Product Description-Microbial Analyzer_Reagents -.pdf

Sources Sought/ Market Research PANHCA-25-P-0000 006302

Product Description (PD) William Beaumont Army Medical Center (WBAMC)

Microbiology Analyzer and Reagents October 2025

This contract is for microbial identification and susceptibility detection for the FT Bliss/El Paso area at William Beaumont Army Medical Center Laboratory, Department of Pathology, Fort Bliss, Texas. This contract is for the lease of one (1) Microbial Identification and Susceptibility testing analyzer and one (1) Mass Spectrometer analyzer and the reagents/consumables needed to perform Gram positive Organism, Gram negative Organism, Anaerobic Organism, Yeast Organisms and Neisseria-Haemophilus Organisms on both analyzers and Mycobacterium Organism identification on the Mass Spectrometer. Needs to be able to interface with existing owned equipment used in workflow, to include the Biomerieux Virtuo Blood Culture Instrument and MYLA middleware server. The analyzers must also support susceptibility for Streptococcus, Gram Positive, and Gram Negative Organisms in accordance with CLSI and the WBAMC algorithm provided in Appendix 2.

The period of performance is:

Base Period: 01 October 2025- 30 September 2026 Option Year 1: 01 October 2026- 30 September 2027 Option Year 2: 01 October 2027- 30 September 2028 Option Year 3: 01 October 2028- 30 September 2029 Option Year 4: 01 October 2029- 30 September 2030

1.0 Location of Equipment/Transition

1.0 The analyzers will be located at the following location for the base year and all options:

William Beaumont Army Medical Center 18511 Highlander Medics Drive Ft Bliss TX 79918

1.1. REAGENTS

1.1.1 For reagents and quantity refer to Appendix 1.

1.1.2 Reagents will be provided on an at need basis, no drop shipments will be authorized. Any boxes received and not ordered will not be acceptable.

1.1.3 Consumables and accessories will be at no cost to the government.

1.1.4 All reagents must be approved by the US Food and Drug Administration (FDA).

1.1.5 All items in the testing menu in Appendix 1 must be offered onsite at WBAMC, no service contracts for ship outs will be acceptable.

1.1.6 Reagents/consumables must meet the requirements of the 24/7 WBAMC mission, workload, and test menu. The Contractor shall provide the necessary materials in accordance with the Equipment’s Operators Manual.

1.1.7 Reagents used for troubleshooting analytical systems must be reimbursed (or replaced) by the

Contractor at no additional cost.

1.1.8 Reagents shall have a shelf life of at least 4 months upon receipt, or as stated within the individual line item on the delivery ticket or invoice. Shall be clearly marked with any required temperature controls, as necessary. The Government acknowledges that the Contractor’s assays have a shelf life of 12 months from manufactured date.

1.1.9 Emergency orders will be delivered within 24 hours after the order is placed.

1.1.10 Reagents testing menu must be the same between the antimicrobial identification analyzers and the Mass Spectrometer minus the antibiotics. All organisms must be able to be resulted on both pieces of equipment to provide redundancy.

1.2. EQUIPMENT

1.2.1. Contractor must provide the lease one (1) microbial identification and antibiotic susceptibility testing analyzer and one (1) Mass Spectrometer that interfaces with the standard microbial identification/susceptibility analyzer that requires minimum hand's on technologist time. Contract must also support necessary middleware, server, and ancillary equipment needed to make these two analyzers interface on the network.

1.2.2. The analyzer must be capable of accommodating upwards of 100 samples on a single test cartridge for the Mass Spectrometer and upward of 100 tests on the microbial identification/susceptibility analyzer at a time.

1.2.3. The microbial identification/susceptibility analyzer must result within twelve hours and the Mass Spectrometer with 30 minutes.

1.2.4. The organismal database provided to WBAMC must be extensive and provide an AES or similar database that can extrapolate and help the technologist when an identification percentage of less than 94% is reached to help with possible organisms the culture may be.

