Occupational Health Suite SOW - 032023.docx

FEDERAL BUREAU OF PRISONS

STATEMENT OF WORK

Occupational Health Suite

A. BACKGROUND

The Federal Bureau of Prisons (BOP) is an agency of the Department of Justice (DOJ). The BOP is responsible for the custody and care of approximately 157,000 Federal offenders. It consists of approximately 36,000 employees located at 122 institution sites throughout the United States, including Hawaii and Puerto Rico.

More information about the agency can be found on the BOP’s public site, www.bop.gov.

B. OBJECTIVE

The BOP is seeking a total occupational health, safety, and environmental productivity solution that can be configured to meet BOP’s Occupational Safety & Health (OSH) software needs. The goal of this system is to enable the BOP to decrease injury rates and associated lost time while providing a proactive communication and reporting tool for management across the agency.

C. PLACE OF PERFORMANCE

The primary place of performance will be the Contractor’s facilities with frequent visits to the Federal Bureau of Prisons sites as needed. The majority of the site visits would be in the Washington, D.C. Metro Area.

Other sites that would utilize this Software Suite are located in Alabama, Arkansas, Arizona, California, Colorado, Connecticut, District of Columbia, Florida, Georgia, Hawaii, Illinois, Indiana, Kansas, Kentucky, Louisiana, Massachusetts, Maryland, Michigan, Minnesota, Missouri, Mississippi, North Carolina, New Hampshire, New Jersey, New York, Ohio, Oklahoma, Oregon, Pennsylvania, Puerto Rico, South Carolina, South Dakota, Tennessee, Texas, Virginia, Washington, Wisconsin and West Virginia. See attachment A.

The contractor must acknowledge/address Place of Service in their proposal.

D. DESCRIPTION OF SERVICES

The BOP is seeking a contractor capable of providing a cloud based occupational health suite that would provide the following functionalities at a minimum:

· Provides an easy workflow for automating and managing medical surveillance programs.

· Integrates with safety and case management.

· Offers the ability to create unlimited number of user-defined questionnaires.

· Maintains complete audit trail for any changes made to a record.

· Includes standard reports that demonstrate return on investment (ROI).

· Includes ability to produce user-defined letters to employees.

· Provides the ability to store external documents with employee records.

· Allows the user to produce a complete medical chart for an employee.

· Offers an easy-to-use notes system with template phrases to reduce repetitive keystrokes.

· Includes a user-defined “lock” on notes and medical records, so these cannot be edited.

· Offers additional modules to expand beyond the Medical group (i.e., Safety, Case Management, Industrial Hygiene)

· Offers integration application programming interfaces (API), which will allow information to be shared with other information systems and software tools.

· System features that promote user efficiency and reduce data redundancy, such as predicted text for data entry, and personalization options for each user.

· A dashboard that provides an instant view of key performance indicators (KPIs) and schedules upon login.

· A robust security component that can be easily managed and maintained by the BOP’s designated system administrators.

· Streamlined regulatory reporting/recordkeeping.

· Track regulatory compliance with applicable OSHA federal regulations and EPA federal and state regulations.

· The system should be able to adhere to data privacy requirements.

· Identify health and injury/illness trends.

· Support effective absence management.

· Provide tools for managing a hearing conservation program.

· Interface between audiometers and the contractor’s EHRS software for automatic download of testing results.

· Identify and modify the baseline audiogram, make age-based adjustments, and calculate STS. There must be an OSHA required written opinion letter that is automatically populated with the test results.

· The contractor’s software shall be able to track the audiometry equipment and calibration information.

The contractor shall provide all labor, material, and equipment necessary to accomplish the following services:

1) Ensure installation of the software system to allow usage to best meet the needs of the BOP.

2) Recommend modifications or changes in equipment and operation procedures as needed.

3) Provide training and ongoing technical support for all BOP facilities, as requested upon approval of the agency or institutional contact.

Contractor’s software shall be an existing and developed system that is current and operational. The contractor’s software shall be easily configurable and shall have the ability to manage a medical surveillance program. The software shall be able to manage many exposure groups including medical surveillance, certification exams, and hazardous environments.

The contractor’s software shall have medical surveillance tables that support exposure, certification, and health examinations. The software shall include a developed industrial hygiene capability.

The ability of the contractor’s software to complete required questionnaires by employees must meet security, confidentiality, and privacy requirements, e.g., Privacy Act, Health Insurance Portability and Accountability Act. The questionnaire data must automatically populate the appropriate fields in the software.

The software should provide integration with the organization’s Human Resource (HR) system as well as between OSH functional areas (medical, safety, etc.). Integration with the HR system allows for efficient, seamless transfer of employee data to OSH, while integration between functional areas allows Medical, Safety, and Occupational Health to communicate with one another, share information and report findings collaboratively, eliminating redundancies.

