Draft Performance Work Statement.pdf

CUI//PROCURE

Department of Defense Defense Health Agency

Performance Work Statement

Medical Logistic Authoritative Data Exchange and Medical Logistics Database Subscriptions

DHA Medical Logistics (MEDLOG)/J4

Healthcare Technology & Services

Solicitation Number:

Version:

Date:

PART 1

1.0 GENERAL INFORMATION

1.1. This is a non-personal services contract to provide Medical Logistics Authoritative Data Exchange and Medical Logistics Database Subscriptions.

1.2. Description of services: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Medical Logistics Authoritative Data Exchange and Medical Logistics Database Subscription as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this PWS.

1.3. Background:

1.3.1. The intent of this requirement is to support the Congressional guidance set forth in Title VII of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2017, as amended by the NDAAs for FY 2018 and 2019, that seeks to eliminate separate silos of military health and to integrate military healthcare under the Authority, Direction, and Control (ADC) of the Defense Health Agency (DHA), consistent with the direction provided by the Secretary of Defense. The DHA Medical Logistics Division supports the DHA's Implementation Plan for transitioning the ADC of the military Medical Treatment Facilities (MTFs) from the Services’ medical departments to the DHA beginning on 1 October 2019.

1.3.2. The Department of Defense (DoD) medical logistics community supports diverse Lines of Business (LOBs), to include equipment property and biomedical maintenance management;

pharmaceuticals and medical surgical inventory management; purchasing and quality assurance;

and assemblage and facilities management. The primary Information Systems (IS) supporting these LOBs are the Defense Medical Logistics Standard Support (DMLSS) system, LogiCole application and the Theater Enterprise-Wide Logistics System (TEWLS). Over the last twenty

(20) years, these systems have inherited as-built data from a number of Army, Navy and Air Force logistics and property legacy applications. As a result of these historical data merges, the two (2) aforementioned systems contain data variances and data diversion. The lack of authoritative source data has impeded effective decision analysis and constrained optimized business processes.

1.3.3. The Defense Health Agency (DHA) and Medical Logistics Information Technology Program Management Office (MEDLOG IT PMO) have initiated a major technical refresh that will merge both the programmatic and technical components of all existing Defense Medical Logistics applications [DMLSS, TEWLS and Joint Medical Asset Repository (JMAR)] into a single program, the Defense Medical Logistics – Enterprise Solution (DML-ES) and a single application called LogiCole.

1.4. Objectives: Using industry standard data, the objective is to normalize, cleanse and structure an authoritative equipment and supply data standardization mapping process, allowing for enhanced audit readiness, increased business process effectiveness in new procurement standardization and existing product recall identification, and management of unnecessary data duplication.

1.5. Scope: To maintain an authoritative data exchange and database subscription service that supports modernization and data standardization in Health Alerts and Equipment Management LOBs. Services, including the authoritative data exchange and database subscription services will be Information Technology (IT) services, external to the DoD. Specific subscriptions required will have the potential to fluctuate over time, based on the dynamic nature of the Government’s various LOBs and their respective accountable Government property and personnel changes. However, the aggregate requirement and level of effort will remain relatively constant over the life of the contract. Any changes will be executed through an official contract modification with approval signature by the Contracting Officer (KO). The contractor shall accomplish establishment of terms and conditions consistent with any trust relationship established with organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to access the information system from external information systems and process, store, or transmit organization-controlled information using external information systems.

1.6. Period of Performance: 30 September 2026 through 29 September 2031 with an option to extend six months from 30 September 2031 to 29 March 2032.

1.6.1. Transition: Reserved

1.6.1.1. Transition-In Period: Reserved

1.6.1.2. Transition-Out Period: Reserved

1.7. Administrative Specifications

1.7.1. Recognized Federal Holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.7.2. Hours of Operation: The contractor is responsible for conducting business Monday through Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.8. Quality

1.8.1. Quality Control: The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is the means by which the work complies with stated requirements.

After acceptance of the Quality Control Plan (QCP) the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. See Part 7, Technical Exhibit 1 -

CDRL A001.

1.8.2. Quality Assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.9. Contractor Personnel: Reserved

1.9.1 Physical Security: Reserved

1.9.2 Key Control: Reserved

1.9.3 Lock Combinations: Reserved

1.10. Data Rights: The Contractor shall comply with Federal Acquisition Regulation (FAR) Subpart 227.7103-5 “Government Rights”, January 17, 2025. The Government retains unlimited data rights to data that is sent to the Contractor for cleansing, normalization, and standardization.

