SOO Viral Loads and HPV (2).docx

1. STATEMENT OF OBJECTIVES

RT-PCR Molecular Testing for Transplant, Respiratory, and Sexual Health Infections Department of Pathology and Area Laboratory Services (DPALS) Brooke Army Medical Center (BAMC)

PR 12217266

1. GENERAL REQUIREMENT:

The Department of Pathology and Laboratory Services at Brooke Army Medical Center, JBSA - Fort Sam Houston, Texas has a requirement for Hepatitis B Virus, Hepatitis C Virus, Cytomegalovirus, Human Immunodeficiency Virus, Epstein-barr Virus, BK/Human polyomavirus 1 Virus, Human Papilloma Virus, STI Panel (CV/NG/TV/MG), and Respiratory Panel (COVID/Flu A/Flu B/RSV) testing reagents and their associated calibrators and controls, as well as three instrument analyzers capable of running the defined assays. The number of tests per year are identified in the workload data table (Table 1).

2. PURPPOSE:

The Government’s requirement is to obtain a random-access multiplex testing platform for Brooke Army Medical Center’s (BAMC) Department of Pathology and Area Laboratory Services Molecular Diagnostics Laboratory, Fort Sam Houston, Texas. The random-access RT-PCR testing platform should provide the quantitative, semi-quantitative, or qualitative determination of the following:

· Hepatitis B Virus (HBV)

· Hepatitis C Virus (HCV)

· Cytomegalovirus (CMV)

· Human Immunodeficiency Virus, species 1 (HIV-1)

· Epstein-barr Virus (EBV)

· BK/Human polyomavirus 1 Virus (BKV)

· Human Papilloma Virus, high-risk (HR HPV)

· Must accept both ThinPrep PreservCyt Solution and SurePath Preservative Fluid

· Must have de-capping/transferring/labeling capabilities

· STI Panel (as a “4 plex” or multiplex option)

· Chlamydia

· Gonorrhea

· Trichomonas

· Mycobacterium genitalium

· Respiratory Panel (as a “4 plex” or multiplex option)

· SARS-COV-2 (COVID)

· Influenza A

· Influenza B

· Respiratory Syncytial Virus (RSV)

Testing Information:

Viral load tests are important for monitoring a patient’s response to treatment and for making clinical decisions about changes in therapy. Additionally, these tests are used to screen and routinely update patients that are pre- and post-transplant. Viral load tests are necessary for clearing a patient for transplant, and for moving a patient in need of a transplant further up on the transplant list, per clinical guidelines. Viral load tests required include: HBV, HCV, HIV, CMV, EBV, HSV ½, and BKV.

The clinical testing requirements for HPV have recently changed, as primary screening is now the gold standard of care, the lab must improve its methodology and workflow to be able to accommodate patient care needs. HPV genotyping is also necessary for guiding care in patients with high-risk infections, as treatment can differ between infection with types 16, 18, 45, or pooled high-risk strains. Identification of high-risk strains is a critical necessity for patient care.

STI testing will allow for the identification of major sexually transmitted infection, such as Chlamydia, Gonorrhea, Trichomonas, and Mycobacterium genitalium. These STIs are highly infectious and can continue to infect patients if not treated. They can also cause long term morbidity and mortality if not identified and treated in a timely manner. STI rates have historically been higher in some military groups, and maintaining this testing capability is critical to BAMC’s patient care mission.

Respiratory testing will identify patients with COVID, Flu A, Flu B, or RSV infection, which is a critical year-round requirement for BAMC patients. A panel option allows for all four assays to be tested from one patient sample, reducing turnaround times to get results, equating to quicker patient care.

In order to be able to conduct these tests, reagents and automated analyzers are needed for period of performance 1 October 2025 to 30 September 2026 with three (3) option years 1 October 2026 thru 30 September 2029. The equipment must be able to connect to the MHS Genesis and must come with an un-interruptible power supply capable of providing power for at least 45 to 60 minutes. All equipment and supplies must be approved by the FDA, with the exception of BKV. The vendor must show that FDA-approval is being sought for BKV at the time of technical evaluation. This requirement is needed NLT 1 October 2025. All detailed information regarding delivery and installation is provided in the SOO.

