POCT systems PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

Licenses for UNIPOC Open Platform Data Management System Point of Care Testing

William Beaumont Army Medical Center 18511 Highlander Medics St.

Ft. Bliss, TX 79906-5327

Part 1

General Information

1. GENERAL: This is a non-personnel request to provide a license for the Nova StatStrip whole blood glucose system, Abbott i-STAT portable blood analyzer, Abbott POC DE Module, and the Siemens RAPIDPoint 500e blood gas system on the Siemens UNIPOC middleware platform currently in use.

The Government shall not exercise any supervision or control over the software license providers performing the responsibilities herein. Such software license providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Software Upgrade/Introduction: The contractor shall provide all training/support personnel, supplies, transportation, tools, materials, supervision, software and other items and non-personal items necessary to support the Nova StatStrip license, the Abbott i-STAT license, Abbott POC DE Module license, and the Siemens RAPIDPoint 500e license for the POCT program as defined in this Performance Work Statement except for those items specified as government furnished property. The contractor shall perform to the standards in this contract.

1.2 Background: The Point of Care Testing (POCT) office manages all testing performed by non-laboratory personnel throughout William Beaumont Army Medical Center (WBAMC). POCT plays several distinct roles within the Department of Pathology at WBAMC and is focused on providing accurate and timely laboratory results at the patient’s bedside. WBAMC POCT currently has the Nova StatStrip glucometer system, the Abbott i-STAT blood analyzer, Abbott POC DE Module, and the Siemens RAPIDPoint 500e blood gas analyzer. These three systems require a license, provided by the middleware vendor Siemens, in order to establish interfacing and connectivity.

The WBAMC POCT systems licenses provide the ability to use the UNIPOC data management system which manages inventory, linearity and QC data, staff training and assessments, proficiency tracking, patient identifiers and results to include date/time of testing and system operator. Monthly reports generated from the system include statistical analysis of workload, Levi-Jennings QC charts, linearity evaluation, and operator data mining.

The WBAMC POCT systems licenses for the UNIPOC system ensures Joint Commission and College of American Pathologists compliance by placing the result directly into the electronic medical record.

1.3 Objectives: The overarching objectives of the support described in this PWS are to:

• Purchase the Nova StatStrip license, the Abbott i-STAT license, Abbott POC DE Module license, and the Siemens RAPIDPoint 500e license on the Siemens UNIPOC middleware.

Siemens must have a Certificate of Noteworthiness/Authority to Operate at the current hospital on 18511 Highlander Medics St., Ft. Bliss, TX 79906.

• Facilitate the operation and expansion of the Nova StatStrip system, the Abbott i-STAT system, the Abbott POC DE Module, and the RAPIDPoint 500e system on the UNIPOC middleware.

• These systems licenses must support, at least, 55 NOVA StatStrip glucometers, 20 Abbott i-STAT analyzers, Abbott POC DE Module, 4 Siemens RAPIDPoint blood gas analyzers and all WBAMC operating personnel to include interfacing with MHS Genesis.

• Ensure that technical projects are executed on schedule and in accordance with technical requirements.

• ESTABLISHING INTERFACE:

(a) The POCT systems shall bi-directionally interface with the Military Healthcare

System (MHS) Genesis and the laboratory information system (LIS), as specified in the SOW.

1.4 Scope/Requirements: This PWS describes the scope of work, objectives, tasks and resources needed to successfully fulfill POCT’s IT support related responsibilities to advance the organization’s mission. As a result, POCT must establish these capabilities in order to better collaborate with its business partners, prioritize IT projects, select high value opportunities to enhance services, and effectively and efficiently operate the organization’s POCT resources.

1. INFORMATION SECURITY

1.1. TELECOMMUNICATION

6.1.1. All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software must be approved through the DHA Software and Application Certification Assessment. Submission of DHA Application Request Worksheet must be completed within the six (6) months of contract award.

6.1.2. The Contractor shall follow Army Regulation 25-1, “Army Knowledge Management and Information Technology, AR 25-2, “Cybersecurity,” and DoD 6025.18-R, DoD Health Information Privacy Regulation.

6.1.3. In accordance with contract requirements, Contractors shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

6.1.4. The Contractor shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies and will provide, maintain and configure VPN concentrator that complies with DoD security standards.