The Government retains unlimited data rights to data furnished by the Contractor after the Government has applied the authoritative data services to the Government data sets. The Government has unlimited rights to all documents and materials produced under this contract.

All documents and materials, to include the source codes of software produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership and copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.11. Reporting

1.11.1. Service Contract Reporting (SCR): Reserved

1.11.2. Non-Disclosure Agreement (NDA): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who have not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.11.3. Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.11.4. Post award conference/periodic progress meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.12. Contractor Identification

1.12.1. Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their contractor status known during introductions.

1.12.2. Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.13. Contractor Access to Health Affairs (HA)/DHA Networks: Reserved

1.14. Personnel Security

1.14.1. The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM

5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor’s responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.14.1.1. Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.14.1.2. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.14.1.3. DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1. Definitions:

2.1.1. Category D: Information Technology (IT) and Telecommunications Services (called D- Services).

2.1.2. Category R: Support (Professional/Administrative/Management) Services (called R- Services).

2.1.3. Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4. Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5. Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6. Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.1.7. Availability: Ensuring timely and reliable access to and use of information. Timely, reliable access to data and information services for authorized users.

2.1.8. Confidentiality: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

2.1.9. External IT Services: IT services that are outside the user organization’s Service authorization boundary and the user’s Service have no direct control over the application or assessment of required security controls. DoDD organizations that use IT services are typically not responsible for authorizing them (i.e., issue an authorization decision), reference (DoDI

8510.01 p. 13). DoD organizations that use external IT services provided by a non-DoD Federal Government agency must ensure the categorization of the Information System (IS) is appropriate to the confidentiality, integrity, and availability needs of the information and mission, and that the Information System is operating under a current authorization from that agency. In accordance with DoD Instruction 8500.01, “Cybersecurity,” October 7, 2019, interagency agreements, or Government statements of work for these external services must contain requirements for Service Level Agreements (SLAs) that include the application of appropriate security controls.

2.1.10. Integrity: Guarding against improper information modification or destruction, inclusive of ensuring information non-repudiation and authenticity.

2.1.11. National Security Information: Information that has been determined pursuant to Executive Order 12958, as amended by Executive Order 13292 or any predecessor order, or by the Atomic Energy Act of 1954 as amended, to require protection against unauthorized disclosure and is marked to indicate its Classified status.

2.1.12. National Security System: Any information system (including any telecommunications system) used by or operated by an agency, or by a Contractor of an agency, or another organization on behalf of an agency having the function, operation, or use of which (i)involves intelligence activities; (ii) involves cryptologic activities related to national security; (iii) involves command and control of military forces; (iv) involves equipment that is an integral part of a weapon or weapons system; or (v) is critical to the direct fulfillment of military or intelligence missions (excluding a system that is to be used for routine administrative and business applications, for example, payroll, finance, logistics, and personnel management applications).

2.1.13. Nonpersonal services contract: A contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.14. System Security Plan (SSP): Formal document that provides an overview of the security requirements for an information system and describes the security controls in place or planned for meeting those requirements. (Reference: NIST Special Publication 800-18, Revision 1).

2.1.15. Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.1.16. Technical Liaison (TL): The individual designated and authorized in writing by the CO to assist the COR in performing specific technical or administrative functions. This individual does NOT have the authority to change the terms of the contract.

2.2. Acronyms:

ADC Authority Direction and Control AIS Automated Information System APL Approved Products List APL