3. SCOPE OF WORK

3.1. The successful contractor shall furnish all equipment (to include three (3) analyzers), reagents, consumables, controls, and any necessary services (e.g., maintenance of furnished equipment) to conduct testing under a Cost-per-Test (CPT) Agreement. All equipment and reagents/consumables shall be supplied and serviced through the Contractor to include all parts, equipment, supplies, and other services required to ensure BAMC is able to meet its objectives as listed herein.

4. ORDERING PERIOD:

Base : 1 October 2025 – 30 September 2026 Option 1: 1 October 2026 – 30 September 2027 Option 2: 1 October 2027 – 30 September 2028 Option 3: 1 October 2028 – 30 September 2029

4.1. The Government will order items on an as needed basis and shall only pay for the actual number of tests ordered, received, and accepted by the Government. The quantities listed in the workload data table represent anticipated test volumes for the period of performance listed; however, quantities could increase and/or decrease during certain periods and/or months.

4.2. The inspection and acceptance for all deliverables rendered under this contract will be by the appointed Ordering Officer. The performance by the contractor technician, the quality of services rendered, and any documentation or written material in support of same, shall be subject to continuous inspection, surveillance, and review for acceptance by the designated ordering officer representative. Other evaluation factors will be monitored that are not quantified by numerical measurements.

5. HOURS OF OPERATION:

The microbiology lab is in operation 24 hours a day, 7 days a week. Normal business hours for administrative personnel are Monday through Friday between the hours of 0730 – 1630 CST. Contractor shall coordinate maintenance scheduled with Ordering Officer (OO) and appointed on duty staff in absence of OO no less than 48 hours.

6. SECURITY REQUIREMENTS AND SAFETY:

6.1. SECURITY. The Contractor shall ensure its personnel comply with the local installation requirements for vehicle registration and operation on the military facility. Any vehicle entering the military installation must have the minimum liability coverage required by the state in which the performance is located. The Contractor shall ensure its personnel comply with installation and Military Treatment Facility (MTF) personnel identification and access requirements.

6.2. SAFETY. The Contractor shall ensure its personnel comply with all installation and MTF safety regulations. Such regulations include, but are not limited to, general safety, fire prevention, and waste disposal. Copies of these regulations are available in the medical activity safety office or may be obtained through the appointed personnel. The government and the contractor’s service representative will exchange hazard communication information before the commencement of any repair. When required, the contractor’s service representative will comply with the Office of Safety and Health Administration (OSHA) lockout/tag-out standards while performing sustainment on MD/MDS.

7. INSTRUMENT/EQUIPMENT REQUIREMENT (OWNED BY CONTRACTOR):

7.1. Contractor shall provide all instruments/equipment necessary to conduct testing as per workload data table on the testing identified. The instrument/equipment provided will be utilized for BAMC's viral loads and high-risk HPV assay needs. In addition, the instrument/equipment must include an automated component that facilitates ease of sample preparation and seamless input of data via barcode scanning. A printer to produce hard copy patient reports and other reports generated shall also be provided.

7.2. These instruments, to include any connections between the instruments/equipment, shall be approved by the US Food and Drug Administration (FDA). A timeline or anticipated FDA-approval plan must be provided for BKV, if not already approved.

7.3. Ability to manage testing workflow of hospital laboratory. Analytical configuration of testing platforms must provide for backup analyzer(s) with equivalent menus utilizing the same reagent formulation to ensure correlation with primary instrument and backup instrumentation.

7.4. Analyzers must have a minimum throughput of 300 tests per module in an 8-hour shift.

7.5. Integrated modules must only require one system control center (computer and screen) to simplify operations.

7.6. Instruments must have load on the fly capabilities for reagents, samples, bulk solutions, and consumables.

7.7. Vendor instrument solution must provide a universal carrier capable of utilizing an array of different tube sizes in one carrier, thus avoiding the need for pre-analytic sorting into specific tubes and dedicated colored racks. Vendor must address this with another solution if they cannot meet this requirement.

7.8. Analyzers must have clinically insignificant carryover and not require the use of disposable pipette tips or aliquots or specific aspiration order of assays.

7.9. Analyzers must be able to repeat and reflex test, auto-rerun and auto-dilute as required by the Medical Director’s approved validation plan.

