PWS_WBAMC_Dictation.pdf

Performance Work Statement (PWS) William Beaumont Army Medical Center (WBAMC)

Dictation and Transcription System

1. GENERAL:

William Beaumont Army Medical Center (WBAMC) has a need for a secure dictation and transcription system that is able to interface and store content within a patient’s medical record for future review and dissemination. The contractor shall provide the government with all of the necessary hardware, software, and personnel support needed to implement, interface, and maintain a fully functioning dictation transcription system, in accordance with the terms and conditions of this Performance Work Statement (PWS) and in compliance with Joint Commission guidance on professional standards. The Contractor shall furnish all of the management, supervision, training, consultations and reporting necessary to fulfill the range of commercial services that would be associated with a similar-typed system deployment at a civilian Medical Treatment Facility (MTF) in accordance with the following parameters:

2. SPECIFIC TASKS:

The contractor shall implement and support a dictation and transcription system that meets the salient characteristics specified in Appendix A and which is able to meet the performance thresholds specified in the performance requirements summary matrix in Appendix D.

2.1. The table below summarizes the hardware, software, hosting, and support services that’ll be accomplished by the Contractor throughout the fulfillment of this contract. In total, this contract will consist of one, twelve month base period, and four, twelve month option periods. The effort to be accomplished throughout the optional years of support will consist of software updates, interface maintenance, and help desk support.

Description

Authority to Operate (ATO) for System Perpetual Site Software Licenses

Interface Development for Essentris, CHCS/ADT, Genesis

Back-End Hosting & Transcription Services

Implementation and Face-to-Face Training Software Maintenance Interface Maintenance

Help Desk Support

2.2. The Contractor shall implement a software and hardware solution that enables the WBAMC staff to accomplish automated dictation and transcription services. Once this information is captured and generated, the transcribed documentation will be routed for review and signature as needed. Once finalized, documentation will be integrated into WBAMC’s electronic medical records in a variety of standard formatted templates (up to 25 different types), which will be determined by WBAMC staff. The transcription will be processed in an electronic format by the system without the need for continuous human manual input. Reports shall be back-end edited and returned with no errors in spelling, grammar, punctuation or missing words.

This secure digital information should be backed up and stored to a system repository for up to one year’s time for future access and review by WBAMC staff.

2.3. The Contractor’s record shall contain at a minimum the following information: date in, date out, title of the work, patient name and register number/social security account number (SSAN)/DoDID, originator’s name, priority designator (routine, priority, or stat).

2.4. The Contractor shall work collaboratively with WBAMC subject matter experts to ensure that the best possible outcome is achieved and to troubleshoot any potential issues that may arise.

The Contractor shall actively plan and document change management activities throughout implementation in order to mold the customer’s plans and manage their expectations.

2.5. The Contractor shall work with the government to establish a secure Admission, Discharge and Transfer System (ADT) inbound from Composite Health Care System (CHCS) to the dictation system and establish the secure ADT message traffic to Chartscript.com. The Contractor shall work with the government to build and maintain a permanent Essentris document upload interface. The Contractor shall work with WBAMC personnel to facilitate System Change Requests with the Defense Health Agency (DHA) Program Office in order to get approval to build and maintain these two interfaces. between Austin Hosting Center Transcription Service

2.6. The Contractor shall provide the B2B server at their hosting center. The Contractor shall work with the Defense Health Agency (DHA) and WBAMC to prepare the required paperwork to connect WBAMC through its B2B server and perform all required testing activities needed to use the proposed CHCS/ADT and Essentris interfaces.

2.7. The Contractor shall provide all documentation required to meet all regulatory compliance testing procedures.

2.8. This requirement can only be fulfilled by 3M’s Secure Enterprise Dictation and Transcription Solution (SEDTS). This solution is already in place in some Military Treatment Facilities including Evans Army Community Hospital (EACH) which will serve as the hosting center for WBAMC.