AQL Acceptable Quality Level ARRT Acquisition Requirements Roadmap Tool ATO Authority to Operate B2B Business-2-Business CAC Common Access Card CAP Cloud Access Point CCEVS Common Criteria Cybersecurity Evaluation and Validation Scheme CDRL Contract Data Requirement List CIO Chief Information Officer CJCSM Chairman of the Joint Chiefs of Staff Manual CMMC Cybersecurity Maturity Model Certification CNSSI Committee on National Security Systems Instruction CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer’s Representative COTR Contracting Officer’s Technical Representative CUI Controlled Unclassified Information DAD-A Deputy Assistant Director for Acquisition DC3 DoD Cyber Crime Center DD Form 254 Department of Defense Contract Security Requirement List (if applicable) DB Design-Build DBB Design-Bid-Build DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DoDIN Department of Defense Information Network DSAs Data Sharing Agreements DSAA Data Sharing Agreement Application DMZ Demilitarized Zone DoDM DoD Department of Defense Manual DPCLO DHA Privacy and Civil Liberties Office DUA Data Use Agreement eMSM Enhanced Multi-Service Markets EVM Earned Value Management FAR Federal Acquisition Regulation FCI Federal contract information FE Facilities Enterprise FedRAMP Federal Risk Authorization and Management Program FIMSA Federal Information Security Modernization Act FRCS Facility Related Control Systems FSO Facilities Security Officer HA Health Affairs HAR Hazards, Alerts and Recalls

HCA Head of the Contracting Activity HIT Health Information Technology IGCE Independent Government Cost Estimate IA Information Assurance IO Initial Outfitting I/O In/Out Processing Portal IPv Internet Protocol Version ISP Internet Service Provider IT Information Technology ISCM Information Security Continuous Monitoring IV&V Independent Verification & Validation MDE Medical Devices and Equipment MedCOI Medical Community of Interest MEDLOG DHA, Medical Logistics MHS Military Health System MIL-STD Military Standard MTFs Military Treatment Facilities NCR National Capitol Region NDA Non-Disclosure Agreement NDAA National Defense Authorization Act NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OPM Office of Personal Management PDT Project Delivery Team PHI Protected Health Information PII Personally Identifiable Information PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PMO Program Management Office PoP Period of Performance PP Personal Property PWS Performance Work Statement QA Quality Assurance QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RFP Request for Proposal RFQ Request for Quotation RMF Risk Management Framework SP Special Publication SPRS Supplier Performance Risk System

SSP System Security Plan SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides US United States VPN Virtual Private Network

2.3. Applicable Publications, DHA Administrative Instructions (AI), etc.

• Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, dated July 10, 2012, current as of December 18, 2014

• Committee on National Security Systems (CNSS) Glossary, dated April 6, 2015

• Committee on National Security Systems (CNSS) Instruction 1253, Security Categorization and Controls Selection for National Security Systems, dated March 27, 2014

• DoD Directive (DoDD) 5530.3, International Agreements, dated June 11, 1987, current as of

January 17, 2025

• DoD Instruction 8320.02, Sharing Data, Information, and Information Technology (IT)

Services in the Department of Defense, dated June 24, 2020

• DoD Instruction 8500.01, Cybersecurity, dated October 7, 2019

• DoD Instruction 8551.01 Ports, Protocols and Service Management (PSSM), dated May 28, 2014, incorporating changes from October 7, 2019

• DoD Instruction 8582.01, Security of Unclassified DoD information on Non-DoD

Information System, dated June 6, 2012, incorporating changes from October 27, 2017

• DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information

Technology (IT), dated November 13, 2020

• DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, dated May 18, 2023

• DoD Instruction 8520.04, Access Management for DoD Information Systems, dated

September 3, 2024

• Executive Order 13556, Controlled Unclassified Information, November 4, 2010

• Federal Information Process Standards (FIPS) Publication (PUB) 200 Minimum Security

Requirements for Federal Information and Information Systems, dated March 2006

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171

Revision 3, Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations, dated May 2024

• NIST SP 800-18 Revision 2, Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems, dated June 4, 2025

• NIST SP 800-37, Risk Management Framework (RMF) Guide for Applying the Risk Management Framework to Federal Information Systems, as well as emerging DoD Cybersecurity, dated December 2018

• NIST SP 800-47 Rev. 1, Managing the Security of Information Exchanges, dated July 20,

• NIST SP 800-50 Rev. 1, Building an Information Technology Security Awareness and Training Program, dated August 28, 2023

• NIST SP 800-53 Release 5.1.1 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, dated November 7, 2023

• NIST SP 800-53a Revision 5, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans, dated August 3, 2021

• NIST SP 800-60r2, Guide for Mapping Types of Information and Information Systems to Security Categories, Volume I, dated January 31, 2024

• NIST SP 800-171, Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, dated November 9, 2023

PART 3

3.0. GOVERNMENT FURNISHED PROPERTY, EQUIPMENT AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1. Services: The Government

☒ Will NOT provide Government Furnished Services in support of this contract. As a result, this paragraph is Not Applicable.