7.10. Vendor must have commonality across all analyzer platforms for the following:

· Software

· Reagents

· Consumables

· Methodology

7.11. Each analyzer must have a minimum of 20 reagent slots to allow for maximum load up of reagents to increase walkaway time and reduce technologist intervention.

7.12. Instruments must be available for full front loading of samples, reagents, consumables and bulk solutions on the fly and STATs must take priority over routine testing.

7.13. Analyzers must have flexible STAT testing options to prioritize the most critical samples based on workflow.

7.14. Analyzers must feature error-proof reagent and commodity design with built in safeguards to prevent reagent mix-ups, probe crashes, and unnecessary downtime.

7.15. Instruments and automation must use point in space sampling to eliminate need for pipette tips and aliquots.

7.16. Calibration of immunoassay analyzers must be easy and of minimal frequency. Immunoassay calibrations must only be required when QC is out of range or new lot numbers of reagent are put into use. Calibrators should be liquid and ready to use with no reconstitution or prep required prior to use. List any calibrators that require preparation and the required process.

7.17. Analyzers must be capable of monitoring reagent usage, maintaining and storing on board supplies/reagents for 24 hours of patient testing on the combined platform, and providing reagent inventory upon request, in real time.

7.18. Quality control frequency not to exceed once/24 hours/instrument platform.

7.19. The analyzers must have a comprehensive QC Program for all tests which includes at minimum the following options:

· QC files may be edited or corrected for errors manually

· On-board quality control data storage and reporting capabilities

· Ability to view and print daily and monthly QC results

· Ability to view and print Levy Jennings graphs

· On-line documentation of out-of-range QC

· Read barcoded QC.

· Westgard rules built in

· If QC fails, instrument will stop running samples

7.20. Chosen analyzers must have minimal daily, weekly, and monthly maintenance downtime. Please provide total maintenance times, including washes and wait time, for daily, weekly, and monthly maintenance. Please include any hands on, automated non-maintenance activities.

7.21. Vendor to provide average number of service calls per year per analyzer.

7.22. Analyzer must accommodate multiple tube and vial sizes simultaneously.

7.23. Instrument must have liquid level sensing, clot, foam and bubble detection. Please describe how analyzer detects.

7.24. Vendor must provide BTU output for both analytics and automation systems.

7.25. Each analyzer shall have automated inventory tracking.

7.26. The instruments supplied, all associated parts, and all accessories must be maintained at the most up-to-date hardware and software. When necessary to maintain hardware updates, the existing instrument/equipment, associated parts, and accessories must be exchanged by the contractor. All software updates or file exchange shall be completed using CD/DVDs only. At no time will USB, internet or cloud-based services be allowed.

6.19 6.20 6.21 6.22 6.23 6.24 6.25 6.26 6.27 6.28 6.29

7.27. The instrument system shall be equipped with an Uninterruptible Power Supply (UPS) capable of providing all necessary electrical power to the instrument/equipment system for at least 45 to 60 minutes.

7.28. The instruments shall be able to be connected to the hospital LIS, currently MHS Genesis or whichever LIS system the hospital uses in the future. The contractor must provide full technical support to ensure that the LIS connectivity is functioning properly.

7.29. Risk Management Framework Compliance. The contractor must acknowledge and demonstrate willingness and ability to comply with the DHA Cybersecurity RMF Requirements, to include specifically acknowledging Exhibit 1, RMF Timeline, and completion of Exhibit 2, Medical Device Risk Assessment Questionnaire.

7.30. The instruments, reagents, and software provided shall comply with the specific requirements listed in this SOO.

7.31. Software upgrades. Contractor shall have access to all necessary diagnostic software. All software upgrades, corrective in nature, shall be at no-cost to the government.

7.32. Contractor shall provide all documentation required to meet all regulatory compliance testing procedures.

7.33. Contractors shall coordinate and conduct a site visit if necessary to the BAMC Immunology section, for the purpose of surveying and assessing current laboratory set-up, laboratory environmental control, and available utilities with regard to potential placement of their instruments in the laboratory. Any changes to the layout of the laboratory, environmental control, or to utilities as currently in existence to accommodate placement of their proposed instruments must be identified. Analyzer will be installed in tandem with back of machines near wall. Each analyzer, including printer, monitor, UPS, and computer system, shall fit within the dimensions outlined in figure below. Sufficient room for proper exhaust and heat clearance based on manufacture’s site specifications shall be maintained, with at minimum a 6” clearance between the existing wall and instruments. Any sliding compartments or access drawers for servicing cannot extend beyond the width of each individual unit outlined in figure below when fully expanded.