3. TRAINING & SUPPORT:

3.1. Within the 2 weeks leading up to the system achieving initial operational capability (IOC), the Contractor shall provide face-to-face, hands-on training sessions on the use of the system that’s tailored specifically to the type of user present, to include administrators, transcriptionists, physicians, super users, and others as needed. This training will be conducted within the applicable offices and locations of each group and will not cease until all of the questions from the users present have been fielded. Thereafter, throughout the course of this time, the Contractor’s staff will make themselves available to conduct one-on-one, over-the-shoulder administrative training for any users needing additional assistance in understanding the system’s workflow for their specific function.

3.2. After IOC has been achieved, the Contractor must provide remote and/or on-site technical support, to assist users with any type of help desk support needed, to include training new users.

3.3. If the dictation system ever becomes inoperable for any reason whatsoever, the issue shall be investigated within no less than two hours and worked to completion. If the issue is ultimately caused by a factor outside of the system itself, the vendor will help the Customer to identify the origins of the issue within four hours and provide guidance on how the problem can be alleviated.

4. HOURS OF PERFORMANCE:

4.1. The system is expected to be operational and accessible 24 hours a day, 7 days a week (aside from scheduled maintenance), and any unscheduled downtime that’s experienced throughout normal business operations must meet the thresholds identified in the performance requirement specifications.

4.2. Scheduled down time and maintenance should be performed outside of normal duty hours or during weekends with at least a 14 calendar day advanced notice, to be coordinated and approved by the WBAMC Information Management Division and Healthcare Informatics Division.

4.3. Notification of any unscheduled downtime and or degradation of performance within the system will be notified by the contractor to WBAMC Information Management Division within 4 hours.

4.4. Hours worked do not include travel time to reach the MTF or other place of performance.

4.5. Closures. During anticipated closure of the facility, that occurs only during the implementation timeline, due to Command declared training holidays or during unplanned closure of the facility due to natural disasters, military emergencies, severe weather, or otherwise, the Contractor shall not invoice the Government for services not performed and the Government will not be liable to the Contractors for any such closures.

4.6. Holidays. The following is a list of legal federal holidays as referred to elsewhere in the contract.

New Year’s Day January 1st Martin Luther King's Birthday 3rd Monday in January President’s Day 3rd Monday in February Memorial Day Last Monday in May Independence Day July 4th

Labor Day 1st Monday in September Columbus Day 2nd Monday in October Veteran's Day November 11th Thanksgiving Day 4th Thursday in November Christmas Day December 25th

NOTE: Any of the above holidays falling on a Saturday will be observed on the preceding Friday;

holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. If the area in which a contract employee is scheduled to work is closed due to the holiday declared by an Executive Order and the employee is not required to report in, payment will not be made for those hours. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

4.6.1. The military may designate a weekday as a Training Holiday if doing so would provide a three-day or four- day holiday weekend (e.g., Thanksgiving weekend, Friday is usually a military training holiday). For example: the following is a list of remaining FY18 Training Holidays:

Friday before Presidents’ Day Friday before Memorial Day Thursday after Independence Day Friday before Labor Day

5. SERVICE TECHNICIANS & APPROVAL OF SERVICES:

5.1. The Contractor shall provide a sufficient number of qualified service technicians to perform necessary service on any government equipment located at a hosting center. When on-site performance is required at WBAMC, personnel should check-in at the front desk in A Lobby on Level 1. Once checked in, the Contractor shall report to the Information Management Division, Help Desk, Room 1BC37, Level 1, to check in with the Point of Contact (POC), Chief Information Officer (CIO), Deputy Chief Information Officer (DCIO), Chief Technology Officer (CTO) or Office Manager before proceeding to complete the service repair work.

5.2. The contractor shall only accept calls for service from the POC, CIO, DCIO, CTO, or a Core Technology Branch, Systems Team representative. Upon completion of any service, a written service report shall be provided to the Information Management Division (IMD) with detailed information regarding the equipment malfunction and corrective action taken. The report shall be faxed or emailed to IMD within five (5) working days. This report shall include part numbers, price per part, and the serial number and model number of the equipment.