☐ WILL provide Government Furnished Services required in support of this contract.

3.2. Facilities: The Government

☒ Will NOT provide Facilities in support of this contract. As a result, this paragraph is Not Applicable.

☐ WILL provide Facilities in support of this contract. The Government provided Facilities are described below:

3.3. Utilities: The Government:

☒ Will NOT provide Utilities in support of this contract. As a result, this paragraph is Not Applicable.

☐ WILL provide Utilities in support of this contract. The Government provided Utilities are described below:

3.4. Equipment: The Government:

☒ Will NOT provide Equipment in support of this contract. As a result, this paragraph is Not Applicable.

☐ WILL provide Equipment in support of this contract. The Government provided Equipment is described below:

NOTE: Currently no GFP will be provided, however should the need for GFP to be provided to the Contractor, the following language and sections apply:

3.4.1. Procurement Integrated Enterprise (PIEE), GFP Module Application

The contractor shall be responsible for obtaining and maintaining access, training and successful operation of the PIEE/GFP Module application for the entirety of the contract PoP. The PIEE GFP Module application is located at the following website: https://wawf.eb.mil/piee-landing/.

Access to PIEE/GFP Module application training materials and in-depth information applicable https://wawf.eb.mil/piee-landing/ to the contractor’s responsibilities regarding GFP can be found at the following website:

https://dodprocurementtoolbox.com/

3.4.2. Contracting Officer Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The CO and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded through DHA, in accordance with applicable FAR Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA AI 095 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

3.4.3. The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the Contracting Office and requested within the PIEE/GFP Module system.

3.4.4. Contractor Responsibilities:

A key contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

3.4.5. The contractor shall report semi-annually 100% inventories, reconciliations, and final disposition of GFP provided by the government. Final invoices will not be paid pending GFP reconciliation. Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245 and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA Administrative Instruction 094 and DHA Guidance.

3.5. Materials: The Government:

☒ Will NOT provide Materials in support of this contract. As a result, this paragraph is Not Applicable.

☐ IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below:

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1. Services:

☒ Will NOT provide Contractor Furnished Services in support of this contract. As a result, this paragraph is Not Applicable.

☐ WILL provide Contractor Furnished Services required in support of this contract.

4.2. General: Reserved.

4.3. Secret Facility Clearance: Reserved.

4.4. Materials: Reserved.

4.5. Equipment: Reserved.

4.6. Facilities: Reserved.

PART 5

5.0 SPECIFIC TASKS

5.1. The Contractor shall provide the following:

5.1.1. Data Integration Support: The Contractor shall create an authoritative data exchange to support modernization and data standardization in Health Alerts and Equipment Management LOBs. The contractor shall include three (3) custom data feeds via a manual mechanism and/or through DHA approved B2B gateway to support product catalog data attributes and data standardization, which will (i) assist in normalizing data before it is committed to the database and exercised in a business process; (ii) matches equipment and supplies to provide an accurate, timely identification of all product recalls. Any required changes to data exchanges will be bi-laterally agreed upon before implementation. The Contractor shall accomplish matching services for supplies and capital medical equipment. The Contractor shall provide a Supply Guide which provides a comprehensive database of medical-surgical supplies, implants, instruments, pharmaceuticals, industrial and office supplies that automatically benchmarks specific prices against those paid elsewhere in the nation, enabling customers to immediately pinpoint specific products and vendors that give you the best cost-saving opportunities.

5.1.1.1. UMDNS would be best served by the ECRI Inventory Classification and Normalization application. This type of application better facilitates via the use of Custom Data Standardization as well as Equipment Data Standardization & Product Catalog, Organized Asset & Item Naming for Effective Equipment Management, and Supply Procurement, all of which organizes and maintains equipment inventories, saving time and effort while ensuring the integrity of your organization’s medical equipment database. ECRI’s proprietary algorithms consolidate your data into a more efficient and useful format. We have the industry’s largest database of equipment descriptions.

5.1.1.1.1. Data Standardization – Equipment - Validates and cleans medical device inventories history. Data Standardization/Normalization of medical device inventory classifications by model name, model number, manufacturer, and Universal Medical Device Nomenclature System (UMDNS) category.