1.2.5. Both analyzers must be able to communicate with each other and existing instruments (Virtuo Blood Culture instrument and MYLA middleware server) owned by WBAMC, transfer patient information so susceptibility/identification can be correlated (they must interface together).

1.2.6. The required analytes/testing capabilities for these analyzers in order to meet the requirements for WBAMC patient population are as follows:

1. Gram Positive Organism Identification/Susceptibility Panels

2. Gram Negative Organism Identification/Susceptibility

3. Anaerobic Organism Identification Panel

4. Neisseria-Haemophilus Identification Panel

5. Yeast (Candida, etc.) Identification

6. Mycobacterium Identification (Mass Spectrometer requirement only)

7. Streptococcus Susceptibility Panel

1.2.7. All organismal panels listed with the exception of Mycobacterium MUST be available on both analyzers. The microbial identification and antibiotic susceptibility testing analyzer MUST have the same organismal library available (or be comparable which can be identified in the technical evaluation once the complete organism list is supplied) as the Mass Spectrometer analyzer in order for WBAMC to have confirmation for both validation purposes, clinical testing confirmation, and if the Mass Spectrometer was to become unavailable as to not effect patient care. For example, both analyzers must be able to identify anaerobic organisms and Neisseria gonorrhea.

1.2.8. The susceptibility testing need only be performed on the microbial identification and antibiotic susceptibility testing analyzer. However, the susceptibility panels must also offer the following antibiotics for each organismal identification area based on the WBAMC Antibiotic Stewardship Program, CLSI guidelines, and WBAMC Pharmacy Algorithm.

1.2.9. These antibiotics must have minimum and maximum MIC ranges in accordance with the CLSI or have a dilution/program in place to interpret results within required breakpoints. True MIC will not work if it does not have the maximum and minimum breakpoints for CLSI guidelines.

1.2.10. The list of the required antibiotic susceptibility test (AST) reagents can be found in Appendix 2.

1.2.11. Both analyzers MUST also be able to flag/identify organisms with specific susceptibility, resistance patterns to include but, not limited to:

1. Methicillin Resistant Staphylococcus Aureus (MRSA)

2. Vancomycin Resistant Staphylococcus Aureus (VRSA)

3. Vancomycin Resistant Enterococci (VRE)

4. Multi Drug Resistant Gram Negative Rods (MDRGNR)

5. Extended Spectrum Beta-Lactamase (ESBL) Resistant Organisms

1.2.12. WBAMC provides weekly reports on reportable organisms and susceptibility event trends in the area to the local Public Health Department, Army Public Health, Reportable events, and Surveillance Monitoring Program. WBAMC also support the Infection control Department with research and identification of potential hospital acquired infections and possible outbreaks within the WBAMC Hospital. The reportable list of organisms must have the common organisms found in the WBAMC community (Neisseria gonorrhea being one example). This list can be provided for common pathogens needed but, the El Paso Reportable List, State of Texas Reportable list, and Army Public Health Reportable disease list should be used as reference when meeting this compliance.

1.2.13. All equipment must integrate with each, requiring middleware to allow cross communications of instrumentation. The middleware/server must be compatible with CyberLog requirements. See Para 9.

2.1. MAINTENANCE AND SERVICE

2.1.1 The Contractor must meet the following service, and maintenance requirements for all testing locations at WBAMC (except where specifically noted otherwise):

2.1.1.a - The Contractor shall provide direct customer service and support, 24 hours / 7 days a week, to include hotline telephone service (provided in English) and on-call emergency repair, to assist operators in correcting equipment problems.

2.1.1.b - The Contractor will maintain all equipment installed under this contract except for repairs necessitated by willful damage or negligence on the behalf of the Government. This includes emergency repairs as well as routine Preventive Maintenance Services (PMS), safety tests, calibrations / calibration verifications, and unscheduled repair services in accordance with procedures and practices prescribed by the manufacturer of the equipment.