6.1.5. All costs for VPN hardware and software shall be incurred by the Contractor.

6.1.6. The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chief Information Officer.

6.1.7. The Contractor shall validate that systems authenticate users through the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the vendor's technical users will maintain secure logon.

6.2. DEPARTMENT OF RISK MANAGEMENT FRAMEWORK (RMF) IMPLEMENTATION PLAN

6.2.1. The Vendor shall provide information for the Risk Assessment Analysis to the Government for all networking IT applicability.

6.2.2. Vendors shall only offer items, which already have an Authorization to Operate (ATO) or Authorization to Operate – Conditional (ATO-C). Vendors with an ATO-C must complete the full ATO process within 6-months of award of the contract.

6.2.3. Any offered system must meet DoD Cybersecurity/Risk Management Framework (RMF) and the attached Service Information Assurance (IA) requirements. Vendors are required to provide a statement with their quote that they agree to the Service Cybersecurity/IA Requirements, HIPAA requirements and B2B requirements that are attached to this RFO.

6.2.4. Vendors are required to provide a completed Joint Medical Device Risk Assessment Questionnaire (v1.1) for the offered system along with their offer. These should be provided by DHA Cyber Logistics or local IMD.

6.2.5. RMF shall be evaluated as part of the System Capability Factor. Vendors must meet all the below RMF minimum requirements along with any additional RMF requirements listed/attached to the RFO. Vendors may be assigned strengths if they exceed any RMF minimum requirement and/or meet any RMF objective.

Additionally, weaknesses may be assigned based on the vendor’s responses in the Joint Medical Device Risk Assessment Questionnaire (v1.1). RMF weaknesses may include but are not limited to; deficiencies in architecture or software versions, other services having cancelled RMF efforts due to vendor non-responses or inability to get an RMF ATO, system having received a DATO from any service, and deficiencies that cannot be mitigated/accepted.

6.2.6. Submitting a quote for any requirement under this initiative constitutes full agreement to all specific Service IA requirements and the attached IA document.

6.2.7. Failure to agree to the attached Service IA requirements and to provide a completed Joint Medical Device Risk Assessment Questionnaire shall result in rejection of the vendor’s quote. Failing to disclose that a system cannot meet IA requirements, failure to meet certification timeframes or failure to receive ATO may result in termination for cause in accordance with FAR 52.212-4(m).

ESTABLISHING INTERFACE:

(a) The system shall bi-directionally interface with the Military Healthcare System (MHS) Genesis and the laboratory information system (LIS), as specified in the SOW.

(b) The system shall have the ability to receive HL7 or scripted order messages (ORM) and information from the LIS and provide DICOM Modality Worklist to the modalities.

(c) If the vendor is not already approved to connect to MHS Genesis bi-directionally, the vendor shall agree to complete any bi-directional interface integration at no additional cost to the Government. Interface integration must be completed prior to final acceptance of the system.

6.1. SECURITY CLEARANCES

6.1.1. Personnel to be assigned to an Automated Data Processing (ADP)/IT position must undergo a successful security screening before being provided access to DoD information technology resources. Prior to an employee being granted interim access to DoD sensitive information, MAMC must receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement shall (must) be met by Contractors, subcontractors and others who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under HIPPA.

Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees shall (must) have at a minimum an ADP Sensitivity Designation of Level II to access the DoD Network.

6.1.2. All Contractors that use the DoD gateways to access Government systems shall submit a DISA Form 41 or equivalent in accordance with COR guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface. Contractors shall complete and submit to TMA one Form 41 for their organization, attached to which shall be a listing of those individuals for whom background checks have been completed, submitted to the OPM, and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request must clearly delineate the ports and protocols used for each Internet Protocol (IP) address. The Contractor shall complete the form and submit to the Government for final processing.

6.1.3. All costs for the Contractors employee background investigations are the responsibility of the Contractor, unless the investigation is completed by the Government, which would be at no cost to the Contractor.