7.34. The Contractor will provide one (1) paper copy and one (1) CD copy of the Operator’s and Maintenance manuals and a statement of the warranty terms.

7.35. Lab Layout. The contractor shall provide a diagram or other graphical representation demonstrating how its proposed equipment fits within the dimensions of the laboratory. Dimension information can be provided to the vendor if needed.

8. PREVENTATIVE MAINTENANCE, FAILURES AND REPAIRS:

8.1. The contractor shall provide all personnel, equipment, tools, materials, supervision, parts, transportation, and other items and services necessary to perform all required repairs and scheduled preventive maintenance/safety inspections and calibrations of their equipment. Contractor shall coordinate with the designated point of contact all scheduled maintenance within ten (10) business days prior to performing preventative maintenance services.

8.2. The performance of scheduled periodic preventive maintenance, safety checks, and calibrations that are not normally performed at the operator level will be performed by contractor service personnel in accordance with requirements as specified in the contractor’s instrument maintenance manual. The contractor shall be responsible for furnishing maintenance, services, repairs, and parts as required by manufacturer in order to maintain the system in optimal operating condition.

8.3. The contractor shall provide a full-service plan to include the recommended unscheduled and preventive maintenance service for their instrument/equipment period. Service shall include repair and replacement of defective parts, complete maintenance program (as required by the manufacturer’s maintenance manuals), and hotline telephone service, in order to assist customer in troubleshooting problems.

8.4. Preventive maintenance services shall be performed in accordance with the manufacturer’s standard/procedures. A preventive maintenance service shall include, but is not limited to, safety, calibration, complete operational testing, lubrication, adjustments, and cleaning of equipment to which the operator does not have access. This also includes the installation of all non-operator parts required to ensure proper operation.

8.5. Upon notification of equipment failure own by contractor, the contractor shall respond to telephonic requests for unscheduled repair within 24 hours. Should the instrument/equipment become inoperable, the contractor’s Repair Service Engineer / technician shall be on-site within 24 hours of initial notification for routine/emergency failures. If the equipment is out of service for longer than 72 hours (from the time-of-service technician’s arrival on site), the contractor shall notify the government point of contract on duty, in writing, as to the reason(s) (i.e. non-availability of parts, etc.) for non-compliance.

8.6. If the equipment cannot be repaired, a replacement instrument shall be provided within seven (7) days. If the equipment cannot be replaced, the Government may seek remedies for non-compliance with terms and conditions of this contract.

8.7. Within one (1) business day after completion of a repair, the contractor’s representative shall furnish the Point of Contact (POC) one (1) copy of a service report for all services performed. The service report shall contain, at a minimum, the following information:

a. Nomenclature, date, description of services performed (i.e., preventative maintenance service, or unscheduled repair service)

b. Location of services performed, duration of services performed, list of parts replaced and;

c. Other actions taken to restore operability of the instrument/equipment, name of technician.

**Full report shall be submitted to designated government point of contact**

8.8. Contractor shall notify government of any hazard information before beginning equipment repair and shall comply with the Occupational Safety and Health Administration while performing maintenance on electrical equipment.

8.9. When appropriate, the contractor’s representative shall attach and complete a DD Form 2163 (sticker), entitled “Medical Equipment Verification/Certification” to the equipment upon completion of calibration services. The Point of Contact will provide the DD Form 2163 to the contractors’ representative. If the DD Form 2163 is already attached to the equipment, the contractors' representative shall update the existing DD Form 2163. Procedures for updating the 2163 will be provided by the Point of Contact.

9. CUSTOMER SERVICE:

9.1. The Contractor shall provide direct customer service and support, during normal business hours and on-call emergency repair service support, to assist operators in correcting equipment operation problems.

9.2. For Emergency Services and unscheduled services, the Contractor’s qualified service technician shall be on-site to provide emergency service (service requiring immediate repair) within 24 hours. The equipment shall be repaired and operational at the minimum of 72 hours after arrival of contractor on site.