However, these items are to be covered under the maintenance agreement.

5.3. Any and all services performed outside the scope of this agreement without the prior approval of the Contracting Officer, shall not be paid for.

6. PREVALIDATION SCREENING:

6.1. In order for a vendor to be considered a viable option for award and to be considered a viable potential for competition purposes, the proposed system must successfully accomplish Nessus and Security Content Automation Protocol (SCAP) vulnerability scans, which is to be paid for by the vendor, at their own cost. The system solution must fulfill the following pre-validation criteria listed below:

• No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

• No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

• No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

• No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

7. CERTIFICATION AND ACCREDITATION:

7.1. Certification & Accreditation (C&A) requirements apply to all DoD and contractor's IS/networks that receive, process, display, store or transmit DoD information. The contractor shall comply with the C&A process for safeguarding SI. Certification is the determination of the appropriate level of protection required for IS/networks. Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network. Accreditation is the formal approval by the government to operate the contractor's IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections;

and with appropriate level of protection for the specified period.

7.2. Certification & Accreditation requirements shall be met before the contractor's system is authorized to access DoD data or interconnect with any DoD IS/network that receives, processes, stores, displays or transmits DoD data. Within 60 days following contract award, the required documentation necessary to receive an Approval to Operate (ATO). The contractor shall make their IS/networks available for testing, and initiate the C&A testing four months (120 days) in advance of accessing DoD data or interconnecting with DoD IS/networks. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

• Attending and supporting C&A meetings with the government

• Supporting/conducting the vulnerability mitigation process

• Supporting the C&A Team during system security testing

7.3. Contractors must confirm their IS/networks are locked down prior to initiating testing.

Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA). Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

7.4. Any re-configuration or change in the system during the C&A testing process will require a re-baselining of the system and documentation of system changes.

7.5. The vendor shall rectify all vulnerabilities identified as Very High, High, and Moderate Severity, CAT I and CAT II vulnerabilities or any other issues identified by the government as "must-fix" items IAW a timeline identified by the Government Representative. C&A Checklists are provided for complying DoD C&A requirements. Reference material and C&A tools may be obtained at: http://www.tricare.osd.mil/tmis_new/ia.htm.

7.6. A request for a waiver to the C&A requirements may be submitted for temporary testing or for other circumstances. A waiver request must be submitted, in writing, to the Designated Approving Authority (DAA). The request must include mitigation strategies that ensure adequate protection measures and security controls are in place (for example: air gapping a testing network).

8. CYBER SECURITY REQUIREMENTS:

8.1. The contractor shall comply with DoDI 8582.01 Security of Unclassified DoD Information on Non-DoD Information Systems and Cyber-security and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53/53a and NIST SP 800-37, “Risk Management Framework (RMF) Guide for Applying the Risk Management Framework to Federal Information Systems, as well as emerging DoD Cybersecurity policy designed to address evolving threats.

8.2. The contractor shall identify the security controls in accordance with Committee on National Security Systems (CNSS) Instruction No. 1253, “Security Categorization and Control Selection for National Security Systems” as outlined within NIST SP 800-171, based on the categorization of confidentiality, availability and integrity of the information type and information technology provided by the government.

8.3. The contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework (RMF).

8.4. The contractor shall configure the information system in accordance with Defense Information Agency (DISA) security technical implementation guides (STIGs).

8.5. The contractor shall ensure that the information system conforms to the requirements of DoDI 8551.01 “Ports, Protocols, and Services Management (PPSM)”.

8.6. The contractor shall ensure that the information system shall authenticate all entities as specified in DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access.

8.7. The contractor shall Public Key enable the information system, implementing digital signature and encryption requirements specified in DoDI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling.”

8.8. The contractor will be responsible for compliance with the United States Cyber Command issuances and Information Assurance Vulnerability Management (IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

8.9. The contractor shall support reciprocity, by providing all NIST security documents directed information to the government.