2.1.1.c - The Contractor must provide all personnel, equipment, tools, materials, supervision, parts, transportation, and other items and services necessary to perform all required repairs and scheduled preventive maintenance / safety inspections and calibrations of equipment. The performance of scheduled periodic preventive maintenance, safety checks, and calibrations that are not normally performed at the operator level must be performed by Contractor service personnel in accordance with requirements as specified in the Contractor's instrument maintenance manual. Completion of analyzer installation will establish time-zero for determining the time frame for performance of periodic services.

2.1.1.d - Any service technician provided by the Contractor must adhere to all required reporting procedures for WBAMC prior to reporting to the laboratory for work. Current procedures will be available through the COR or ACOR. Changes to reporting procedures will be communicated to the contractor by the COR or ACOR.

2.1.1.e - For equipment supporting the Laboratory, the service technician must be on-site to provide unlimited service within twenty-four (24) hours of establishing telephonic contact.

The equipment shall be repaired and operational within 48 hours after initial on-site response by the Contractor. Should both analyzers become inoperable, the Contractor's service technician must be on-site within four (4) hours of initial notification. The repair of at least one

(1) Analyzer must be completed within eight (8) hours of initial notification. If deemed necessary, after consultation with the COR and / or ACOR, if at least one analyzer cannot be repaired within eight (8) hours of the initial notification, the Contractor shall, where requested, arrange the pickup and delivery of critical specimens to a College of American Pathologists accredited clinical laboratory, with priority testing service provided for STAT / ASAP specimens. The Contractor shall pay all costs associated with the provision of this alternative testing, including those for delivery of hardcopy patient results by express courier, directly to the laboratory for as long as all analyzers remain inoperable.

2.1.1.f - For equipment supporting other locations, the service technician must be on-site to provide unlimited service (service requiring repair) the next business day of establishing telephonic contact. The equipment shall be repaired and operational within 48 hours after initial on-site response by the Contractor.

2.1.1.g - In all cases, the Contractor shall provide all reagents, calibrators, controls, and any other materials necessary to troubleshoot instrument failure. Replacement parts used, as necessary, claimed from local operator-level maintenance kits as well as any reagents that may have been used must be replaced at no cost by the Contractor.

2.1.1.h - The Contractor shall notify the COR or ACOR of the exact date and time for performance of a preventive maintenance service no later than ten (10) days prior to the scheduled preventive maintenance services.

2.1.1.i - Within one (1) working day after completion of a repair, the Contractor's representative shall furnish the COR one (1) copy of a service report for all services performed with a copy to the Equipment Management Branch and the Laboratory Representative for the MTF. The report shall be in English and shall contain, as a minimum, the following information:

- Nomenclature and serial number

- Date of service

- Description of services performed (ie: preventive maintenance service, or unscheduled repair service)

- Location of services performed

- Duration of performance (hours)

- List of parts replaced or other actions taken to restore operability of the instrument

- Name of technician

2.1.1.j - The Contractor must relocate / revalidate any instrument if requested by the Government at no additional cost. This includes any location within the WBAMC healthcare network.

2.1.2. The contractor's service representative shall report in person or telephonically notify the maintenance manager, building number 5005, telephone number 915-742-2121, prior to commencing services during normal duty operating hours Monday through Friday, 7:30AM to 5:00PM, William Beaumont Army Medical Center, Fort Bliss, Texas. During other than normal operating hours the contractor's representative shall report to the Administrative / Staff duty Officer of the Day (AOD / SDO), building number 5005, telephone number 915-742-2121 Located on the 3rd Floor Information Desk.

2.1.2.a - The contractor shall check-in at Medical Maintenance RM HB1250, Customer Service Desk, for ID badge upon arrival and check out when departing the service site.

2.1.2.b - Upon completion of services, the assisting Medical Maintenance technician will sign the service report to validate services performed.

2.1.2.c - If repairs are completed after 5:00PM, the contractor will sign in/out with the Administrative / Staff Duty Officer on Duty (AOD / SDO) and / or the Medical Maintenance technician on duty.

2.1.2.d - The government and contractor's service representative will communicate hazardous information before the commencement of any repair.

