Point of Care MHS Genesis PWS.pdf

Performance Work Statement (PWS)

For

Point of Care (POC) Testing Interface to Military Health System (MHS) Genesis

Medical Treatment Facility, David Grant Medical Center Travis AFB

27 August 2020

Table of Contents

SECTION NO. AND TITLE PAGE NO.

I. Description of Service 3

II. Definitions 5

III. Deliverables 5

IV. General Information 7

V. Appendices 13

A. Applicable publications and Forms B. Projected Workload

PERFORMANCE WORK STAEMENT (PWS)

Point of Care Testing Interface to Military Health System (MHS) Genesis

Medical Treatment Facility, David Grant Medical Center

Travis AFB

I. Description of Services

1.1. Services Include a technology license for each individual Point-of-Care (POC) testing device platform and all testing devices. The technology license will also include service, support, and updated maintenance for each platform. Additionally, a system support model, browser based remote access, result interface, and in-unit patient verification with positive patient identification is required. The terms “must,” “shall” and “will” denote mandatory actions in this PWS. This includes all direct and indirect resources.

1.2. The contractor shall comply with the College of American Pathologists, Joint Commission, Food and Drug Administration, and all federal, state, and local laws applicable to the performance of work. Further, in order to meet Department of Defense (DoD) information assurance requirements, the contractor’s POC testing device platform MUST have underwent DoD Information Assurance Certification and Accreditation Process (DIACAP) to ensure that risk management is applied on the information system. DIACAP defines a DoD wide formal and standard set of activities, general tasks and management structure process for the certification and accreditation of a DoD information system that will maintain the Information Assurance posture throughout the system's life cycle.

1.3. The contractor MUST provide a virtual server capable of interfacing all of the current and future Point-of-Care (POC) Testing devices, ability to interface all automated and manual testing into the electronic health record (MHS Genesis), and the ability to provide various quizzes to POC operators to help meet regulatory compliance.

1.4. The contractor shall provide a pre-configured virtual system image which includes the operating system, database and associated software to run on the virtual host infrastructure operated, maintained and managed by DGMC staff. The contractor shall be responsible for configuration and support of all software provided to DGMC within the virtual system including acquiring any third party software licenses provided with and used within the virtual system.

1.5. The virtual server provides management for devices and users, device logon authentication and lockout, device certifications, user compliance, user alerts and notifications, test results alerts, QC result data and analysis, patient result data, manual test result entry, data reports printing, software and calibration updates to analyzer devices. Data manager system shall not require any other vendor specific data managers or adapters to be able to connect to POC testing devices. The data manager system shall house their software in a virtual web server. The contractor shall provide required specifications to DGMC staff in order to configure interface.

1.6. The contractor shall provide tools, diagnostic equipment, software, hardware, firmware, materials, supplies, repair parts and materials not furnished by the government necessary to keep the system operational to manufacturer’s specifications, seven (7) days per week including federal holidays. The contractor shall provide troubleshooting assistance via email by phone as determined by the Contracting Officer Representative (COR), and replacement parts by mail as requested. The contractor shall provide and install software updates. The contractor shall provide new or updates for user manuals when changes are made. The contractor shall furnish and install all manufacturers’ mandatory modifications and/or upgrades. All service calls, once initiated, shall be worked until the full functionality of the data management system is restored.

1.7. This contract is a non-personal services contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the government and its employees.

1.8. The contractor shall provide both scheduled and unscheduled services to maintain data connectivity virtual server in a fully functional condition with a ninety-eight percent (98%) uptime guarantee (calculated on a quarterly basis).

1.9. Minimum Personnel Qualifications: Services under this contract will be performed by individuals who have demonstrated knowledge and competence in servicing and maintaining the virtual server and data connectivity programs under this contract. The Contractor shall ensure repair technicians have been fully trained and experienced in testing and repairing the online site, virtual server, and components on contract. The representative chosen by the contractor shall have practical experience with the implementation procedure of the data connectivity virtual server in a Department of Defense facility. The representative chosen by the contractor shall have at a minimum two (2) year of experience in the maintaining/repairing the data connectivity virtual server specified in this PWS.

1.10. Upon Completion of work, an acceptance inspection will be conducted by the Government (personnel for the DGMC Point-of-Care Testing staff) and the data connectivity virtual server users to ensure all services were completed. The information provided by the contractor will be used by the customer quarterly throughout the term of the contract to perform quality assurance and cost analysis before the next option year is exercised.

1.11. Quality Control: the contractor shall ensure that the quality of service and materials provided under this contract meet or exceed the conditions outlined in the PWS.

1.12. Technical phone support shall be available 24 hours, 7 days a week. The contractor shall perform unlimited emergency calls. The contractor shall remain on call for a period of no less than ninety (90) days after the go-live date to troubleshoot any system problems that arise from the integration of the data connectivity virtual server.

Additionally, the contractor shall install any and all software updates, and update all connectivity hardware as they become available.

1.13. The time frame, within which the contractor’s representative must respond, is measured from the time of verbal notification that service is required. Response time for this contract shall be no more than two hours to confirm notification of service call.

Deficiencies shall be corrected within a period of seventy two (72) hours from first notification of failed access to the data connectivity virtual server. If access cannot be acquired within the first eight hours after initial reporting, the contractor shall contact the DGMC Group Point-of-Care Testing Manager from the Clinical and Anatomical Pathology Flight and/or his/her designated representative to communicate the reason for the delay. The deficiency shall be corrected and returned back to a fully functional state within seventy two (72) hours.

II. Definitions:

2.1. Defect: Any nonconformance of a part or assembly of the system under contract to specified requirements.

2.2. Emergency Service Call: An emergency situation is one that happens with little or no warning, in which the health and safety of patients and staff may be endangered, or the system is totally non-operational. Emergency repair situations cannot be forecasted. Calls for service or emergency repairs shall be performed at no additional cost to the government. The contractor shall respond within 24 hours of a telephone notice, including weekends and federal designated holidays to determine the course of action to remedy the situation. The emergency problem must be resolved within 72 hours of the initial contact with the vendor.

III. Deliverables

3.1. The contractor shall provide onsite implementation of the licensed program within 8 weeks of contract award. At which time, all applicable analyzers MUST transfer patient data and results into the patient’s electronic health record (MHS Genesis) without error.

3.2. The contractor shall provide onsite training and materials to all users of the licensed program.

3.3. The contractor’s POC testing device platform MUST be compatible with Cerner’s MHS Genesis electronic heath record platform. Additionally, the contractor’s POC testing device platform must be compatible with the following analyzers:

a) Abbott, ISTAT

b) Nova Biomedical, Nova Net Stat Strip

c) Roche Diagnostics, Coaguchek XS Plus

d) Accriva Diagnostics, Avoximeter 4000

e) Medtronic, Activated Clotting Time (ACT) Plus

f) Siemens Diagnostics, Rapid Point 500

g) Siemens Diagnostics, Stratus

h) Quidel Immunoassays, Sofia

3.4. The contractor MUST incorporate DGMC’s Laboratory patient accession numbering sequence on each report as applicable.

3.5. The contractor MUST provide initial integration of all Point of Care Testing devices and program the data connectivity virtual server for use by Point of Care Testing staff.

3.6. The contractor shall provide DGMC Laboratory with a web-based result reporting that will allow DGMC Laboratory to receive and review results utilizing a standard web browser, for example, Google Chrome or Microsoft Edge. The contractor’s website will also provide access to check the status of test results and provide access to historic results which are available online indefinitely. The contractor’s website shall provide a password-based system in which reports can be accessed by DGMC Laboratory personnel.

3.7. The contractor’s program shall allow management of inventory of test reagents and supplies. Additionally, the contractor’s program must allow management of competency assessment of testing personnel.

3.8. The automated monitoring software shall be able to send alerts of certain events in the contract service center.

3.9. DGMC will designate email account(s) within DGMC to receive such alerts that will be monitored periodically by DGMC personnel. Any email alerts received at the designated DGMC account(s) will then be immediately forwarded to designated email account(s) of the contractor.

3.10. The contractor shall ensure a Security Background Investigation has been initiated by the contracting organization.

3.11. Unaccompanied access to the MTF is not authorized without written consent from Government personnel. All personnel entering the medical treatment facility must wear a contractor identification badge which will be provided by the Government at point of check-in at the MTF.

IV. General Information

4.1. Privacy Act Program: The Contractor shall comply with the Privacy Act of 1974 (the Act) and AFI 33-332, the Air Force Privacy Act Program and the agency rules and regulations issued under the Act in the design, development operation of any system of records. Operation of a system means performance of any of the activities associated with maintaining the system of records, including the collection, use and dissemination of personal information. Systems of Records on individuals are defined as a group of any records under the control of an agency from which information is retrieved by the name of the individual or by some identifying number, symbol or other identification unique to the individual.

a) All records generated during the performance of the contract are considered Government records and shall be turned over to the Government upon termination of the Contract.

b) Records are considered to be all books, papers, maps, photographs, machine-readable materials or other documentary materials, regardless of physical form or characteristics, made or received by any agency of the Government under federal laws, or in connection with the transactions of public business, and preserved or appropriate for preservation by any agency, or its legitimate successor, as evidence of the organization, functions, policies, decisions, procedures, operations or other activities of the Government or because of the informational value of data in them. This includes all electronic records.