8.10. The contractor shall implement system level protection and detection capabilities that are consistent with their contract for NIST Security requirements that meet DoD and DHA Cybersecurity Architectures.

8.11. The contractor shall self-certify that the information system is compliant with the applicable NIST security controls annually by submission of a Security Assessment Report (SAR) and security test plan for compliance of testing IA controls.

8.12. The contractor shall comply with the incident management requirements of Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, “Cyber Incident Handling Program”.

9. HEALTH INFORMATION SECURITY REQUIREMENTS:

Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the contractors must:

• Notify the TMA Privacy Office.

• Sign a Data Use Agreement (DUA). If access and/or extraction of PHI is required from a

DoD AIS for any reason, the contractor must request and receive an approval of the DUA prior to accessing, extracting, copying, or storing information to or from any DoD AIS.

The DUA must be approved by the TMA Privacy Officer, TRICARE Management Activity, before PHI may be used by the contractor as stated above. The contractor shall only request access to the minimum amount of data required to achieve the objectives outlined and specified in the DUA. Once a DUA is approved, the contractor must fully comply with all terms and conditions stated therein. The DUA is a separate contract with its own terms and conditions. The contractor shall only retain the data for the minimum amount of time required to achieve the objectives outlined and specified in the DUA.

DUAs are active at a maximum, for one year, and at the expiration of which the contractor must renew it or submit a Certificate of Data Destruction to the TMA Privacy Office.

• Comply with all HIPAA requirements.

• Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

The contractor shall ensure that data which contains PHI is continuously protected from unauthorized access, use, modification, or disclosure. The contractor shall comply with all previously stated requirements for HIPAA, Personnel Security, Electronic Security, and Physical Security.

10. VULNERABILITY MANAGEMENT:

10.1. The contractor shall implement an information assurance vulnerability management (IAVM) program. The DoD IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to MHS systems. As part of the program, the contractor shall provide a primary and secondary point of contact in the Vulnerability Management System (VMS) and to the MHS Information Assurance Vulnerability Alert (IAVA) Monitor. The point of contact shall provide, upon receipt of a vulnerability message, an acknowledgment of receipt via the VMS. The contactor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance in the VMS. Receipt and compliance messages to the government shall occur within the stipulated time window, as stated in the vulnerability message or in the VMS.

10.2. The contractor shall ensure AIS assets that are under development are registered in the VMS and have all applicable electronic patches installed for the system (1) when the system is delivered to the Government, or (2) if the AIS assets are used to store or process Government data prior to delivery (such as when being used in testing and development).

10.3. Guidance regarding the requirement for IAVM is contained in the DoD Information Assurance Vulnerability Alert (IAVA) December 30, 1999 memorandum and Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01 (Appendix A to Enclosure B) provides additional reference information. Implementation is addressed in the Defense Information Systems Agency (DISA) IAVA Process Handbook, Version 2.1, June 11, 2002. An asset is defined as any hardware device, such as a router, firewall, server, or an operating system image accessed by more than one user. Primary servers and the workstations that they support are assets that must be registered in the VMS. The DISA VMS web enabled application is used to disseminate IAVAs, Information Assurance Vulnerability Bulletins (IAVBs), and Information Assurance Technical Advisories down to the System Administrator (SA) and applicable personnel throughout the chain of command.

10.4. The contractor shall maintain any development environments in accordance with TMA Information Assurance IA best practices and operational requirements. During product development for the government, the contractor shall ensure that all IA mitigation strategies have been applied to the development environment prior to any Government data being loaded onto any assets or software for testing or delivery.

10.5. IA mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the government shall be in compliance with all known applicable Department of Defense Computer Emergency Response Team (DoD-CERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

10.6. Disposing of Electronic Media. Vendors shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Vendors are required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

10.7. Ports Protocols and Services. Vendors shall follow all current DoD and Defense Information Systems Agency (DISA) standards and requirements for acceptable Ports, Protocols, and Services. Any requests for exception to using the current DISA Ports, Protocols, and Services standards requires an request for exception sent through the Program Manager to the

DAA.