2.1.2.e - When required, the contractor's service representative will comply with the Office of Safety and Health Administration lockout / tag out standards while performing maintenance on equipment.

2.1.2.f - Contractor's service representative will be factory trained and have a minimum of two years of experience working on the contracted equipment.

2.1.2.g - Contractor must furnish all software upgrades issued by the equipment manufacturer.

2.1.2.h - Contractor shall have access to all necessary diagnostic software (if applicable).

2.1.2.i - Required forms and extracts from pertinent directives will be furnished to the contractor's service representative by the government.

2.1.2.j - The contractor shall keep the system in good operating condition, meeting all equipment and performance requirements published by the OEM. The contractor also assumes responsibility for system conformance with the latest published edition of NFPA-99, OSHA and CDRH. The contractor shall ensure that the system maintains their minimum uptime requirements.

2.1.2.k - All equipment listed in Section 2 will be fully mission capable at a minimum of 95% of available time (uptime). Downtime is defined as the state when the system is not operable or available for routine clinical use. The start of the downtime period will be the time the contractor is notified by the COR or authorized designee. Scheduled preventive maintenance shall not be considered in downtime calculation.

2.1.2.l - Minor system failures of ancillary components that do not affect system clinical use and availability will not be considered in downtime calculation, except if the FST needs to preempt use of the system to accomplish the repair.

The Contractor shall not remove any equipment from the Government work site without prior approval of the COR and Property Book Officer (PBO) or his / her designated representative.

(i.e. printer, UPS, monitor). The contractor shall notify the COR / PBO (in writing/e-mail) the intent to remove / exchange any equipment. The written notification will include the make, model, serial number of each equipment item that will be removed and the same information for the equipment being installed within the MTF.

2.1.2.m- Services for instrumentation maintenance and or supply shipment shall not be held on subsequent option years due to previous contractual agreements. Once the vendor has entered into a contractual obligation the services provided will be independent of other contractual obligations and will not be halted, held, or canceled due to previous contractual obligations or outstanding requirements. See 1.1.2 for same stipulation for reagents.

2.2. NORMAL HOURS OF OPERATION

2.2.1. Normal Hours of Operation. Monday through Friday between the hours of 0730 - 1630.

Holidays. Routine equipment servicing and reagent delivery will not be required on standard Federal Holidays. If an emergency arises, equipment servicing and reagent delivery will be provided.

2.2.2. The Contractor shall provide equipment maintenance service/direct customer service and support, 24 hours/7 days a week, to include hotline telephone service, and direct connect remote instrument diagnostic capability to assist operators in correcting equipment operation problems.

2.2.3. Legal Holidays. The following legal holidays will be observed by the Government:

New Year’s Day 1 January Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May Juneteenth 19 June Independence Day 4 July Labor Day First Monday in September Columbus Day Second Monday in October Veteran’s Day 11 November Thanksgiving Day Fourth Thursday in November Christmas Day 25 December

NOTE: Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above.

3.1 TRAINING

3.1.1 The Contractor must provide the following for all testing locations at WBAMC:

3.1.1.a - The Contractor must provide initial on-site operator training to all technicians assigned to the Government site normally assigned to perform the associated testing prior to implementation of the analyzer for patient testing. In addition, the Contractor must provide training for four (4) primary (key) operators, per major analyzer and automated system at the Contractor's training site at no additional cost to the Government (including transportation airfare, rental car, per diem, etc.) prior to implementation of the analyzer.

3.1.1.b - All on-site training must include basic analyzer operation, troubleshooting procedures, performance of operator-level periodic preventive maintenance procedures, and use of any data management / quality control software.

4.1 Quality Control and Quality Assurance

4.1.1 The Contractor shall provide a Quality Control (QC) Plan that contains, at a minimum, the items listed in 1.2.2 (below) to the Contracting Officer and Contract Officers Representative (COR) for acceptance not later than 10 days AFTER the start of the contract (see Exhibit 1). The Contracting Officer will notify the Contractor of acceptance or required modifications to the plan. The Contractor shall make appropriate modifications and obtain acceptance of the plan by the Contracting Officer.

