PWS_Blood Donor Testing_HT940626QE098.pdf

Department of Defense Defense Health Agency

Performance Work Statement

Blood Donor Testing Services - Infectious Disease Laboratory Testing

Eisenhower Army Medical Center (EAMC), Fort Gordon, Ga

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide blood donor testing services and blood bank reference laboratory testing in support of Eisenhower Army Medical Center, Fort Gordon, Georgia. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.2 Description of services/introduction: The Contractor shall provide comprehensive, off-site blood donor infectious disease screening and blood bank reference laboratory testing services for the Kendrick Memorial Blood Center, Eisenhower Army Medical Center (EAMC), Fort Gordon, Georgia. All testing shall be conducted at the Contractor’s primary FDA-licensed facilities or within its formally approved network; to ensure clinical uniformity and stringent quality control, referrals to secondary subcontractor laboratories shall be minimized and require prior written approval from the Contracting Officer’s Representative (COR), with the prime Contractor retaining full responsibility for all results. To guarantee uninterrupted support to the military blood supply, the Contractor must maintain a robust Business Continuity Plan ensuring zero degradation, delay, or stoppage of testing services during national emergencies, natural disasters, or facility outages. Finally, all standard blood donor screening, nucleic acid testing (NAT), and confirmatory testing shall be executed in strict compliance with Title 21 of the Code of Federal Regulations (CFR), the Clinical Laboratory Improvement Amendments (CLIA) of 1988, and all applicable American Association of Blood Banks (AABB) standards.

1.2.1 All testing shall be in accordance with the Food and Drug Administration (FDA) regulations for the manufacturing of transfusable blood products and for blood bank reference lab testing.

1.2.2 Standard Test Panel: The panel shall include, at a minimum: ABO/Rh, Antibody Screen, Antibody Identification, Syphilis Test (STS), HBsAg, HBcAb, HCV, HIV-1/2, HTLV I/II, Chagas/T.cruzi, and Cytomegalovirus (CMV).

1.2.3 Nucleic Acid Test (NAT) Panel: The NAT panel shall include, at a minimum: West Nile Virus (WNV) NAT, HIV NAT, HCV NAT, and HBV NAT.

1.2.4 Confirmatory Testing: The contractor shall perform individual confirmatory tests for all initial reactive results, including but not limited to: HBsAg Neutralization, HCV confirmatory, HBV confirmatory, HIV 1/2 confirmatory, HTLV I/II confirmatory, Chagas confirmatory, and Syphilis (TP-PA) confirmatory.

1.3 Background: The Department of Pathology at the Eisenhower Army Medical Center (EAMC), Fort Gordon, GA, operates the Kendrick Memorial Blood Center. The Blood Center requires comprehensive, FDA-compliant infectious disease laboratory testing for blood donors to ensure the safety, purity, and potency of the military blood supply.

1.4 Objectives: Provide blood donor testing services to support surgical services, the Department of Pathology.

1.5 Scope: The Contractor shall provide all required facilities, personnel, services, and materials to provide blood donor testing services in support of the U.S. Army. All tests shall be executed at the Contractor's FDA-licensed premises or within its network of qualified subcontractor laboratories.

1.6 Period of Performance (PoP): The Period of Performance (PoP) shall consist of one (1) 12-month Base Period and four (4) consecutive 12-month Option Periods. Additionally, this contract contains provisions for a 6-month Option to Extend Services in accordance with FAR clause 52.217-8.

If exercised, the Option to Extend Services will be performed under the same terms, conditions, and performance standards of the prevailing period of performance. The total potential duration of this contract, including all option periods and the 6-month extension, shall not exceed five (5) years and six (6) months.

1.7 Administrative specifications

1.7.1 Place of performance: The testing and analysis shall be performed off-site at the Contractor's established, FDA-licensed medical laboratory facilities.

1.7.2 Recognized Federal holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.7.4 Emergency Services: The Contractor shall provide a toll-free customer service telephone line accessible 24 hours per day, 7 days per week, 365 days a year to address emergent testing issues or reporting delays. Testing operations shall be conducted on a schedule necessary to meet the strict turnaround times defined in Part 5.