10.8. Public Key Infrastructure and Encryption. Vendors shall follow the DoD standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication. Where interoperable PKI is required for the exchange of unclassified information between DoD and its vendors and contractors, industry partners shall obtain all necessary certificates. Vendors must turn over to the Government all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support. The Vendor must provide a written report detailing all of the above, prior to task order expiration, regardless of modifications or extensions.

10.9. Information Systems (IS)/Networks Physical Security. The contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the contractor will support a Physical Security Audit performed by the Government of the contractor's internal information management infrastructure. The MHS Physical Security Audit Matrix is available at the following website:

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_/012304/0930/clean/version.xls. The contractor shall correct any deficiencies identified by the Government of the contractor's physical security posture. The contractor shall be required to follow all requirements in the MHS Information Assurance Policy. New MHS policies will be posted to the following website:

http://www.tricare.osd.mil/tmis_new/IA.htm.

11. GENERAL SECURITY REQUIRMENTS:

11.1. Access and general protection/security policy and procedures. Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy.

In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

11.2. For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

11.3. The contractor shall validate that all contractor employees performing service on the installation are United States citizens or hold a valid resident alien status providing proof of alien registration with the Immigration and Customs Enforcement Service and shall be able to understand, speak, read, and write in the English language. An employee may be barred from entering the installation because of misconduct or breaches of security violations. This will be verified by the Law Enforcement Agency. The contractor shall not enter restricted or OFF LIMIT areas.

11.4. Contracted personnel shall prominently display contractor furnished identification badges in a visible location above their waist at all times while physically on the installation performing contractual requirement. Each badge shall include the company’s name, employee name, contract number, and expiration of the badge.

11.5. During increased Force Protection Conditions (FPCONs), entry requirements to the installation may change with little to no notice. Depending on the incident or threat, all personnel to include contractors may be denied access to the installation for safety/security reasons. Contractors are subject to spot checks or inspections of the vehicles and personal items at entry control points or facility access points during higher threats or during random antiterrorism measure checks. Failure to comply with these added security measures may result in denial of access to the installation.

11.6. AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website:

http://jko.jten.mil.

11.7. iWATCH Training. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

11.8. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS.

11.9. The contractor shall comply with DoD Directive 8500.1, "Information Assurance (IA)," DoD Instruction 8500.2, "Information Assurance (IA) Implementation," DoD Directive 5400.11, "DoD Privacy Program," DoD 6025.18-R, "DoD Health Information Privacy Regulation," and DoD 5200.2-R, "Personnel Security Program Requirements."

11.10. The contractor shall follow the TMA Privacy Office guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) security clearances and ensure all contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations. Contact the TMA Privacy Office for guidance on the appropriate ADP/IT levels for personnel on the contract. The TMA Privacy Office procedures for personnel security are listed on the following website:

http://www.tricare.osd.mil/tmaprivacy/personnel-security.cfm

11.11. The contractor shall initiate, maintain, and document personnel security investigations appropriate to the individual's responsibilities and required access to Military Health System (MHS) Sensitive Information (SI).

11.12. The contractor shall immediately report to the TMA Privacy Office and deny access to any automated information system (AIS), network, or MHS SI information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate government representative for security reasons.

12. PUBLICATIONS:

Following is a list of basic publications applicable to this contract. Current issues of many DA publications can be accessed at http://www.usapa.army.mil. Current issues of many forms can http://jko.jten.mil/ be accessed at http://www.usapa.army.mil. Publications and forms not on the internet can be obtained from the MTF. The Publications have been coded as mandatory or advisory. The Contractor is obligated to follow those coded as mandatory only to the extent that they apply to this contract. Supplements, amendments, or changes to these mandatory publications may be issued during the life of the contract. Advisory publications may be used for information and guidance but are not binding for compliance.