All data collected within the proposed system is the sole property of the Department of Justice/Federal Bureau of Prisons and will be provided by the contractor at the request of the agency in full and in the format requested by the agency at any time during the contract period.

The Contractor must address all areas listed in the Description of Services in their proposal.

E. CONTRACTOR REQUIREMENTS

I. Experience and Qualifications

The contractor shall be in compliance with OSHA, ADA, FMLA, HIPAA and DOT standards.

The contractor shall have a minimum of five years of proven, past experiences in this field to provide the services in accordance with the Statement of Work.

The program shall have an online help tool and technical support available 24 hours per day, 7 days per week.

The program shall provide compliance, competence indicators, and quality measures for documentation.

The program shall be optimized for use in a mobile electronic environment to meet evolving technological advances.

The program shall allow for the creation of customized care plans that have the ability to be integrated into an electronic medical record.

The Contractor must be registered in the System for Award Management (SAM). Contractors should go to www.sam.gov to find their information. Contractors shall maintain a current and accurate record in the SAM system annually. Registration in no way guarantees that a contract will be awarded.

The Contractor must address all requirements and provide documentation required in Qualifications and Experience with their proposal.

F. BOP Information System Requirements

All systems must acquire an Authority to Operate (ATO) prior to use, and an Authority to Test (ATT) prior to system testing with no live data or running a pilot. These authorizations must be granted by the BOP Authorizing Official (AO). All applicable system environments, including development, test, quality assurance, integration, production, and any other environment related to the system must reside within the authorization boundary.

1.0 Applications

1.1 Auditing/Logging

All applications must be capable of auditing events and maintaining logs with sufficient information to be able to account for the actions of individual users and record system events and processes.

1.2 Identification, Authentication, and Authorization

All new information systems should use a centralized directory for identification, authentication, and authorization to control, provision, and de-provision access to those systems. To connect information systems to an administrative network, all information systems must be capable of supporting Lightweight Directory Access Protocol (LDAP v3 or successor) or Microsoft Active Directory.

Each system user must be uniquely identified. Access to information is controlled using a “Least Privilege” role- or assignment-based methodology that provides the user with only the information and access required to perform his/her duties and nothing more. Systems must be capable of tiered-role privileges that distinguish between users and administrators and their authorized functions.

1.3 Encryption

1.3.1 Data at Rest

All information systems that store data must have the capability to encrypt the drives on which the data is stored using FIPS 140-2 compliant encryption.

1.3.2 Data in Motion

All information systems that transmit data over administrative networks must use protocols that encrypt data as it traverses the network. Information systems must support the most current version of secure protocols and encryption standards, and must be capable of being configured to prevent the use of insecure protocols including, but not limited to, Telnet, FTP, SNMP v1/2, and HTTP.

1.4 Endpoint Security and Management and Vulnerability Management

All networked information systems should be capable of being managed through an approved endpoint security and management application and be fully operational while being scanned for security vulnerabilities without disruption of service. All networked systems should also be capable of being patched using a centrally managed patch management application.

Servers and other computing devices using an operating system must employ anti-virus software protection.

1.5 Network Standards and Protocols

Information systems must meet the following network standards to be deployed on an administrative network:

i. Supports IPv4/v6 Dual Stack and provides full and equal functionality when utilizing IPv6 as when using IPv4;

ii. Does not require or enable wireless of any type (WiFi, 4G, etc.) unless an exception is granted by the CIO and is implemented per BOP and DOJ guidelines;

iii. If the system requires internet access, it must be configured to use an explicit proxy and only utilize standard internet ports (80/443);

iv. Does not directly connect to other IP networks;

v. Does not use IPv4 Multicast

1.6 Cloud System Requirements

Any system that will connect to or be hosted in a non-BOP cloud service must use cloud service providers (CSP) that have been independently evaluated by an authorized FedRAMP 3PAO and are FedRAMP-certified, and the CSP has provided the most current System Security Plan (SSP), Control Implementation Summary (CIS), Customer Responsibility Matrix (CRM), Security Assessment Report (SAR), and list of any open Plans of Actions and Milestones (POAMs) to the BOP Chief Information Security Officer (CISO) for consideration, and has received an ATO from the BOP Authorizing Official (AO).

1.7 Medical Systems

Medical systems must comply with standards published by the Office of the National Coordinator for Health Information Technology (ONC) with regard to data access, storage, and reporting.

1.8 Mobile Applications

Mobile applications must be designed using HTML5 or operate natively on a version of the Android operating system currently being supported by industry with security patches.

2.0 Peripheral Requirements

2.1 Locally Attached Peripherals

Peripherals that are locally attached to standard BOP workstations must:

i. Not be shared on the network;

ii. Not require software to operate that requires access to the internet or other network resources;

iii. Not require software to operate that requires older versions of software to operate such as Java, Flash, etc.;

iv. Not broadcast wireless signals (i.e. Bluetooth, WiFi, etc.);

v. Not require a change to the workstation local security policy to operate.