9.3. The Contractor shall perform preventive maintenance services (PMS), safety tests, calibrations, and unscheduled repair services in accordance with procedures and practices prescribed by the manufacturer of the equipment. Scheduled routine services shall be performed between 0730-1630 LOCAL Monday-Friday, excluding U.S. Holidays.

9.4. The Contractor shall provide a full unscheduled and preventive maintenance service for the instrument/ equipment owned by contractor. All maintenance and repairs shall be inclusive of all costs for the performance of scheduled periodic maintenance (as required by the Contractor’s instrument maintenance manuals), unscheduled maintenance and repair of the analyzers and any associated equipment provided by the Contractor as part of the analyzer system, including replacement parts, replacement part shipment costs, and service technician travel costs for performance of maintenance services.

9.5. The contractor’s qualified service technician shall be on site to provide routine services; service requiring immediate repair; and scheduled services for preventive maintenance (as specified in the Contractor’s instrument maintenance manual), safety and calibration as required by this statement of work. The equipment shall be repaired and operational within 72 hours after arrival of contractor on site.

9.6. Upon analyzer failure, the Contractor’s qualified service technician shall be on-site to provide unlimited emergency service (service requiring immediate repair; an unscheduled maintenance/service requirement) within 24 hours. The equipment shall be repaired and operational within 72 hours after arrival of contractor on site.

9.7. Should the analyzer at BAMC become inoperable, the Contractor’s technical repair specialist shall be on-site within 24 hours of initial notification and make the repair within 72 hours after arrival of contractor on site. If the analyzer cannot be repaired within 72 hours after arrival of contractor on site, a replacement analyzer, at no additional cost to the U. S. Government, will be provided within seven (7) days of the initial notification to be utilized by the U.S. Government until the original instrument is fully repaired and accepted for service.

9.8. During the period when the analyzer is inoperable, the Contractor will arrange the pickup and delivery of critical specimens to a College of American Pathologists accredited clinical laboratory of their choice. The selected laboratory will provide patient reports. Each patient report shall include the testing laboratory’s reference range for the test being performed. The Contractor will be responsible for all costs associated with the provision of this service, including those for delivery of hardcopy patient results, for as long as the analyzer remain inoperable.

9.9. The Contractor shall provide all necessary user-replaceable maintenance items that will be required to support the analyzer, and any analyzer specific tools/supplies necessary to perform operator-level periodic maintenance tasks, at no additional cost to the U.S. Government.

9.10. Minimal Hands-on System Maintenance required, including limited reagent preparation time/steps prior to use. List reagent /calibrator prep for assays.

9.11. Computer Patient Data Handling: No hardware, containing any patient information is to be removed from any location, without the approval and removal of data by the facility information technology department.

9.12. Preventative and Predictive Maintenance: Contractor shall provide regular, scheduled maintenance to assure the continued reliable operation of the equipment. These preventive maintenance visits shall be of a frequency that conforms to the manufacturer's operation and maintenance instructions for the supported equipment. Minimum of 1 per year per instrument unless documentation for volume performed denotes not required for optimum quality of operation.

9.13. Emergency Repair: Emergency repairs shall be performed after notification that the equipment is inoperative. The contractor shall provide the government with a designated point of contact and shall make arrangements to enable its maintenance representative to receive such notification. The contractor shall perform emergency repair service within 24 hours of time of notification of the malfunction.

9.14. Maintenance Support: Service repair person locally based within San Antonio geographical area,

9.15. Operator Procedure Manuals: Operator and Service manuals along with Clinical and Laboratory Standards Institute (CLSI) compliant procedures must be furnished for each instrument model supplied, unless provided electronically on board the instrument. Vendor to write Standard Operating Procedures for each assay in the laboratory template, to ensure that procedures are totally available prior to implementation.

10. DELIVERY OF EQUIPMENT

10.1. All equipment (owned by contractor) shall include delivery, installation, maintenance, and removal upon termination of contract. Contractor shall furnish all necessary calibrators/standards and quality control materials necessary to perform the initial method verifications per CLIA/NCCLS guidelines.

10.2. The instrument (s)/ equipment shall be delivered to the Brooke Army Medical Center (4th floor) within 30 days or less after contract award. Exact installation location shall be coordinated by contractor and government point of contact (OIC and/or NCOIC). Equipment setup, LIS connectivity, on-site training, and method verification studies, shall be completed by vendor personnel within six (6) weeks or less after contract award to ensure that equipment is fully operational.