12.1. Mandatory Publications:

10 USC 1089 - Defense of Certain Suits Arising Out of Medical Malpractice

10 USC 1091 - Personal Services Contracts PL 91-596 - Occupational Safety and Health Act 0f 1970 PL 101-647, Section 231 - Crime Control Act of 1990 PL 102-190, Section 1094 - National Defense Authorization Act PL 104-191k - Health Insurance Portability and Accountability Act of 1996 DoD Directive 5200.28 - Security Requirements for Automated Information

Systems DoD 5200.2-R - Personnel Security Program DoD 6025.18-R - Department of Defense Health Information Privacy

Regulation DoD 8580.02-R - DoD Health Information Security Regulation DoDI 1402.5 - Criminal History Background Checks on

Individuals In Child Care Services

12.2. Advisory Publications:

AR 310-25 - Dictionary of United States Army Terms

MEDCOM Pam 25-31 - Index of Command Administrative Publications (16 Sep 02)

12.3. Applicable MTF Standard Operating Procedures (SOPs) and Policies:

AR 25-2 - Information Assurance AR 40-1 - Composition, Mission, and Functions of the Army

Medical Department AR 40-3 - Medical Services: Medical, Dental, and Veterinary

Care AR 40-4 - Army Medical Department Facilities/Activities AR 40-5 - Preventive Medicine AR 40-48 - Non-Physician HCPs AR 40-66 - Medical Records Administration and Health Care

Documentation AR 40-68 - Clinical Quality Management AR 40-501 - Standards of Medical Fitness

AR 40-562 - Immunizations and Chemoprophylaxis AR 340-21 - The Army Privacy Program (05 Jul 85) AR 351-3 - Professional Education and Training Programs of the Army Medical Department AR 380-19 - Information Systems Security AR 380-67 - The Department of the Army Personnel Security

Program AR 385-40 - Army Accident Investigations and Reporting AR 600-85 - Army Substance Abuse Program Civilian Services MEDCOM Reg 715-3 - Contractor/Contractor's Employees and MEDCOM

Personnel Relationships

12.4. Standard Forms:

The following is a listing of forms that may be required, and may customarily be used by a HCP performing services. A complete list of forms can be accessed at http://www.apd.army.mil/AdminPubs/ProductMap.asp.

SF 85-P - Questionnaire for Public Trust Positions SF 88 - Medical Record – Report of Medical Examination SF 93 - Report of Medical History SF 504 - Medical Record - History SF 505 - Medical Record – History – Parts 2 and 3 SF 506 - Medical Record – Physical Examination SF 507 - Medical Record SF 509 - Medical Record – Progress Report SF 513 - Medical Record – Consultation Sheet SF 515 - Medical Record - Tissue Examination SF 519-B - Radiologic Consultation Request/Report

(Radiology / Nuclear Medicine / Ultrasound / Computed Tomography Examinations)

SF 523 - Medical Record –Authorization for Autopsy SF 523A - Disposition of Body SF 541 - Medical Record – Gynecologic Cytology SF 550 - Medical Record –Urinalysis SF 551 - Medical Record –Serology SF 557 - Medical Record – Miscellaneous SF 558 - Medical Record – Emergency Care and Treatment SF 600 - Medical Record – Chronological Record of Medical

Care

12.5. Department of Army:

DA 3894 - Hospital Report of Death DA 4106 - Incident Report http://www.apd.army.mil/AdminPubs/ProductMap.asp

DA 4700 - Medical Record – Supplemental Medical Data DA 5008 - Telephone Medical Advice/Consultation Record

12.6. Department of Defense:

DD 577 - Appointment/Termination Record – Authorized Signature

DD 689 - Sick Slip, Individual DD 1289 - Prescription Form DD 2161 - Medical Care, Referral for Civilian DD 2795 - Pre-Deployment Health Assessment Questionnaire DD 2796 - Post-Deployment Health Assessment

12.7. Other Forms:

FD Form 258 - FBI US Department of Justice Fingerprint Card

13. POINTS OF CONTACT:

i. End-User:

Name: Debra Moody Title: Systems Administrator E-mail Address: Deborah.m.moody.civ@mail.mil Office Phone: 915-742-2722

ii. Project Management:

Name: Jeff Cunningham Title: HNC MCISS PM E-mail Address: jeffrey.w.cunningham@usace.army.mil Office Phone: 256-895-1091

Name: Kevin Miller Title: HNC MCISS PgM E-mail Address: Kevin.B.Miller@usace.army.mil Office Phone: 256-895-2503

14. INVOICING INSTRUCTIONS / PROCEDURES FOR PAYMENT:

The Government will accomplish monthly progress payments against this contract as the work to be accomplished is underway. The contractor shall submit only one invoice per month, which should be submitted by the twenty-fifth calendar day of the month following:

mailto:jeffrey.w.cunningham@usace.army.mil mailto:Kevin.B.Miller@usace.army.mil

• the end of the invoiced month (for services).

OR

• the end of the month in which the products or deliverables were accepted by the Government.

a. Initial Acceptance Coordination:

Invoices shall initially be submitted via email to the Customer Representative(s) identified below so they can certify that the associated products have been received and/or the services have been rendered. In response the Customer Representative(s) will electronically identify that payment should be made.

• Femia.D.McElveen.civ@mail.mil

• Emily.R.Lacey.mil@mail.mil

* Acceptance Coordination is REQUIRED prior to any Invoice Submission.

b. Invoice Submission Coordination:

Contractors shall submit all invoices along with acceptance coordination from the customer representative(s) via email to the following locations for final processing:

• ITS_MCIS_INVOICES@usace.army.mil

• kevin.miller@usace.army.mil

• jeff.cunningham@usace.army.mil

* Contractors SHALL NOT submit invoices via Wide Area Workflow (WAWF). All invoices submitted to WAWF will be REJECTED.

c. Content of Invoice:

The invoice shall be submitted on official letterhead in Adobe’s Portable Document Format (PDF) and shall include the following information at a minimum.

• Name and address of the contractor (Note: Differences between the remittance address on the invoice and the data on record in the System for Award Management (SAM) can potentially cause delays in payment. Please verify these data agree exactly.)

• Invoice date and number

• Entire Contract number, contract line item number, the order number and modification number as applicable.

• Description, quantity, unit of measure, unit price and extended price of the item delivered. Item description must match those contained in the purchase order/contract description.

• Delivery tracking information to include tracking number and name of the person accepting delivery.

mailto:Femia.D.McElveen.civ@mail.mil mailto:Emily.R.Lacey.mil@mail.mil mailto:ITS_MCIS_INVOICES@usace.army.mil mailto:kevin.miller@usace.army.mil mailto:jeff.cunningham@usace.army.mil

• In cases where there is no physical delivery, please include all email correspondence to the electronic delivery POC (the customer) when the product becomes available for download or is renewed in accordance with the statement of work. Read receipts may help substantiate electronic delivery.

• Name and address of official to whom payment will be sent

d. Final Invoice:

Final payment will be processed only after all of the terms outlined in this performance work statement have been fulfilled. Final Invoices shall be clearly marked “FINAL” and submitted within 30 days after period of performance end date specified in contract. NOTE – In some cases the first invoice may also be the final invoice.

Appendix A:

Salient Characteristics

The dictation system must have back end speech recognition (BESR) capability and be able to fulfill all of the parameters specified below:

The system must be able to support over 100 concurrent transcriptionist users and 500 concurrent dictation users at one time and can be expanded to accommodate a higher number of users, if needed.

The system shall have the capacity to process up to 1 million lines of transcription per year.

The system should offer back end speech recognition capability that allows the provider to speak from anywhere into a computer, phone, and/or Vocera Communications Badge, to dictate his/her notes. The system must dictate spoken communication without the need for a user to compensate for any system processing lag.

The system should automatically learn the dictator’s speech patterns, without having to train it, to reduce automated transcription errors over time with usage.

All exported files must be in compliance with Joint Commission Operative Report standards.

The system should backup and format dictation into a viewable file that can be edited, printed, and electronically signed online.

System should allow customizable template options for headers and footers.

The system should notify providers via email when there are reports needing to be signed.

The system must be flexible to allow providers to “self-edit” their dictations after BESR based on document type.

System must operate in a completely paperless manner with printing available on-demand and allow the inpatient medical records and coding departments the ability to preview and print signed and unsigned transcribed reports.

System should not allow a report to be finalized/signed by a medical professional that contains missing mandatory information.

Files should be able to be sent to other staff members, and when received, recipients should receive notifications to take action. Document status should be verifiable online.

The system should have online account maintenance capabilities for all user accounts.

The system should have management and reporting tools that can export data to validate service provider invoice information and to identify accuracy and timeliness metrics for return on investment (ROI) purposes.

The system must be able to interface with the Essentris Electronic Health Record (EHR) system for immediate upload of Operative Reports, and it must be able to download the Admissions, Discharge, and Transfer (ADT) data feeds from the Composite Health Care System (CHCS).

System must be able to integrate with MHS Genesis electronic health record within one year following the contract award.

Onsite training for system administrators, providers, and coders shall be included.

The system must have robust security features which protect Patient Health Information, to include data at Rest Encryption (D@RE), and the ability to secure data in transit between hospital and a secure data center via B2B capability.

The system shall be HIPAA compliant.

The system must have a current and maintainable, authority to operate (ATO) on a DoD network.

Must be compliant with Windows 10, 8, and 7 operating systems.

Appendix B:

Performance Requirement Specifications Matrix

PERFORMANCE

REQUIREMENT

STANDARD

METHOD OF

ASSESSMENT

Implementation of a dictation and transcription software system which quickly generates transcribed dialogue with proper spelling, capitalization, punctuation, and without any omissions of spoken words.

Dictation system must be accurate and reduce current note-writing time by 75%.

The system’s electronic reports and other data outputs will be analyzed for performance metrics.

System must achieve Initial Operating Capability within six months.

System must meet anticipated threshold and be in compliance with federal, state, and local guidelines concerning data security of personal health information (PHI).

The system will be inspected by system users and WBAMC IA personnel.

Must be able to interface with CHCS, Essentris, and Genesis databases.

The system interfaces must be operational, functional, and in compliance with commercial security standards and in compliance with federal, state, and local guidelines concerning data security of personal health information (PHI).

The system will be inspected by system users and WBAMC IA personnel.

System to be operational and functional for 24/7 operations.

Any issues resulting in performance operations outside commercial standards must have remedy initiated within two hours and a remedy plan must be provided within four hours if unmitigated. Unscheduled system downtime incidents during normal business hours should not occur more than twice per quarter and should never exceed a 48 hour period. Scheduled maintenance should always occur outside of normal business hours and must be coordinated/approved by the COR at minimum of seven days prior.

The system’s electronic reports and other data outputs will be analyzed for performance metrics.

Appendix C:

Release of Claims

CONTRACT NO.________________________TASK ORDER NO._____

Contractor Name: ___________________________________ Address: ___________________________________

Pursuant to the terms of the above-referenced Contract or Task Order, and in consideration of the sum of $______________________, Contractor, or its successors or assignees, upon payment of the said sum by the United States of America (hereinafter, the Government), hereby releases the Government from all claims, demands, and obligations arising under said Contract or Task Order, or any modification thereof, except specified claims stated as follows (if no claims, indicate “NONE”): __________________________________________.

In WITNESS WHEREOF, this Release of Claims has been executed this ____ day of _________________, 201___.

Signature: _________________________________________ Name: _________________________________________ Title: _________________________________________

CERTIFICATE

I, ___________________________, certify that I am the _______________________ (official title) of the company referred to herein as Contractor, and that the individual executing this Release of Claims is duly authorized to bind said Contractor.

Signature

Performance Work Statement (PWS)