5.1.1.1.2. Data Standardization – Supplies - Validates and cleans supply purchase order history. Data Standardization/Normalization of medical device inventory classifications by model name, model number, manufacturer, and UMDNS category.

5.1.1.1.3. Product Catalog - Facilitates the maintenance of DoD Device Inventory Classifications to account for new inventory/industry changes. Additionally, it facilitates more accurate predictive analytics, life cycle analysis and AEM planning.

5.1.2. Technical Integration Support: The Contractor shall transmit the authoritative data exchange via a manual mechanism and/or over a DHA approved B2B gateway, while strictly adhering to Cybersecurity requirements.

5.1.3. Test Planning and Performance: The Contractor shall participate in LogiCole/ECRI interface testing to support functionality and performance evaluations.

5.2. Interconnection Security Agreement – IAW NIST SP 800-47 Rev. 1, Managing the Security of Information Exchanges:

5.2.1. Interconnection Statement of Requirements. The requirements for interconnection between the Contractor and the Government are for the express purpose of exchanging data between ECRI HAR System (owned by the Contractor) and LogiCole (owned by the Government). The Government requires the use of the Contractor’s ECRI HAR System database, and inversely the Contractor requires the use of the Government’s LogiCole database, as specified in the Office of Management and Budget (OMB) Circular A-130, Appendix III, for system interconnection and information sharing. The expected benefit is to expedite the processing of data associated with HARs within prescribed timelines.

5.2.2. System Security Considerations - General information/data description. The interconnection between ECRI HAR System and LogiCole is a bi-directional connection. The purpose of the interconnection is to exchange information on supplies and equipment used by DoD Components for the purpose of receiving HAR and for identifying on the ECRI website HAR that matches medical supplies or equipment used or owned by a specific DoD Component.

5.2.3. This connection exchanges data between the Contractor’s system and the Government’s system via a dedicated, DHA approved B2B gateway.

5.2.4. Data Sensitivity - The sensitivity of data exchanged between the Contractor and the Government is Controlled Unclassified Information (CUI). Information type for this data exchange is “Official Information Dissemination” and “Logistics Management”, as categorized Low (confidentiality), Low (integrity), and Low (availability) in accordance with NIST SP 800- 60r2, “Guide for Mapping Types of Information and Information Systems to Security Categories”.

5.2.5. Information Exchange Security - The security of the information routed within this bi-directional feed shall be protected through the use of Federal Information Process Standards (FIPS) Publication 140-2 approved encryption mechanisms. The connections at each end are and shall be located within controlled access facilities. The Contractor shall ensure that data access is verifiable and controlled.

5.2.6. Trusted Behavior Expectations - The Contractor is expected to protect the Government’s data in accordance with the Privacy Act and Trade Secrets Act (18 U.S. Code 1905) and the Unauthorized Access Act (18 U.S. Code 2701 and 2710).

5.2.7. Incident Reporting - The party discovering a security incident shall report it in accordance with its incident reporting procedures.

5.2.8. Audit and Monitoring Responsibilities - Both parties (Contractor and Government) are responsible for auditing application processes and activities involving the interconnection. Audit logs and/or reports will be retained for one (1) year from logged/reported event. Audit logs and/or reports will only be purged in a first-in, first out (FIFO) fashion. Activities that will be recorded include event type, date and time of event, user identification, workstation identification (by IP address and/or MAC address), and success or failure of access attempts.

Elevated audit and monitoring activities, to record the security actions taken to mitigate specific audit issue(s) or event(s), shall be afforded to system administrators (SAs) or security officers.

When using education/certification in conjunction with labor categories, the COR in coordination with the CO must establish a review process of contractor personnel to ensure labor category requirements are met.

5.3. General:

5.3.1. Database Subscriptions: Through the use of an internet-based portal, the contractor shall provide access to subscriptions via unique/individual username and password entry. The Contractor shall provide super-user access to the identified Government TLs, allowing the ability of the Government TLs to vet and grant various levels of subscription access, within the confines of this contract, to requesting service members at DoW Components and Support Activities.