10.3. SAFETY DATA SHEETS (SDS): The contractor shall provide safety data sheets (SDS) for each item delivered under this contract that is considered to be HAZARDOUS MATERIAL. The SDS shall contain information on the hazards associated with each specific chemical or material. The SDS shall contain at a minimum the following information: identification of the specific hazard, the required practice for the safe use of the product, first aid procedures, and what to do in the event of a spill or other mishap or accident.

10.4. The contractor shall be responsible for installation, which consists of in-house delivery, positioning, and mounting of all equipment listed on the delivery order and connections of all equipment and interconnecting wiring and cabling if applicable in coordination with the facility biomedical engineer. Upon receipt of notice to proceed with installation, it shall be the contractor's responsibility to inform the Contracting Officer of any problems which may be anticipated in connection with installation, or which will affect optimum performance once installation is completed. In the event that progress of the installation is interrupted through no fault of the contractor, the continuous installation referenced in the preceding paragraphs may be terminated until such time as the cause of delay has been eliminated, and then shall be resumed within 24 hours after the contractor has been notified that work may again proceed.

10.5. Vendor shall provide equipment installation and possible reinstallation at minimal costs if the equipment is required to be moved due to construction or laboratory redesign.

11. REAGENTS/CONSUMABLES:

11.1. As indicated in the FDA safety alert communication, assays that use free capture streptavidin/biotin in their assay architecture have been demonstrated to show interference which can lead to misdiagnosis and medical error. We require that the assays must not use free-capture streptavidin/biotin in the assay architecture to minimize the risk of interference from ingested biotin.

11.2. Vendor reagents must be 99% liquid ready to use from storage, requiring no reconstitution or mixing. List all Reagents that are not liquid, ready to use.

11.3. Vendor calibrators must be at least 95% liquid ready to use from storage, requiring no reconstitution or mixing. List all assay calibrators that are not liquid, ready to use.

11.4. Vendor must provide Sigma data on chemistry testing verified by 3rd party source, using CLIA and the College of American Pathologists (CAP) data.

11.5. Quality of Reagents, Supplies and Disposables: The contractor shall assure that all supplies provided/ordered for use on their equipment will be of the quality necessary to produce a quality product. The reagent quality must be high enough to satisfy proficiency testing standards of the CAP and the Joint Commission. In the event that the supplies are found to be defective and unsuitable for use with the contractor's equipment or the contractor has failed to comply with the requirements herein, the contractor is required to deliver the supplies within 24 hours of receipt of the verbal order.

11.6. Vendor must provide 5 years of FDA field action notifications

11.7. The manufacturer will provide the required quality control materials and test reagents and ensure that there is minimal change in lot numbers during the contract year.

11.8. All reagents and quality control material shall be provided by the manufacturer of the equipment; be marked with the required storage temperature and expiration dates; be maintained at the proper storage temperature during transportation from the Contractor’s storage facility to the U.S. Government acceptance site and be delivered on time at the appropriate storage temperature. Preservation and packing - Preservation and packing shall be performed in accordance with the best commercial practices and in such a manner to afford adequate protection against any damage during shipment from source to destination.

11.9. The reagents and quality control material must perform within the manufacturer’s stated/published package inserts. Deliveries of required items will be called in to the Contractor by the designated Contracting Officer’s Representatives. Orders will be delivered within five (5) business days of requested date of delivery.

11.10. Emergency orders will be delivered within 24 hours using overnight shipping, or, if this shipping requirement cannot be met, the Contractor shall identify the guaranteed emergency order shipping method that can be accommodated in their response to the Solicitation for Bid.

12. TRAINING:

12.1. The Contractor will provide initial operator training to all technicians assigned to the U.S. Government site (BAMC Department of Pathology Microbiology staff), as well as annual refresher training, as needed, to ensure adequate user competency during times of personnel turnover.

12.2. All training manuals/guides, instructional literature, and any other related written/electronic material shall be provided. Training shall include basic operation of the analyzers, troubleshooting procedures, performance of operator-level periodic preventive maintenance procedures, and use of the data management/quality control software.