2.2 Networked-Attached Peripherals

Peripherals that must connect directly to an administrative network should be part of a larger system or sub-system authorized to operate on that network. Each system or sub-system must provide controls to the peripherals attached to the network that comply with the system standards detailed above or provide mitigating controls for peripherals that cannot meet a system standard.

NOTE: All proposed IT Hardware, Software and Systems will require a full security and technical review in compliance with the Federal Information Technology Acquisition Reform Act (FITARA).

3.0 Privacy and Records Management

All systems must be evaluated prior to ATT or ATO for privacy and records management requirements. An Initial Privacy Assessment (IPA) must be completed and if BOP Privacy and Records Management Branch, and DOJ Office of Privacy and Civil Liberties (OPCL) determines that the system collects, processes, stores or disseminates personally identifiable information (PII), a Privacy Impact Assessment (PIA) must be done to evaluate the impact on the confidentiality, integrity, and availability of the data. If required, the Office of General Counsel (OGC) will prepare a System of Records Notice (SORN) to be published in the federal register prior to system’s use. All systems must complete a Records and Information Management Certification (RIMCert) evaluation regardless of PII status.

4.0 Contractor Information Security Personnel

Contractor is required to have one or more persons to perform the duties of an Information Systems Security Officer (ISSO), dedicated to assisting the BOP in meeting any necessary information security and security remediation requirements related to the system, for the duration of the contract.

5.0 Contractor Background Clearances and Communications

All contractors must comply with DOJ/BOP background clearance requirements before being permitted to do any work under a BOP contract. Contractors working remotely for the BOP will be issued contractor user accounts and PIV cards. Contractors will be required to use government furnished equipment (computers) to access the BOP network. All email communications between contractor personnel and BOP personnel must be conducted using the BOP’s email system, to prevent data loss. All virtual meetings between contractor personnel and BOP personnel must be conducted using the BOP’s collaboration/meeting system(s) (currently Cisco Webex and Microsoft Teams).

The contractor must address/acknowledge all items stated in the BOP Information System Requirements section in their proposal.

G. PROJECT MANAGER

The Contractor shall provide a Project Manager who shall be responsible for all Contractor work performed under this SOW.

The Project Manager shall be a single point of contact for the Contracting Officer and the COR. It is anticipated that the Project Manager shall be one of the senior level employees provided by the Contractor for this work effort.

The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor's proposal. The Project Manager is further designated as Key by the Government. During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Project Manager and all designated alternates shall be able to read, write, speak, and understand English. Additionally, the Contractor shall not replace the Project Manager without prior approval from the Contracting Officer.

The Project Manager shall be available to the COR via telephone between the hours of 07:30 and 16:00 EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within 2 hours of notification.

The contractor must address/acknowledge this section in their proposal.

H. PERIOD OF PERFORMANCE

The contract terms will be for a one-year base period with four one-year option periods.

I. TRAVEL

Contractor travel may be required to support this requirement. All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

The contractor must address/acknowledge this section in their proposal.

J. POST AWARD CONFERENCE

The Contractor shall attend a Post Award Conference with the Contracting Officer and the COR no later than 15 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held at the Government’s facility, located at 320 First Street, NW Washington DC 20534 or via teleconference.

K. IMPLEMENTATION PLAN

The Contractor shall provide a draft Implementation Plan at the Post Award Conference for Government review and comment. The Contractor shall provide a final Implementation Plan to the COR not later than 15 business days after the Post Award Conference.

L. PROGRESS REPORTS

The Project Manager shall provide a weekly progress report to the Contracting Officer and COR via electronic mail. This report shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.

M. PROGRESS MEETINGS

The Project Manager shall be responsible for keeping the COR informed about Contractor progress throughout the performance period of this contract, and ensure Contractor activities are aligned with BOP objectives. At a minimum, the Project Manager shall review the status and results of Contractor performance with the COR on a monthly basis via electronic mail.

N. PROTECTION OF INFORMATION

Contractor access to information protected under the Privacy Act is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

Contractor access to unclassified, but Security Sensitive Information may be required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination.

O. SECTION 508 COMPLIANCE

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L. 105-220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this contract shall be in compliance with the “Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

P. PAST PERFORMANCE

The contractor must provide a minimum of 3 past performance references. The references must include a valid point of contact and telephone number and email address for that individual.

Q. INVOICES

The contractor that obtains the award shall mail all invoices to the address below.

Federal Bureau of Prisons Central Office Business Office 320 First Street, NW Suite 901-4 Washington, D.C. 20534

CO-BusinessOffice-S@bop.gov