Section 5.9 of the PWS contains a list of all the required subscriptions for end users. The Contractor will provide subscription access usage analytics to show quantity of individuals accessing the various database subscriptions on a 6 month and 12-month basis, as requested by DHA. The following database information will be provided:

5.4. Capital Guide Tool - Provides advisory support for medical equipment. Provides custom analyses that help pinpoint savings opportunities, negotiate discounts and identify unnecessary expenditures. Provides Service Analysis to ensure costs-effective and optimum support highlighting costs savings, discount histories, user experience reports, review of general terms and conditions and specific points for potential negotiation. Additionally, it provides Reagent Contract Analysis, Fair Market Value Analysis, Comparative Analyses of the Market, Custom Comparative Analysis based on what is needed by Stakeholders, Capital Budget Review for assessment of annual budgets.

5.5. Decision Visualization Tool - Accelerates complex decision making by engaging stakeholders in an unbiased, transparent process designed to support cost, quality, and outcomes initiatives.

5.6. Functional Equivalents Tool - Add-on Module to the Supply Guide gives unbiased guidance on the supply alternatives healthcare supply chain and how it can find functionally equivalent medical-surgical supplies and implants to help improve quality and lower costs.

Integrates with the Supply Guide Database, navigating out-of-stock/recall situations, vetting standardization opportunities and facilitating product conversions.

5.6.1. Dynamic ranking/comparative matrices of highly prevalent industry manufacturers’ product line common models within a device code.

5.6.2. Product identification tool sets for industry functional equivalents of medical-surgical supplies and implants to include pricing analytics.

5.7. Utilization Analytics - Add-on Module to Supply Guide. Identifies large savings opportunities and improves patient care by benchmarking product usage of medical surgical supplies against that of peer organizations and those within your health system to identify best/worst performers and inform your best practices. Utilization Analytics pinpoints elevated purchase quantities which could indicate “at risk” situations and assist in developing a corrective action plan.

5.8. Biomedical Guide – Subscription Service that provides planned maintenance intervals and times for medical devices, corrective maintenance data, inspection and planned maintenance procedures, cybersecurity best practices and procedures, expected and useful life for medical devices/systems, and consulting services as well as a database of discontinued devices and service acquisition costs.

5.9. A summary of required subscriptions is as follows:

Subscriptions Required for MEDLOG IT PMO and DHA MEDLOG

PWS Section

Alerts Automatch – Equipment 5.11.1.1 Alerts Automatch – Supplies 5.11.1.2

Alerts Workflow 5.11.1 Capital Guide Tool 5.4

Data Standardization – Equipment 5.1.1.1.1 Data Standardization – Supplies 5.1.1.1.2

Functional Equivalents 5.6 Supply Guide 5.1.1

Product Catalog 5.1.1.1.3 Utilization Analytics 5.7 Biomedical Guide 5.8

5.10. Patient Safety

Patient Safety (PS) Users with ECRI Alert tracking roles would be required to respond to PS communications within the PS Channel by the suspense date indicated in the PS communication.

5.10.1. The response will be recorded by using a Status menu with the following options:

5.10.1.1. Acknowledgement that communication was received, read, & disseminated within 24 hours of receipt.

5.10.1.2. Communication not applicable for this user.

5.10.1.3. Communication not applicable for this facility.

5.10.1.4. Other (the free text field would be available to enter additional information).

5.10.2. The Action menu would provide the following options:

5.10.2.1. Not applicable for this communication.

5.10.2.2. Action completed (the free text field would be available to enter additional information).

5.10.2.3. Other (the free text field would be available to ender additional information).

5.10.3. The Patient Safety Program (PSP) and PS Leads would have access to a dashboard that displays real-time metrics for the percentage of on-time PS communication acknowledgment data from the Status menu and the percentage of on-time action confirmation data from the Action Menu.

5.10.3.1. The Dashboard would display the enterprise-wide metrics as well as metrics grouped by network to allow PS Leads the ability to monitor the metrics of the MTFs within their market/network in order to determine which MTFs have or have not compiled.

5.10.3.1.1. PSP/PS use of Enterprise Technology Decision data is required to help pinpoint savings opportunities and identify unnecessary expenditures. Enterprise Technology Decision is comprised of Comparative Analyses (Market Intelligence Reports, Custom Comparative Analysis, Capital Budget Review), Exclusive Research Tools (Device Evaluation Online, International Vendor Guide, Device Comparison Guide, Capital Market and Analytics, Capital Budget Tool), and Patient Safety Resources (Basic Alerts Database). Use of these applications will lower expenditures on consumables by utilization of data-driven decisions.