4.1.2. The QC Plan shall include:

4.1.3. A description of the inspection system to cover all incidental support and maintenance services listed on the Performance Requirements Summary (PRS) listed in Exhibit 1.

Description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title and organizational placement of the inspectors. Additionally, control procedures for any Government provided keys or lock combinations shall be included.

4.1.4. A description of the methods to be used for identifying and preventing equipment failure and/or defects.

4.1.5. A description of the records to be kept to document inspections and corrective or preventive actions taken. NOTE: The records of inspections shall be kept and made available to the Government throughout the contract performance period and for the period after contract completion until final settlement of any claims, if any, under this contract.

4.1.6. Quality Assurance (QA). For those tasks listed on the PRS (Exhibit 1), the COR will follow the methods of surveillance specified in this contract. Government personnel will record surveillance observations, as needed, and provide to the Contractor. The receipt of the observation does not necessarily constitute concurrence with the observation, only acknowledgment that the Contractor has been made aware of the defective performance.

Government surveillance may include observations/tasks not listed in the PRS. Such surveillance will be done according to standard inspection procedures or other contract provisions. Any action taken by the Contracting Officer as a result of surveillance will be according to the terms of this contract.

4.1.7. Equipment Troubleshooting. When the Government performs troubleshooting with the Contractor, the Contractor shall replace all reagents.

4.1.8. Performance Evaluation Meetings.

4.1.8.1. The Contracting Officer may require the Contractor to meet with the Contracting Officer and/or COR, as deemed necessary.

4.1.8.2. The Contractor may request a meeting with the Contracting Officer, when the Contractor believes such a meeting is necessary. If required, written minutes of any such meetings shall be recorded in the contract and signed by the Contractor and the Contracting Officer. If the Contractor does not concur with any portion of the minutes, such nonoccurrence shall be provided in writing to the Contracting Officer within 10 calendar days following receipt of the minutes.

5.1. UPGRADE OF EQUIPMENT.

5.1.1. Database Updates. The Contractor is responsible for keeping equipment installed with the most up to date organismal reference databases. The Contractor is responsible for providing QC reagents and organism needed to validate new databases at no additional cost to the Government.

6.1. SPECIAL WORKING CONDITIONS.

All equipment, parts, materials, and incidental services supplied by the Contractor shall conform to the applicable Safety and Health Standards as indicated in the current code of federal Regulations, Title 29, Chapter XVII, paragraph 1910, Occupational Safety Health Act of 1970.

7.1. CONTRACTOR PERSONNEL.

7.1.1. Contractor Employees. The Contractor shall not employ persons for work on this contract if such employee is identified to the Contractor by the Contracting Officer as a potential threat to the health, safety, security, general well-being or operational mission of the installations and their population.

7.1.2. Contractor employees shall present a neat appearance and be easily recognized as Contractor employees. Contractor personnel shall either wear a distinguishable uniform or badge on the exterior of their clothing while performing any service at any Government facility.

7.1.2.1. The Contractor shall not employ any person who is an employee of the US Government. Additionally, the Contractor shall not employ any person who is an employee of the Department of Defense, either military or civilian, unless such person seeks and receives approval according to DOD 5500.7R, “Joint Ethics Regulation”. The Contractor shall not employ any person who is an employee of the Department of Defense, if such employment would be contrary to local policies.

7.1.2.2. The contractor employees will be registered with the Symplr© system for

WBAMC. Vendors must check in with Symplr© and report to PMO to check in. At no time is the contractor employee to walk about the WBAMC without an escort. PMO will contact the COR to escort the vendor to the laboratory area.

7.1.2.3. Contractor employees will not be admitted to the department of pathology with a prior scheduled appointment. No walk-ons will be accepted by the COR.

8.1. BILLING AND PAYMENTS.

8.1. The vendor must provide a reagent/test list with each fixed price for the appropriate test upon award of the contract to the COR. This will be the firm, fixed price for the entire term of the contract to include option years.