6.1.4. The terms and conditions of this clause must be completed no later than three (3) months post award.

6.4. BUSINESS TO BUSINESS (B2B) PARTNERS AND 3rd PARTY VENDORS

6.4.1. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

6.4.2. PERSONNEL SECURITY.

6.4.2.1. The Contractor shall comply with the following:

• DoD Directive 8500.01, “Cybersecurity

• DoD Directive 5400.11, “DoD Privacy Program”

• DoD 6025.18-R, “DoD Health Information Privacy Regulation”

• DoD 5200.2-R, “Personnel Security Program Requirements”

• Local regulations as deemed appropriate by the Information Assurance Officer

• AR 25-1, “Army Knowledge Management and Information Technology”

• AR 25-2 “Cybersecurity”

• AR 525-13 Antiterrorism

• AR 530-1 Operations Security (OPSEC)

• DOD Instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology

(IT)

6.4.2.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

6.4.2.2.1. Follow the DoD guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT- III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

6.4.2.2.2. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility local area network (LAN).

6.4.2.2.3. Immediately report to the MTFs Security Office and deny access to any automated information system (AIS), network, or information if a Contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for any reason.

6.4.2.2.4. Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

6.4.2.3. AT Level 1 Training. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities, and controlled access areas shall complete AT Level 1 training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR, or to the Contracting Officer, if a COR is not assigned, within 10 days after completion of training by all employees and subcontractor personnel. AT Level 1 Awareness Training is available at the following website: https://atlevel1.dtic.mil/at.

6.4.2.4. Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractors employees shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as direct by DOD, HQDA, and or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

6.4.2.5. OPSEC Training. Per AR 530-1, Operations Security, new contractor employees must complete Level 1 OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete annual OPSEC awareness training.

Software and systems support in analyzing, troubleshooting, testing and making recommendations related to systems environment.

o Work in coordination with other network efforts WBAMC wide to improve network performance.

o Implement all networking security standards to the networking equipment that resides on the network in accordance with security policies.

o Provide administrative access to allow supervisors to assign cutoffs and lock out parameters in the event that linearity and/or QC data is outside of acceptable parameters or if competency assessments of testing personnel have expired. Lock outs should also be programmable to prevent patient testing if QC has not been performed on the appropriate schedule for all interfaced instrumentation or if any testing component has expired.

o Program and analyze linearity data for all POCT systems.

o Track competency assessment completion and expiration dates.

o Maintain a list of all approved operators, patient identifiers and results of patient testing to include date and time of testing.

o Direct upload of patient results to the patients’ electronic medical record using a scripted interface.

o Inventory management to include a minimum of two lot numbers for each instrument control level, strips, reagents and/or cartridges to include expiration dates.

o Generation of monthly reports to include workload, QC data including Levi-Jennings charts, linearity charts, correlation and statistical analysis of operators and patient data from a single location.

o Ability to program and track proficiency samples.

o Capability to track individual users through unique operator log-ins.

o Ability to read barcode (code 128 code 039) and manual entry patient identifiers.

• Perform configuration, installation, training and other system administration functions as necessary.

o Provide Operating System (OS) services and Administration to include enterprise system management, server and SAN administration, and user account management.

o Software engineering support in the integration of existing baseline and non-baseline software into the systems environment.

• Define and document customer needs and requirements and develop and establish system specifications.

• Troubleshoot, diagnose and resolve outages and other problems with web servers, data processing servers and database servers.

o Provide for Incident Response and Problem Management including root cause of system problems, such as configuration issues resulting in operational performance degradation or system outages, supporting the local manager with information and advice on the necessary corrective actions and/or interim workarounds. The associated operational support process requires careful management and planning to ensure optimal results at all times. Incident Response activities include: problem identification, recording, classification, diagnosis, metrics, and reporting. Error Control includes providing correction of configuration items to resolve or remove errors, faults, or inconsistencies, in conjunction with the overall management of known errors while they remain unresolved and until they are eliminated by the successful implementation of changes made under the change control process. The Contractor will be responsible for the resolution of issues / trouble tickets in a timely manner and within the prescribed Service Level Agreements (SLAs) established by the appropriate organizations. IT Security requires reporting all possible incidents to the Security Officer or System Owner as appropriate on a case by case basis, and following their provided direction as well as established IT Security Incident policy. This includes providing required assistance and all required documentation for all IT security incidents.

• Ensure all systems are HIPAA compliant.

• Perform all requirements outlined in this PWS necessary ensuring no interruption in WBAMC

POCT workflow.

PERFORMANCE WORK STATEMENT (PWS)