5.10.3.1.2. The PSP will allow end users to view all Dashboard metrics from all MTFs in the entire enterprise with the ability to export the data for more in-depth analyses.

5.11. Repository of all Hazards, Alerts, and Recalls (HAR) for Government Medical Devices and Equipment (MDE) with sortable data points, to include respective HAR:

accession number, priority, subject/headline, device code, manufacturer, common model, publication date, status, status date, and U.S. Food & Drug Administration (FDA) class of recall.

5.11.1. HAR and MDE will utilize the DoW Enterprise Recall Management programs designed to automate and enhance the recall management process. Recall Management uses tracking recall activity in real-time using ECRI Alerts Workflow, said Alerts Workflow is a comprehensive alert and recall management solution that helps ensure the removal of harmful products before they reach the patient. Additionally, Alerts Workflow Alert and recall management solution that helps ensure the removal of harmful products before they reach the patient. System can be customized to organizational needs and offers integration with Computerized Maintenance Management System (CMMS) systems to help expedite the removal of potentially harmful products. System also allows for Group Tracking, support for Custom Private DoD Channels for post customized DoD Alerts, coverage of cybersecurity alerts, Automatch of alerts to inventories medical devices based on provided inventory of equipment assets and purchased supplies.

5.11.1.1. Alerts Automatch – Equipment - Add-on Module to Alerts Workflow, automatically identifies relevant alerts on equipment by comparing customer inventory/purchase order history and notifies staff daily of affected products to reduce time spent on recalls.

5.11.1.2. Alerts Automatch – Supplies - Add-on Module to Alerts Workflow, automatically identifies relevant alerts on medical supplies by comparing customer inventory/purchase order history and notifies staff daily of affected products to reduce time spent on recalls.

5.11.2. The DHA PSP will require 3 Patient Safety roles: DHHQ, PS Network Leads, and Patient Safety Managers (PSM). The PSP disseminates 2 types of PS closed loop communications: PS Alerts & PS Advisories and 1 one-way communications for FYSA: PS Notices.

5.11.3. The DHHQ PSP needs the ability to assign ECRI Coordinator roles to PS Network Leads, who can then assign roles ECRI Alert Tracking User roles to PSMs for each MTF.

5.11.4. A separate PS channel (or a PS group identifier that can be used to identify PS users) shall be created for the DHHQ PSP to disseminate PS communications to PSMs for each MTF that PS Network Leads can view in an FYI capacity. Alternatively, PS communications shall be available for distribution to PS Leads, who will disseminate the PS communication to the PSMs for each

MTF.

5.11.5. ECRI Alerts Tracking for Patient Safety communications for tracking will be done within the separate PS Channel or will only be disseminated to users that have the PS group identifier.

Ultimately, PS communications should only be disseminated to PS users.

5.11.6. MDE procurement and cost analytics tools sets and services:

5.11.6.1. MDE procurement and cost analytics tools sets and services are required, to include comparative product evaluations, price benchmarking data, contractor proposal analyses, service/maintenance contract analyses, consumable/reagent contract analyses, fair market value analyses, market share/sector intelligence, request for proposal analysis, Request for Proposal (RFP) templates, user experience reviews, justification analysis, capital budget reviews.

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1. All work under this contract is unclassified.

6.2. The TIER 1 or TIER 2 levels and position sensitivity designation for positions under this contract is:

6.2.1. TIER II: Non-critical sensitive position.

6.3. Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements: While the Performance Work Statement (PWS) and supporting documents for this service contract do not contain Personally Identifiable Information (PII) or Protected Health Information (PHI), compliance with DHA Administrative Instruction-110, Safeguarding Procurement Sensitive Information, is required.

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data. After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4. Training. Reserved

6.5. Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS. Reserved

6.6. Risk Management Framework (RMF) for DoD IT: All IS, Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DoDI 8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal Information Security Modernization Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

6.6.1. All systems subject to RMF must present evidence of authorization in the System Security Plan, Security Assessment Report (SAR) a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD Component PIT system accreditation decision that is current within 3 years within 5 business days of CO request. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or Authority to Operate with Conditions (ATO-C) by contract award.

6.6.2. The contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework (RMF) and DoDI 8510.01, Risk Management Framework (RMF).

6.6.3. The contractor shall configure the information system in accordance with Defense Information Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).