1.8 Quality

1.8.1 Quality Control (QC): The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The Contractor shall maintain QC System records that are complete and reliable. The contractor’s QC program is the means by which the work complies with stated requirements. The Contractor shall provide a copy of its existing Quality Control System within 10 working days after award of the contract. Any changes made after award of contract shall be submitted to the COR and to the Contracting Officer for Government's review and approval prior to implementation.

1.8.2 A progress meeting shall be held by telephone within 60 calendar days after contract start date between the COR and the Contractor to discuss any issues.

1.8.3 The Contractor shall perform external proficiency testing surveys as required by CLIA for all regulated analytes. The Contractor shall provide the COR a listing of external proficiency surveys that the laboratory participates in accordance with CLIA. Survey results and statistical reviews for specific laboratory specialties shall be provided to COR or designee upon request.

1.8.4 The Contractor shall operate a quality control program as required by FDA; Current CLIA requirements are located at the Health Care Financing Administration's website:

http://www.phppo.cdc.gov/CLIA. Upon request of the COR , the Contractor shall provide documentation of quality assurance policies, quality control results for assays, on-going calculations of quality control performance (coefficient of variation, mean and standard deviation), monthly Levy-Jennings graphs, and documentation of appropriate analyzer maintenance. Upon request, the Contractor shall provide verification results for assays of non-regulated analytes, and analytes for which proficiency testing does not currently exist.

1.8.5 All test methods shall be FDA approved for blood donor testing. Any non-FDA approved method being performed shall have a documented validation plan. Upon request, the validation plan and validation results shall be made available to the COR or designee. All instrumentation and testing methods, standard operating procedures must be validated prior to implementation and use by the Contractor providing blood donor testing IAW FDA requirements.

1.8.6 The Contractor shall ensure that subcontracted laboratories comply with and meet all accreditations/certifications as the prime contractor.

1.8.7 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.9 Contractor personnel

1.9.1 Contractor Representative. The Contractor shall designate and submit, in writing, within 10 working days after award, the name of a full-time contractor representative and alternate. The written designation shall be submitted to the contracting officer and the COR as identified in the contract. The Contractor shall also provide the telephone, pager, cell phone and facsimile numbers and email address for the designated full-time contractor representative and alternate.

1.9.2 The contractor shall ensure the contractor representative is available telephonically, or in person by appointment, as needed, for troubleshooting, servicing, introducing new tests, etc.

During non-duty hours, the contractor representative shall be accessible on a cell phone or pager.

1.9.3 The contractor shall ensure the contractor representative is available telephonically, or in person by appointment, to meet, as necessary, with the COR, as identified on contract or task order, to discuss immediate administrative, technical issues, and problem areas the customers may be experiencing in the field. During non-duty hours, the contractor representative shall be accessible on a cell phone or pager number.

1.10 Contractor Responsibility

1.10.1 The Contractor shall ensure all employees under this contract who will be interacting with government personnel (i.e., contractor representative, customer service personnel, data entry/specimen processing technician, and courier) are able to read, write, and speak English fluently, with sufficient clarity, to effectively communicate.

1.10.2 The Contractor shall ensure each laboratory possesses all legally required license(s), certification(s), and accreditation(s) in accordance with Federal statutes and implementing regulations as well as those of the State in which the laboratory is located. The Contractor shall ensure any subcontractors performing services hereunder shall meet the same requirements as the prime contractor. Proof of the above required certification(s), accreditation(s), license(s), etc., shall be provided to the BDCs IAW the FDA regulations.

1.10.3 The Contractor shall ensure its employees have the ability to perform the applicable duties consistent with their license and certification. The Contractor shall ensure all laboratory testing staff complies with minimum Federal, State, and local law qualifications/requirements. The Contractor shall ensure all employees comply with applicable State regulations regarding their certification or registry, or license for the State in which the Contractor's testing facility is located.

1.10.4 The contractor shall ensure all testing and supervisory personnel at all contractor-owned, affiliate, or subcontracted laboratories assigned to work under this contract meet and maintain the applicable personnel qualifications set forth under the Clinical Laboratory Improvement Amendments (CLIA) of 1988 regulations.