8.2. The vendor must bill in WAWF within 30 days of receiving the billing statement.

8.2.1. The vendor must attach an itemized invoicing, breaking down into each individual test type, in WAWF for proper review of fixed test pricing in order for invoices to be paid.

8.3. The vendor must have an inventory monitoring system in place for each individual test.

8.4. If the vendor is aware that the workload is exceeded for an individual CLIN or item, the vendor will not ship and will contact the COR about the rejected processing.

9. INFORMATION SECURITY (CyberLog)

9.1. TELECOMMUNICATION

9.1.1. All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software must be approved through the DHA Software and Application Certification Assessment. Submission of DHA Application Request Worksheet must be completed within the six (6) months of contract award.

9.1.2. The Contractor shall follow Army Regulation 25-1, “Army Knowledge Management and Information Technology, AR 25-2, “Cybersecurity,” and DoD 6025.18-R, DoD Health Information Privacy Regulation.

9.1.3. In accordance with contract requirements, Contractors shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

9.1.4. The Contractor shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies and will provide, maintain and configure VPN concentrator that complies with DoD security standards.

9.1.5. All costs for VPN hardware and software shall be incurred by the Contractor.

9.1.6. The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chief Information Officer.

9.1.7. The Contractor shall validate that systems authenticate users through the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the vendor's technical users will maintain secure logon.

9.2. DEPARTMENT OF RISK MANAGEMENT FRAMEWORK (RMF) IMPLEMENTATION

PLAN

9.2.1. The Vendor shall provide information for the Risk Assessment Analysis to the Government for all networking IT applicability.

9.2.2. Vendors shall only offer items, which already have an Authorization to Operate (ATO), or items for which the Vendor agrees to go through the DHA RMF process and obtain an

RMF ATO.

9.2.3. Any offered system must meet DoD Cybersecurity/Risk Management Framework (RMF) and Service Information Assurance (IA) requirements. Vendors are required to provide a statement with their quote that they agree to the Service Cybersecurity/IA Requirements, HIPAA requirements and B2B requirements.

9.2.4. Vendors are required to provide a completed Joint Medical Device Risk Assessment Questionnaire (v1.1) for the offered system along with their offer. These should be provided by DHA Cyber Logistics.

9.2.5. RMF shall be evaluated as part of the System Capability Factor. Vendors must meet all the below RMF minimum requirements along with any additional RMF requirements listed.

Vendors may be assigned strengths if they exceed any RMF minimum requirement and/or meet any RMF objective. Additionally, weaknesses may be assigned based on the vendor’s responses in the Joint Medical Device Risk Assessment Questionnaire (v1.1). RMF weaknesses may include but are not limited to; deficiencies in architecture or software versions, other services having cancelled RMF efforts due to vendor non-responses or inability to get an RMF ATO, system having received a DATO from any service, and deficiencies that cannot be mitigated/accepted.

9.2.6. Submitting a quote for any requirement under this initiative constitutes full agreement to all specific Service IA requirements.

9.2.7. Failure to agree to the Service IA requirements and to provide a completed Joint Medical Device Risk Assessment Questionnaire shall result in rejection of the vendors quote.

Failing to disclose that a system cannot meet IA requirements, failure to meet certification timeframes or failure to receive ATO may result in termination for cause in accordance with FAR 52.212-4(m).

ESTABLISHING INTERFACE:

(a) The system shall bi-directionally interface with the Composite Health Care System (CHCS), Military Healthcare System (MHS) Genesis and the laboratory information system

(LIS).

(b) The system shall have the ability to receive HL7 order messages (ORM) and information from the LIS and provide DICOM Modality Worklist to the modalities.

9.3. SECURITY CLEARANCES

9.3.1. Personnel to be assigned to an Automated Data Processing (ADP)/IT position must undergo a successful security screening before being provided access to DoD information technology resources. Prior to an employee being granted interim access to DoD sensitive information, WBAMC must receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement shall (must) be met by Contractors, subcontractors and other who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under HIPPA. Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees shall (must) have at a minimum an ADP Sensitivity Designation of Level II to access the DoD Network.

9.3.2. All Contractors that use the DoD gateways to access Government systems shall submit a DISA Form 41 or equivalent in accordance with COR guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface.

Contractors shall complete and submit to TMA one Form 41 for their organization,which shall be a listing of those individuals for whom background checks have been completed, submitted to the OPM, and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request must clearly delineate the ports and protocols used for each Internet Protocol (IP) address. The Contractor shall complete the form and submit to the Government for final processing.

9.3.3. All costs for the Contractors employee background investigations are the responsibility of the Contractor, unless the investigation is completed by the Government, which would be at no cost to the Contractor.

9.3.4. The terms and conditions of this clause must be completed no later than three (3) months post award.

9.4. BUSINESS TO BUSINESS (B2B) PARTNERS AND 3rd PARTY VENDORS

9.4.1. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

9.4.2. PERSONNEL SECURITY.

9.4.2.1. The Contractor shall comply with the following:

• DoD Directive 8500.01, “Cybersecurity

• DoD Directive 5400.11, “DoD Privacy Program”

• DoD 6025.18-R, “DoD Health Information Privacy Regulation”

• DoD 5200.2-R, “Personnel Security Program Requirements”

• Local regulations as deemed appropriate by the Information Assurance Officer

• AR 25-1, “Army Knowledge Management and Information Technology”

• AR 25-2 “Cybersecurity”

• AR 525-13 Antiterrorism

• AR 530-1 Operations Security (OPSEC)

• DOD Instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)

9.4.2.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

9.4.2.2.1. Follow the DoD guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

9.4.2.2.2. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility local area network (LAN).

9.4.2.2.3. Immediately report to the MTFs Security Office and deny access to any automated information system (AIS), network, or information if a Contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for any reason.

9.4.2.2.4. Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

9.4.2.3. AT Level 1 Training. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities, and controlled access areas shall complete AT Level 1 training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR, or to the Contracting Officer, if a COR is not assigned, within 10 days after completion of training by all employees and subcontractor personnel. AT Level 1 Awareness Training is available at the following website: https://atlevel1.dtic.mil/at.

9.4.2.4. Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractors employees shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office.

Contractor workforce must comply with all personal identity verification requirements as direct by DOD, HQDA, and or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

9.4.2.5. OPSEC Training. Per AR 530-1, Operations Security, new contractor employees must complete Level 1 OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete annual OPSEC awareness training.

9.5. ELECTRONIC SECURITY.

9.5.1. Contractor Information Systems (IS)/networks that are involved in the operation of https://atlevel1.dtic.mil/at systems in support of WBAMC shall operate in accordance with controlling laws, regulations, DoD, and local policy.

9.5.2. Certification & Accreditation (C&A) requirements apply to all DoD and Contractor’s IS/networks that receive, process, display, store or transmit DoD information. The Contractor shall comply with the C&A process for safeguarding IS. Certification is the determination of the appropriate level of protection required for IS/networks. Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

9.5.3. Accreditation is the formal approval by the Government to operate the Contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections; and with appropriate level of protection for the specified period.

9.5.4. The Contractor shall comply with C&A requirements, as specified by the Government that meet appropriate DoD Information Assurance requirements. The C&A requirements shall be met before the Contractor’s system is authorized to access DoD data or interconnect with any DoD IS/network that receives, processes, stores, displays or transmits DoD data. The Contractor shall ensure the proper Contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

• Attending and supporting C&A meetings with the Government

• Supporting/conducting the vulnerability mitigation process

• Supporting the C&A Team during system security testing

9.5.5. Contractors shall (must) confirm that their networks are locked down prior to initiating testing.

9.5.5.1. Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

9.5.5.2. Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

9.5.6. Any re-configuration or change in the system during the C&A testing process shall require a re-base lining of the system and documentation of system changes.

9.5.7. Information Assurance (IA) mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the Government shall be in compliance with all known applicable Department of Defense Computer Emergency Response Team (DoD-CERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

9.5.8. Disposing of Electronic Media. Contractor shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Contractor is required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

9.5.9. Information Assurance Vulnerability Management (IAVM). The Contractor shall implement an information assurance vulnerability management program for all AIS and corresponding subnets that are connected to or intermittently connect to DoD networks. The program shall meet the scope and intent of AR25-2 and WBAMC IA policies to provide protection against known threats and vulnerabilities. Compliance with DoD IAVM alerts and bulleting is required for these systems and shall be completed within the specified timeframe.

9.6. INFORMATION SYSTEMS (IS)/NETWORKS PHYSICAL SECURITY.

9.6.1. The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor shall support a Physical Security Audit performed by the Government of the Contractor's internal information management infrastructure.

9.6.2. The MHS Physical Security Audit Matrix is available at:

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20v ersion.xls.

9.6.3. The Contractor shall correct any deficiencies identified by the Government of the Contractor's physical security posture.

9.7. SPECIAL REQUIREMENTS FOR PROTECTED HEALTH INFORMATION.

9.7.1. Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the Contractors shall (must):

9.7.2. Notify the MTF HIPAA Security Manager.

9.7.3. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

9.8. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (June 2012) In accordance with DoD 6025.18-R “Department of Defense Health Information Privacy Regulation,” January 24, 2003, the Contractor meets the definition of Business Associate.

Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and in DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

(a) Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DoD 6025.18-R or DoD 8580.02-R.

Individual has the same meaning as the term “individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 160.103, limited to the information created or received by the Contractor from or on behalf of the Government pursuant to the Contract.

Electronic Protected Health Information has the same meaning as the term “electronic http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls protected health information” in 45 CFR 160.103.

Required by Law has the same meaning as the term “required by law” in 45 CFR 164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part 164, subpart C.

Terms used, but not otherwise defined, in this Clause shall have the same meaning as those terms in 45 CFR 160.103, 160.502, 164.103, 164.304, and 164.501.

(b) The Contractor shall not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

(c) The Contractor shall use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Contract.

(d) The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

(e) The Contractor shall, at their own expense, take action to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Clause.

These mitigation actions will include as a minimum those listed in the TMA Breach Notification Standard Operating Procedure (SOP), which is available at:

http://www.tricare.mil/tma/privacy/breach.aspx.

(f) The Contractor shall report to the Government any security incident involving protected health information of which it becomes aware.

(g) The Contractor shall report to the Government any use or disclosure of the ProtectedHealth Information not provided for by this Contract of which the Contractor becomes aware.

(h) The Contractor shall ensure that any agent, including a subcontractor, to whom itprovides Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

(i) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

(j) The Contractor shall provide access, at the request of the Government, and in the timeand manner reasonably designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

(k) The Contractor shall make any amendment(s) to Protected Health Information in a Designated Record Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government, and in the time and manner reasonably designated by the Government.

(l) The Contractor shall make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner reasonably designated by the Government or the Secretary, for purposes of the Secretary determining the Government’s compliance with the Privacy Rule.

(m) The Contractor shall document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

(n) The Contractor shall provide to the Government or an Individual, in time and manner reasonably designated by the Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

General Use and Disclosure Provisions Except as otherwise limited in this Clause, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the HIPAA Privacy Rule, the HIPAA Security Rule, DoD 6025.18-R or DoD 8580.02-R if done by the Government.

Specific Use and Disclosure Provisions

(a) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(b) Except as otherwise limited in this Clause, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(c) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

(d) Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1).

Obligations of the Government Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

(a) The Government shall provide the Contractor with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520.

(b) The Government shall provide the Contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Contractor’s permitted or required uses and disclosures.

(c) The Government shall notify the Contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45

CFR 164.522.

Permissible Requests by the Government The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Privacy Rule, the HIPAA Security Rule, or any applicable Government regulations (including without limitation, DoD 6025.18-R and DoD 8580.02-R) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

Termination

(a) Termination. A breach by the Contractor of this clause, may…