ISSO, and any other designated Federal Officials, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HHS/NIH/CC policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

· Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

· Not include any sensitive information in the subject or body of any reporting e-mail; and

· Encrypt sensitive information in attachments to email, media, etc.

· Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS/NIH privacy breach response policies when handling PII breaches.

· Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to Contractor facilities during a breach/incident investigation CC-Specific Information Security Requirements:

· The Contractor is required to adhere to CC-specific information security requirements, which align with those set forth within the NIH Information Security Handbook (NIH Access Required).

· The Contractor shall complete the CC Minimum Security Questionnaire which includes an overview of the system, roles and responsibilities, and configurations.

· The Contractor shall ensure the system is registered and kept current in the NIH Governance, Risk, and Compliance (GRC) tool as well as the CC data repository tool.

· The Contractor shall provide the CC Security Team with the required documentation to receive an Authorization to Operate (ATO).

· The NIH/CC shall perform multiple vulnerability scans of the server, the operating system, relational database management system (RDBMS), and websites via NIH agents. The vendor is responsible for remediating any vulnerabilities identified within the following timeframe:

NIH and CC Remediation Timelines

· For externally hosted systems (e.g., cloud providers) that are not scanned by NIH, the vendor must provide monthly vulnerability scan reports from the web application, database, and operating system. Scan results shall be managed and mitigated by the vendor via CC’s POA&M process.

Privacy Act Requirements:

· Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother's maiden name, biometric records, etc.

· It has been determined that this contract is subject to the Privacy Act of 1974, because this contract provides for the design, development, or operation of a system of records about individuals from which records are retrieved by name or other identifying particular.

· The System of Records Notice applicable to this contract will be provided by the CC Privacy Office.

· The Designated Federal Official will notify the Contractor if a Privacy Threshold Analysis (PTA) for the information system and information handled under this contract is warranted. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

· If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within ninety (90) days after completion of the PTA and in accordance with NIH/CC policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

· The Contractor must support the agency in reviewing the PIA at least every three (3) years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.