1.10.5 The Contractor shall submit a copy of the professional certification and/or licensure of the corporate Laboratory Director and/or Medical Director to the COR within 10 working days after contract award. The Contractor shall also submit copies of all certifications/licenses for the Technical Supervisors of the Primary Contractor's laboratory.

1.11 Service Delivery and Reporting

1.11.1 Customer Services. The Contractor shall provide customer service which shall be accessible by toll-free telephone service 24 hours per day, 7 days per week to assist Government staff in tracking test results, modifying test requests, obtaining information regarding specimen requirements, and other applicable related issues/problems that may arise in the performance of work under this contract. The Contractor shall provide toll-free number(s) as applicable to each task order.

1.11.2 The contractor shall provide testing service for 7 days a week.

1.11.3 The Contractor shall provide all necessary instructions for shipping and supplies for biologic specimens to be transported from the blood donor centers submitting test requests under this contract to the Contractor.

1.11.4 The primary result reporting will be by secure FTP or e-mail to the representatives of the blood donor center. Results must be protected portable document file (pdf) or text file and sent by secure FTP e-mail upon completion of the testing and verification of results for accuracy within a 24-hour period following receipt of the specimens. Contractor must be able to receive specimens within 24 hours of collection including when collections occur after regular business hours, during blood drives that occur away from KMBC, during blood drives that occur on weekends, and any other instance when normal shipping via FedEx is unavailable.

1.11.5 Contractor shall inform the COR of any delay in test results within the 24-hour period via e-mail or secure fax. Repeat positive results for initially reactive and failed run sample shall be available within 48 hours of receipt of donor specimens. The contractor shall provide additional confirmatory testing for donor specimens that are initially reactive for donor specimens that are initially reactive for Hepatitis B Surface Antigen, Hepatitis B Virus Core, Human T- Lymphotropic Viruses Type I & II, Human Immunodeficiency Virus 1 & 2, Hepatitis C Virus, and Treponema Pallidum (Syphilis) as required by regulatory and service agencies.

1.11.6 The additional confirmatory testing results shall be available within 5 to 10 business days to the blood donor centers via e- mail or secure fax. Confirmation test results will be available based upon the requirements established by the specific testing procedure. Original hard copy results must be sent to the representatives of the blood donor centers by courier or mail.

Facsimile will be utilized as a back-up to e-mail. A list of email addresses will be provided by the representatives of the blood donor centers within 10 working days after award to the Contractor to provide results electronically through email. Original test results will be mailed to the following addresses: a. Infectious Disease Testing and Confirmation results: Kendrick Memorial Blood Center Bldg. BDC 001 48 Central Hospital Court Ft Gordon, GA 30905-5650.

1.11.7 Handling of Specimen or Request Discrepancies: Specimen loss due to breakage, spillage, insufficient dry ice, misplacement, mishandling, or any other Contracted related problem will be considered unacceptable if more than two (2) specimens are lost or otherwise compromised per month. Repeated problems with specimen loss may be grounds for termination of contract for cause. The Contractor shall bring any errors or discrepancies to the attention of the representatives of the blood donor center immediately upon discovery.

1.12 Physical Security

1.12.1 The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use.

1.12.2 The Contractor shall obtain all local, State and Federal government licenses, passes and permits necessary to enter the government installation to include vehicle registration and insurance as required.

1.12.3 Information Security. The computer system shall be processing and transferring data that is classified as Sensitive but Unclassified (SBU) and shall have the appropriate security features.

Electronic transmission of identifiable patient information shall be in compliance with requirements of the Privacy Act and Health Insurance Portability and Accountability Act (HIPAA). The following security requirements are in addition to the DoD, U.S. Army, or other government agency basic policy of initial and periodic security training, and the need for physical controls to protect hardware.

1.12.3.1 Neither the Contractor, nor any of its employees, shall disclose or cause to be disseminated any information concerning military activity operations.

1.12.3.2 Neither the Contractor, nor any of its employees, shall disclose private medical information concerning patients to third parties other than those personnel designated by the Government at each Submitting Activity to receive patient results. Results shall be handled as private medical records in accordance with DA Pam 25-51, Privacy Act Requirements for Medical Records Systems.