12.3. In addition, the contractor shall provide supplemental operating training to above government personnel, without additional charge to the government, upon installation of the upgrade in equipment hardware or operating system software connected with the operation of an instrument already furnished.

12.4. In the case of any significant software or assay procedural updates, the Contractor shall provide one (1) primary (key) operator training slot per major instrument/equipment, one (1) key operator Training per new instrument install, one (1) key operator raining for the existing instrumentation, two (2) On-site in lab training slots for the instrumentation to be used over the 5-year term of the agreement as the lab needs for staff changes. This training can be on or off-site at the Contractor’s full expense.

13. INFORMATION SECURITY

13.1. The Contractor shall comply with the most recent published versions of the following references, as well as all regulations or guidance referenced within those publications:

13.1.1 United States Law

· The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

· The Federal Information Security Management Act (FISMA)

· The E-Government Act of 2002

13.1.2 Office of Management and Budget (OMB)

· Circular A-130

· Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors

13.1.3 National Institute of Standards and Technology (NIST)

· NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems

· NIST SP 800-39—Managing Information Security Risk: Organization,

· NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

· NIST SP 800-60—Volume 1 Revision 1: Guide for Mapping Types of Information and Information Systems to Security Categories

13.1.4 Federal Information Processing Standards (FIPS)

· FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

· FIPS PUB 199 – Standards for Security Categorization of Federal Information and Information Systems

· FIPS PUB 200: Minimum Security Requirements for Federal Information and Information Systems

· FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

13.1.5 Department of Defense (DoD)

· DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

· DoD Instruction 8500.1, Cybersecurity

· DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

· DoD Instruction 8510.01, Risk Management Framework Process (RMF)

· DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

· DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

· DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs

· DoD Directive 5400.11, DoD Privacy Program

13.2. TELECOMMUNICATION

13.2.1 Systems that provide the ability to control instrument software from remote locations are preferred. All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software shall be able to pass MITC testing and review and be awarded a Certificate of Net worthiness (CoN) from NETCOM. Submission of the CoN shall be completed within six (6) months of contract award.

13.2.2 In accordance with contract requirements, Contractors shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

13.2.3 The Contractor shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies and will provide, maintain and configure VPN concentrator that complies with DoD security standards.

13.2.4 All costs for VPN hardware and software shall be incurred by the Contractor.

13.2.5 The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chief Information Officer.

13.2.6 The Contractor shall validate that systems authenticate users through the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the vendor's technical users will maintain secure logon.

13.3. RISK MANAGEMENT. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security. "Vendors shall ensure ability to conform to all standards set forth by Department of Defense Risk Management Framework."

13.4. BUSINESS TO BUSINESS (B2B) PARTNERS AND 3rd PARTY VENDORS-General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow

13.5. PERSONNEL SECURITY.

13.5.1 Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

13.5.2 Follow the DoD guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

13.5.3 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility local area network (LAN).

13.5.4 Immediately report to the MTFs Security Office and deny access to any automated information system (AIS), network, or information if a Contractor personnel filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for any reason.

13.5.5 Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

13.5.6 Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractor’s personnel shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce shall comply with all personal identity verification requirements as direct by DOD, HQDA, and or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, shall the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

13.6. ELECTRONIC SECURITY.

13.6.1 Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of SAMMC shall operate in accordance with controlling laws, regulations, DoD/DHA, and local policy.

13.6.2 Risk Management Framework(RMF) requirements apply to all DoD/DHA and Contractor’s IS/networks that receive, process, display, store or transmit DoD information. The Contractor shall comply with the RMF process for safeguarding IS.

13.6.3 Authorization to Operate is the formal approval by the Government to operate the Contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, authorization allows IS/networks to operate within the given operational environment with stated interconnections, and with appropriate monitor level of protection for the specified period.