4.2. FOR OFFICIAL USE ONLY (FOUO). The Contractor shall create and Maintain FOUO material IAW DoD 5400-7, DoD Freedom of Information Act Program, Chapter 4; AFI 33-129, Web Management and Internet Use; and AFI 33-201, Communications Security (COMSEC), Table 1. Mark all documents meeting the requirements identified in DoD Regulation 5400.7/Air Force Supplement, paragraphs C3.2.1.2 thru C3.2.1.9 as “For Official Use Only” IAW instructions. Safeguard all sensitive data IAW DoD Regulation 5400.7/Air Force Supplement. When documents containing FOUO material are authorized for destruction, shred the records so that the pieces cannot be reconstructed. Degauss or overwrite magnetic tapes or other magnetic media. Records Disposition shall be IAW with the Records Management Program, AFI 33-322.

4.3. DoD Freedom of Information Act (FOIA) Program: If the Contractor receives a FOIA request the Contractor shall immediately hand-carry it to the base FOIA manager for processing. The FOIA manager will task a Government official. When tasked, the Contractor shall be responsible for searching for the records and providing those records to a Government official who, as the authorized official, will make the decision on releasing Government records.

4.4. Functional Requests: A written request for DoD records that does not cite either the FOIA or Privacy Act may be received from any person (including a member of the public), or organization, or a business. The Contractor shall be responsible for searching for the records and providing those records to a Government official who, as the authorized official, will make the decision on releasing Government records.

4.5. Health Insurance Portability and Accountability Act (HIPAA). In accordance with DoD 6025.18-R “Department of Defense Health Information Privacy Regulation,” January 24, 2003, the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and in DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

4.6. Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DoD 6025.18-R or DoD 8580.02-R.

a) Individual has the same meaning as the term “individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

b) Privacy Rule means the Standards for Privacy of Individually Identifiable Health

Information at 45 CFR part 160 and part 164, subparts A and E.

c) Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 160.103, limited to the information created or received by the Contractor from or on behalf of the Government pursuant to the Contract.

d) Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

e) Required by Law has the same meaning as the term “required by law” in 45 CFR 164.103.

f) Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

g) Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part 164, subpart C. Terms used, but not otherwise defined, in this Clause shall have the same meaning as those terms in 45 CFR 160.103, 164.501 and 164.304.

h) The Contractor shall not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

i) The Contractor shall use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Contract.

j) The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

k) The Contractor agrees to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Clause.

l) The Contractor shall report to the Government any security incident involving protected health information of which it becomes aware.

m) The Contractor shall report to the Government any use or disclosure of the Protected

Health Information not provided for by this Contract of which the Contractor becomes aware.

n) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

o) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

p) The Contractor shall provide access, at the request of the Government, and in the time and manner reasonably designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

q) The Contractor shall make any amendment(s) to Protected Health Information in a

Designated Record Set that the Government directs or agrees to pursuant to 45 CFR

164.526 at the request of the Government, and in the time and manner reasonably designated by the Government.

r) The Contractor shall make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner reasonably designated by the Government or the Secretary, for purposes of the Secretary determining the Government’s compliance with the Privacy Rule.

s) The Contractor shall document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

t) The Contractor shall provide to the Government or an Individual, in time and manner reasonably designated by the Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45

CFR 164.528.

u) NIST Special Publication 800-88 Rev 1- Destroy paper using cross cut shredders which produce particles that are 1 x 5 millimeters in size (reference devices on the NSA paper Shredder EPL), or to pulverize/disintegrate paper materials using disintegrator devices equipped with 3/32 inch security screen (reference NSA Disintegrator EPL.) and maximum particle size after shredding of no more than 1/32" by 7/16" to meet the DoD HIPAA standards.

4.7. General Use and Disclosure Provisions: Except as otherwise limited in this Clause, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the HIPAA Privacy Rule, the HIPAA Security Rule, DoD 6025.18- R or DoD 8580.02-R if done by the Government.

4.8. Specific Use and Disclosure Provisions

a) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

b) Except as otherwise limited in this Clause, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

c) Except as otherwise limited in this Clause, the Contractor may use Protected Health

Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

d) Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1).

4.9. Obligations of the Government: Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

a) The Government shall provide the Contractor with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520.

b) The Government shall provide the Contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Contractor’s permitted or required uses and disclosures.

c) The Government shall notify the Contractor of any restriction to the use or disclosure of

Protected Health Information that the Government has agreed to in accordance with 45

CFR 164.522.

4.10. Permissible Requests by the Government: The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Privacy Rule, the HIPAA Security Rule, or any applicable Government regulations (including without limitation, DoD 6025.18-R and DoD 8580.02-R) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

4.11. Termination

a) Termination. A breach by the Contractor of this clause, may subject the Contractor to termination under any applicable default or termination provision of this Contract.

b) Effect of Termination.

c) If this contract has records management requirements, the records subject to the Clause should be handled in accordance with the records management requirements. If this contract does not have records management requirements, the records should be handled in accordance with paragraphs (1) and (2) below:

(1) If this contract does not have records management requirements, except as provided in paragraph (2) of this section, upon termination of this Contract, for any reason, the Contractor shall return or destroy all Protected Health Information received from the Government, or created or received by the Contractor on behalf of the Government.

This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the Protected Health Information.

(2) If this contract does not have records management provisions and the Contractor determines that returning or destroying the Protected Health Information is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of Protected Health Information is infeasible, the Contractor shall extend the protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such Protected Health Information.

4.12. Miscellaneous

(a) Regulatory References. A reference in this Clause to a section in DoD 6025.18-R, DoD 8580.02-R, Privacy Rule or Security Rule means the section currently in effect or as amended, and for which compliance is required.

(b) Survival. The respective rights and obligations under the “Effect of Termination” provision of this Clause shall survive the termination of this Contract.

(c) Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with DoD 6025.18-R, DoD 8580.02-R, the HIPAA Privacy Rule or the HIPAA Security Rule.

V. Appendices

APPENDIX A

Applicable Instructions, Directives and Regulations

Publications and forms applicable to this Performance Work Statement (PWS) are listed below, and are mandatory. The contractor shall follow those publications to the extent specified (that is, the specific procedure in a paragraph, section, chapter or volume) to meet requirements in this PWS. Applicable publications are located at http://www.e-publishing.af.mil/pubs. The Government may issue supplements or amendments to listed publications from any organizational level during the life of the contract. The contractor shall keep all issued publications up-to-date. The contractor shall immediately implement those changes in publications that result in a decrease or no change in the contract price. Before implementing any such revision, supplement, or amendment that will result in an increase in contract price, the contractor shall submit to the contracting officer a price proposal for approval. Price proposals shall be submitted within 30 calendar days from the date the contractor receives notice of the revision, supplement, or amendment-giving rise to the increase in cost of performance. The Government and the contractor will negotiate the changes into the contract under provisions of the Changes clause. The Contractor will continue to supply the Government forms needed for daily operations. Upon completion of the contract, the contractor shall return to the Government all issued publications and unused forms.

Publications Code:

AFI--Air Force Instruction AMC-Air Mobility Command DoDI-DoD Instruction MDGI -60th Medical Group Instruction

DEPARTMENT OF DEFENSE and AIR FORCE PUBLICATIONS:

Number Title of Directive

DoDI 3020.37 Continuation of Essential DOD

Contractor Services During Crises

DoDI 5400.7-R DoD Freedom of Information Act Para, C.4.2.1, C.4.4C3.2.1.2 - C3.2-1.9

Air Force Sup DoD Freedom of Information Act

DoDI 5500.7-R Joint Ethics Regulation (JER)

DoDR 6025.18-R Health Information Privacy Regulation http://www.e-publishing.af.mil/pubs http://www.e-publishing.af.mil/pubs

AFI 33-129 Transmission of Information Via the Internet

AMC Sup 1 Transmission of Information Via the Internet

AFI 33-201 Communications Security (COMSEC)

AFI 33-332 Air Force Privacy Act Information

AMC Sup 1 Air Force Privacy Act Information

Travis Air Force Base Environmental Management Policy for Contractors available at <http://www.travis.af.mil/pages/60cons/ReadingRoom.htm>.

Records Disposition Schedule WebRIMSs website at <https://webrims.amc.af.mil/login.cfm>

Privacy Act Systems of Records Notice(s) at <http://www.defenselink.mil/privacy/notices/usaf>

Health Insurance Portability and Accountability Act (HIPAA)

APPENDIX B

WORKLOAD ESTIMATES

Projected Workload

1. Projected Workload

40,000 results entered into the electronic health record system annually.

Additionally a minimum of 500 personnel’s competency will be maintained.

Previous year numbers may increase or decrease by 10% per year, based on number of patient’s visits, admissions, and assigned personnel.

* Previous year numbers may increase or decrease by 10% per year, based on the numbers of patient visits and admissions.

http://www.travis.af.mil/pages/60cons/ReadingRoom.htm https://webrims.amc.af.mil/login.cfm http://www.defenselink.mil/privacy/notices/usaf

APPENDIX A