1.12.3.3 All inquiries, comments or complaints pertaining to patient information or government information, arising from any matter observed, experienced, or discovered as a result of, or in connection with the performance of this contract shall be directed to COR for resolution.

1.12.4 Computer Security

1.12.4.1 Computer system processing is sensitive, but unclassified information, and shall have the appropriate security features in accordance with requirements in the National Security Agency "Orange Book" (DoD 5200.28-STD, DoD Trusted Computer System Evaluation Criteria), U.S. Army's or other Government Agency basic policy of initial and periodic security training and the need for physical controls to protect hardware. The website for the Orange Book is: http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.html.

1.13 Government’s COR

The COR monitors all technical aspects of the contract and assists in contract administration.

The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14 Personnel Security

1.14.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM

5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.14.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.14.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.14.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

1.15 Management Reports

1.15. MANAGEMENT REPORTS.

1.15.1 Monthly COR Reports. The Contractor shall provide separate monthly data summary reports of tests performed for each COR under this contract. The contractor shall submit all monthly review reports to the Contracting Officer's Representative (COR) no later than the 10th calendar day of the following month.

1.15.1.1 The reported information shall include subtotals for each test and the test name, vendor's test code, test cost, number of tests performed (current month), total monthly cost (per test), number performed year to date (per test), and cost year to date (per test). The contractor shall also provide notice of when a selected test is subject to a unit price reduction based on the discount terms incorporated under contract. The test name, vendor's test code, the revised unit cost per test, and effective date shall be annotated.

1.15.2 The reports with data required in PWS paragraph 1.15 shall report using the primary method. Results may be sorted by four additional methods:

1.15.2.1. Results listed chronologically by unit numbers is the primary reporting method.

1.15.2.2 Test names are listed alphabetically.

1.15.2.3 Test names listed in order of year-to-date test frequency (highest to lowest).

1.15.2.4 Test names listed in order of year-to-date total test cost (highest to lowest).

1.15.3 Quarterly Regional Reports. The Contractor shall provide quarterly data summary reports of tests performed for each COR as identified under this contract. The printed reports shall be delivered to the COR, and contracting officer no later than the tenth calendar day of the month after the end of each quarter. Letter issued to the contractor after award of the contract will identify the COR.

1.15.3.1 The reported information shall include subtotals by COR for each test and include test name, vendor's test code, test cost, number of tests performed (current month), total monthly cost (per test), number performed year to date (per test), and cost year to date (per test).

1.15.3.2 The reports with data required in PWS paragraph 1.15 shall be sorted by the COR using the primary method (unit numbers chronologically) and may be reported by the additional three methods outlined at paragraphs PWS paragraph 1.15.2.1, through 1.15.2.4.

1.15.4 The Contractor shall provide the COR and contracting officer a Quarterly Summary Report. The recorded information shall as the minimum include:

1.15.4.1 Cumulative subtotals for each test ordered. Identify the test name, vendor's test code, and current test cost (Unit).

1.15.4.2 Cumulative dollar subtotal for each test ordered. Identify the test name, vendor's test code, and current test cost (per unit).

1.15.4.3 Notification of when a specific test is subject to a unit price reduction based on the contractor's proposed discount schedule/terms incorporated under contract shall be provided by the Contractor to the COR and the contracting officer. Identify the test name, vendor's test code, and revised unit cost per test.

1.15.4.4 Notification of the revised pricing for a given test based on price reductions will be made to the contracting officer and CORs and other contracting officers by modification to the basic contract.

1.15.4.5 All reports shall be submitted in electronic spreadsheet form. Electronic supplemental narrative shall be forwarded as appropriate.

1.16 Miscellaneous Contractor Responsibilities

1.16.1 The Contractor shall keep the contracting officer and the COR, informed of the most recent developments in clinical laboratory methods used and medical interpretation of laboratory tests through periodic newsletters, reports, data sheets, and/or Continuing Medical Education (CME) presentations. The Contractor shall provide quarterly updates.

1.16.2 The Contractor shall provide through its toll-free customer service network, with minimal transfers and holding, access to knowledgeable, responsive laboratory professionals.

1.17 Contract Start-Up Period

1.17.1 Immediately upon award, there will be a start-up period consisting of a maximum of 30 calendar days. The intent of this start-up period is to enhance coordination between the Government and the Contractor in order to avoid misunderstanding or mistakes on the part of both parties. The Contractor shall provide the necessary personnel required to perform training/orientation with coordination from the COR. During this period, the following shall take place:

• The Government COR's will brief the Contractor as to where to ship their shipping/packaging materials. If needed, the Contractor will make a site visit to the donor center to instruct personnel on labeling, packing and shipping requirements.

• The Contractor shall provide materials and supplies needed for shipment of specimens from COR to Contractor to last for the initial 6-week period.

• The Contractor shall provide each COR with processing and shipping information and their commercial client services manual during the start-up period.

1.18 Safety Requirements

1.18.1 The Contractor shall maintain safety and health standards consistent with the requirements set forth by the Occupational, Health, and Safety Administration (OSHA), and the Center for Disease Control (CDC) and Prevention.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D- Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R- Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.1.7 Each (EA) / Trip: For the purpose of the Courier Services CLIN, one "Each" or "Trip" is defined as a single, authorized, round-trip courier route dispatched to support an away blood drive. The route begins at the Kendrick Memorial Blood Center, proceeds to the designated blood drive location, and returns to the center with collected specimens.

2.2 Acronyms:

AIS Automated Information System APL Approved Products List APL AQL Acceptable Quality Level ARRT Acquisition Requirements Roadmap Tool ATO Authority to Operate B2B Business-2-Business CAC Common Access Card CAP Cloud Access Point

CCEVS Common Criteria Cybersecurity Evaluation and Validation Scheme CDI Covered Defense Information CE Computer Environment CDRL Contract Data Requirement List CIO Chief Information Officer CJCSM Chairman of the Joint Chiefs of Staff Manual CMMC Cybersecurity Maturity Model Certification CMR Contractor Manpower Reporting CNSSI Committee on National Security Systems Instruction CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CSP Cloud Service Provider CSSP Cyber Security Service Provider CUI Controlled Unclassified Information DAD-A Deputy Assistant Director for Acquisition DC3 DoD Cyber Crime Center DD Form 254 Department of Defense Contract Security Requirement List (if applicable) DB Design-Build DBB Design-Bid-Build DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DSAs Data Sharing Agreements DSAA Data Sharing Agreement Application DMZ Demilitarized Zone DoDM Department of Defense Manual DPCLO DHA Privacy and Civil Liberties Office DUA Data Use Agreement eMSM Enhanced Multi-Service Markets EULA End User License Agreement EVM Earned Value Management FAR Federal Acquisition Regulation FCI Federal contract information FE Facilities Enterprise FedRAMP Federal Risk Authorization and Management Program FISMA Federal Information Security Modernization Act FRCS Facility Related Control Systems FSO Facilities Security Officer HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HCA Head of the Contracting Activity

HIT Health Information Technology IGCE Independent Government Cost Estimate IA Information Assurance IO Initial Outfitting I/O In/Out Processing Portal IPv Internet Protocol Version IS Information System ISP Internet Service Provider IT Information Technology ISCM Information Security Continuous Monitoring IV&V Independent Verification & Validation MedCOI Medical Community of Interest MHS Military Health System MIL-STD Military Standard MTFs Military Treatment Facilities NCR National Capitol Region NDA Non-Disclosure Agreement NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OPM Office of Personal Management OSD Office of the Secretary of Defense P-ATO Personal Authorization to Operate P&R Personnel and Readiness PGI Procedures, Guidance and Information PDT Project Delivery Team PHI Protected Health Information PII Personally Identifiable Information PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PMO Program Management Office PoP Period of Performance PP Personal Property PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PSP Personnel Security Program PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan

RFP Request for Proposal RFQ Request for Quotation RMF Risk Management Framework SP Special Publication SPRS Supplier Performance Risk System SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides TOS Terms of Service US United States UFC Unified Facilities Criteria VPN Virtual Private Network XML Extensible Markup Language

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☒ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.2 Facilities: The Government:

☒ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.3 Utilities: The Government:

☒ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.4 Equipment: The Government:

☒ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.5 Materials: The Government:

☐ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ IS providing Materials in support of this contract/task orders. The Government-provided Materials are the actual specimens for testing.

The government will perform specimen collection and provide biologic specimens that have been collected and processed per the Contractor's published pre-analytical requirements, and in accordance with standard quality procedures.

The government will label each sample with a unique unit number and provide the Contractor with test requests, lists, or work documents with required ordering information per the contractor's requirements.

The government will provide donor notification IAW FDA requirements and established DoD policies.

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☒ WILL provide Contractor Furnished Services required in support of this contract/task orders.

The Contractor shall provide a hard copy (electronic copy optional) of its Client Services Manual to the COR at the BDC during the start-up period. Examples of the information to be provided include the following:

• Test specific specimen collection and preservation requirements for each test or analyte.

• Test specific method and interpretation for each test or analyte.

• Test specific method reference ranges, when required.

• Test specific method sensitivity, specificity, and interferences, when required.

• Test specific schedule of performance and average turnaround time for each.

• Result Code

4.1.1 Provide updated information on test methodology changes, (i.e. changes in normal ranges, methods, and reporting units, etc). In the event of any methodology change, written information/instruction shall be provided to the contracting officer and COR within 15 calendar days prior to the Contractor implementing said change. This will allow time for changes in testing algorithms - if needed. Changes to procedures with less than 15 calendar days' notice shall be made only with concurrence by the COR. The COR will notify the contracting officer in the event of noncompliance with this requirement.

4.1.2 PRODUCT INFORMATION. The Contractor shall provide product information on new test(s) offered by the Contractor. Updated information shall be provided to contracting officer and COR once test procedure validation is complete.

4.3 SUPPLIES: If the Contractor requires unique supplies, the Contractor shall provide an initial 6- week stock of materials or supplies to be used by submitting facilities identified in each task order in preparation for shipment of specimens for testing requirements. Supplies required for the initial 6- week period shall be a part of the contract start-up period responsibilities. Government-held stock of Contractor-furnished items shall be routinely replenished by the Contractor to allow performance of all contract requirements without interruption. Maintenance of the stock will be by request from the COR POC to the Contractor. On a case-by-case basis, emergency supplies may be requested by each COR POC and shall be provided by the Contractor as required. The Contractor shall meet with COR within 5 working days after the award of a task order to determine the quantity required for each site. The Contractor shall:

• Furnish materials and supplies necessary to meet the requirements for the provision of services established under the terms of this contract.

• Furnish materials/supplies to submitting facilities to prepare specimens for shipping to the Contractor facility for processing and testing. Some examples of supplies required may include but are not limited to: Shipping and packaging containers for submitting specimens in a manner required for efficient processing at the Contractor's facility. As necessary, test request forms required for the Contractor.

• Furnish written instructions to Government personnel for sample preparation, applying barcode labels, packing samples, preparing paperwork, and shipping or transport of containers.

• Government facilities will utilize unique Barcode labels for identification on each sample transfer tube, or specimen container. The Contractor must be capable of accepting labels in ISBT 128 technology for samples received for testing. The Contractor shall furnish instructions on how to place the barcode labels on each transfer tube or specimen container.

4.4 Facilities

4.4.1 The Contractor shall maintain the necessary facilities to perform services under the terms of this contract. If for any reason the contractor moves operations to another testing location, the contractor will ensure that all provisions within this contract are met with no loss of service to include turn-around times should extended shipping times be required.

4.5 Labor

4.5.1 The Contractor shall maintain necessary labor to perform the services under the terms of this contract.

PART 5

5.0 SPECIFIC TASKS

5.1 Testing:

5.1.1 The Contractor must hold a valid FDA Blood Establishment License and perform the full range of FDA-mandated blood donor testing.

5.1.2 Volume: The Contractor shall process an estimated annual volume of 7,000 whole blood and 500 platelet apheresis or plasma apheresis units from the Kendrick Memorial Blood Center at Fort Gordon, GA.

5.1.3 Initial routine testing, repeat testing, and confirmation testing must follow standard industry practices. Repeat positive results for initially reactive or failed-run samples must be available within 48 hours of specimen receipt.

5.1.4 Any delay in test results must be reported to the blood donor center within 24 hours via telephone, email, or secure fax

5.2 Confirmatory Testing

5.2.1 The Contractor must provide additional confirmatory testing as required by regulatory and service agencies for specimens initially reactive for: Hepatitis B Surface Antigen (HBsAg)Hepatitis B Virus Core (HBV Core)Human T-Lymphotropic Viruses Type I & II (HTLV)Human Immunodeficiency Virus 1 & 2 (HIV 1 & 2)Hepatitis C Virus (HCV)ChagasTreponema Pallidum (Syphilis).

5.2.2 Confirmatory testing results must be delivered to the blood donor center via email or secure fax within 5 to 10 business days.

5.2.3 The center requires approximately 300 confirmatory tests per year

5.2.4 If the FDA issues new testing mandates during the contract period, the Contractor shall implement them within 30 days of issuance.

5.2.5 The Contractor must maintain a daily surge capacity of at least 1,000 samples per day to support unforeseen contingencies or mission upsurges.

5.2.6 The Contractor shall ensure the accurate and timely performance of laboratory testing services in biologic specimens provided by CORs. The quality for all services rendered hereunder shall conform to the highest standards in the clinical pathology and clinical reference laboratory professions as established by accrediting and licensing agencies. Contractor will have a plan, in case of a national emergency (example 9/11), that will ensure no delay or stoppage of service.

5.3 Contractor Laboratory Information System

5.3.1 The Contractor shall provide and maintain a computerized laboratory information and management system for rapid retrieval and printing of laboratory results including elements within the Contractor's laboratory. The Contractor shall maintain the test results in accordance with appropriate regulatory/accrediting agency guidelines.

5.3.2 The Contractor's automation shall provide:

• Test results reporting. Routine test results shall be sent by facsimile and or electronically transmitted to each to the submitting facility, within 24 hours from receipt of samples.

• Any delays in testing due to failed runs, or instrument malfunctions should be reported immediately if delay in testing beyond 24 hours will occur.

• Once corrective actions have been taken or resolved and testing resumed, test results will be made available immediately upon completion of review.

5.4 Handling of Specimen or Request Discrepancies

5.4.1 Specimen loss due to breakage, spillage/leakage, insufficient dry ice, misplacement, mishandling or any other Contractor- related problem(s) shall be reported immediately to the impacted blood donor center upon knowledge or detection of problem. Repeated problems with compromised specimens may be grounds for termination for cause of the contract.

5.4.2 Any specimens that have been broken, leaked, or otherwise compromised during transit shall be immediately reported to the appropriate blood donor center upon unpacking at the contractor's laboratory.

5.4.3 All specimens shall be processed within 24 hours of receipt. Specimen discrepancies or additional specimen requirements shall be brought to the attention of the submitting facility within the 24-hour period.

5.5 Specimen Retention

5.5.1 Specimens shall be stored/retained by the Contractor for at least 7 days after the reporting of the results. In selected cases, and upon request by a site, the Contractor shall store/retain specimens for up to 30 days at no additional cost.

5.6 Referrals to Another Laboratory or Institution

5.6.1 The contractor shall ship specimens to other laboratories as required when referral work is sent by the Government to another institution which may be conducting joint studies or when the specimen is time sensitive. Specimen transport expense for referrals to another laboratory or institution are at no additional cost to the Government.

5.7 Results Reporting

5.7.1 The Contractor shall provide reports of donor testing to the submitting facility within a 24 hour turn-around time from receipt.

5.7.2 Blood donor testing reports meeting CLIA requirements shall be faxed and/or electronically transmitted to each submitting facility for local printing. As a minimum, printed reports shall include:

• The name and address of the contract laboratory where each test was performed.

• The specimen blood donor unit number assigned by the COR.

• The name of the contract Laboratory Director or Medical Director.

• A phone number to contact the contract laboratory concerning the test results.

• The specimen collection date.

• The Contractor's report date and time.

• The test name.

• The test result(s).

• The unit of measurement for quantitative tests.

• The normal or expected range.

• The report status (i.e., final or interim).

• Other interpretive information appropriate for the test(s).

5.7.3 Abnormal results (results outside the reference range), or incomplete testing shall be flagged by some indication on the reports to differentiate them from normal results (results within the reference range). Reports will be released by the Contractor, even if all of the results in each batch have not been completed within the run, with the understanding that when incomplete tests or confirmation tests are completed, reports will be available to the submitting facility. This will allow for unit release and appropriate unit quarantine. It is imperative that the results per batch be released even if some of the tests are incomplete due to mission requirements of the submitting facility to release blood products as quickly as possible after the lot review process which is dependent upon test results. Units with incomplete testing results will be quarantined by the submitting facility, until such completion and release of the results and review by the lot release process.

5.7.4 In cases of malfunction of the Contractor-supplied electronic reporting method lasting more than 24 hours, the Contractor shall, without additional charge, provide express overnight shipping or courier delivery of printed reports to each COR until the automated information system is properly functioning.

5.8 Courier Service Administration

5.8.1 Ordering and Authorization: The Contractor shall provide on-demand courier services to support away blood drives, estimated at approximately 60 trips per year. A "trip" is defined in Section 2.1.7. The Contractor shall not initiate any courier trip without prior authorization (written or electronic) from the COR or a designated Government representative (e.g., Blood Center NCOIC).

5.8.2 Funding and Limitation Notification: The Contractor is responsible for tracking the cumulative number of trips invoiced against the 60 EA annual estimate. The Contractor shall notify the Contracting Officer (KO) and COR in writing when 75% of the authorized quantity (45 trips) has been reached. Performance of any trips beyond the 60 EA ceiling requires prior written approval and modification from the Contracting Officer.

5.8.3 Manifest and Proof of Delivery: To receive payment for a fixed-price trip, the Contractor's monthly invoice must include a detailed manifest. At a minimum, the manifest must document the:

Date and time of dispatch

Name of the authorizing Government official

Pickup location (away blood drive site)

Signature of receipt from the receiving laboratory staff

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is Unclassified but involves the processing of Sensitive but Unclassified (SBU) data, including Personally Identifiable Information (PII) and Protected Health Information (PHI).

6.2 The TIER 1 or TIER 2 levels and position sensitivity designation for positions under this contract is: N/A

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements:

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data.

After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training

6.4.1 Not Applicable

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS:

6.5.1 The contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800- 171), in accordance with DFARS clause 252.204-7012.

6.5.2 NIST SP 800-171 DoD Assessment Methodology. The DFARS provision 252.204-7019 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement. This requirement enables a strategic assessment of a contractor’s implementation of the NIST SP 800-

171 requirements as required in DFARS clause 252.204-7012. The DoD Assessment Methodology requirement flows down to subcontractors.

6.5.2.1 Basic Assessment: The contractor shall obtain and maintain access to the Supplier Performance Risk System (SPRS) via the PIEE, (available via the internet at https://www.sprs.csd.disa.mil/)

6.5.2.1.1 The contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD Assessment Scoring Template, and enter the results electronically in SPRS for each covered contractor information system that is relevant to an offer, contract, task order, or delivery order.

See Attachment 2, Deliverable Schedule Table.

6.5.2.1.2 The contractor shall ensure that applicable subcontractors also have their results of a current assessment posted in SPRS prior to awarding a subcontract or other contractual instrument in accordance with DFARS clause 252.204-7020.

6.5.3 The contractor shall provide the government with access to its facilities, systems, and personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) assessment in accordance with DFARS clause 252.204-7020.

6.5.4 Cybersecurity Maturity Model Certification (CMMC):The CMMC (DFARS clause 252.204-7021) builds upon the NIST SP 800-171 DoD Assessment Methodology by adding a comprehensive and scalable certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level. The CMMC is designed to increase assurance to the DoD that federal contract information (FCI) and DoD Controlled Unclassified Information (CUI) is protected at a level commensurate with the risk.

The CMMC requirement flows down to subcontractors.

6.5.4.1 The contractor shall have a current (i.e., not more than three years old) CMMC certificate in SPRS issued by an accredited CMMC Third Party Assessment Organization (3PAO) at the required CMMC level. The description of CMMC levels is available at https://www.cmmcab.org/.

6.5.5 The contractor shall submit requests to vary from NIST SP 800-171 in writing to the CO or COR, for consideration by the DoD Chief Information Officer (CIO). The contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

6.5.6 If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that…