13.6.4 The Contractor shall comply with RMF requirements, as specified by the Government that meet appropriate DoD/DHA Information Assurance requirements. The RMF requirements shall be met before the Contractor’s system is authorized to access DoD/DHA data or interconnect with any DoD/DHA IS/network that receives, processes, stores, displays or transmits DoD/DHA data. The Contractor shall ensure the proper Contractor support staff is available to participate in all phases of the RMF process. They include, but are not limited to:

· Attending and supporting RMF meetings with the Government

· Supporting/conducting the vulnerability mitigation process

· Supporting the RMF Team during system security testing

13.6.5 Contractors shall confirm that their networks are locked down prior to initiating testing.

· Conformation of system lock down shall be agreed upon during the definition of the RMF boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

· Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

13.6.6 Any re-configuration or change in the system during the C&A testing process shall require a re- base lining of the system and documentation of system changes. Some changes will necessitate a pause in work depending on the severity and impact of change and determined by the COR in conjunction with the IA representative.

13.6.7 Vulnerabilities that have been identified by the DHA as "must-fix" issues during C&A process shall be mitigated according to the timeline identified by the DHA Representative. C&A Checklists are provided for complying DHA C&A requirements.

13.6.8 A request for a waiver to the C&A requirements may be submitted for temporary testing and other usual circumstances. A waiver request shall be submitted, in writing, to the Designated Approving Authority (DAA). The request shall include mitigation strategies that ensure adequate protection measures and security controls are in place (for example: air gapping a testing network).

13.6.9 Information Assurance Vulnerability Management (IAVM). The contractor shall implement an information assurance vulnerability management program. The DHA IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to DHA systems. As part of the program, the contractor shall provide a primary and secondary point of contact for IAVM compliance reporting. The contactor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance to the DHA IA Operations POC. Receipt and compliance messages to DHA shall occur within the stipulated time window, as stated in the vulnerability message.

13.6.10 Guidance regarding the requirement for IAVM is contained in the Army Regulation 25–2, "Information Assurance” and Army Regulation 25–1, “Army Knowledge Management and Information Technology.” An asset is defined as any hardware device, such as a router, firewall, server, or an operating system image accessed by more than one user. The “MEDCOM IASO list server is the primary means to disseminate IAVAs, Information Assurance Vulnerability Bulletins (IAVBs), and Information Assurance Technical Advisories down to the System Administrator (SA) and applicable personnel throughout the chain of command. Requests to be added to the IASO list server shall be sent to medcom.ia@amedd.army.mil.

13.6.11 The contractor shall maintain any development environments in accordance with MEDCOM Information Assurance (IA) best practices and operational requirements. During product development for the Army, the contractor shall ensure that all IA mitigation strategies have been applied to the development environment prior to any Army data being loaded onto any assets or software for testing or delivery.

13.6.12 IA mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the Army shall be in compliance with all known applicable Army Computer Emergency Response Team (ACERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

13.6.13 Disposing of Electronic Media. Contractors shall follow the Army standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with Army Regulation 25–2, "Information Assurance” and Army Best Business Practices (BBP), “Reuse of Computer Hard Drives.”

13.6.14 Ports Protocols and Services. Contractors shall follow all current Army standards and requirements for acceptable Ports, Protocols, and Services. Any requests for exception to using the current Army Ports, Protocols, and Services standards requires a request for exception sent through the Program Manager to the DAA.

13.6.15 Public Key Infrastructure and Encryption. Contractors shall follow the Army standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication. Where interoperable PKI is required for the exchange of unclassified information between the Army and its contractors and contractors, industry partners shall obtain all necessary certificates. Contractors shall turn over to the Army all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support. The Contractor shall provide a written report detailing all of the above, prior to task order expiration, regardless of modifications or extensions.

13.7. INFORMATION SYSTEMS (IS)/NETWORKS PHYSICAL SECURITY.

13.7.1 The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor shall support a Physical Security Audit performed by the Government of the Contractor's internal information management infrastructure.

13.7.2 The MHS Physical Security Audit information is available at: http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls.

13.7.3 The Contractor shall correct any deficiencies identified by the Government of the Contractor's physical security posture. New Army policies will be posted to the following website:

http://www.apd.army.mil/

13.8. SPECIAL REQUIREMENTS FOR PROTECTED HEALTH INFORMATION.

13.8.1 Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the Contractors shall:

· Notify the MTF HIPAA Security Manager.

Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

TABLE 1. WORKLOAD DATA. All volumes are in tests per year.

VIRAL LOAD

TEST

Personally Identifiable Information, Protected Health Information, and Federal Information Requirements Revised 10/27/2020)

1. General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws.

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019, and DoDI 5400.11-R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS).