PWS.docx

Department of Defense Defense Health Agency – Performance Work Statement –

MEDICAL EMERGENCY DISPATCH SUPPORT FOR WALTER REED NATIONAL MILITARY MEDICAL

CENTER, BETHESDA, MD

Solicitation Number:N/A Version: N/A Date: N/A

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide medical emergency dispatch support services for the Medical Center Emergency Dispatch and Communications Center for Walter Reed Military Medical Center (WRNMMC) in Bethesda, MD.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform medical emergency dispatch support services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this performance work statement.

1.3 Background: Walter Reed National Military Medical Center has a requirement for medical emergency dispatch support services for the Medical Center Emergency Dispatch and Communications Center for Walter Reed Military Medical Center (WRNMMC) in Bethesda, MD. All of the contractor employees will be performing non-personal services.

1.4 Objectives:

a. The purpose of this contract is to provide 24/7 operator coverage for the Medical Center Emergency Dispatch and Communication Center for Walter Reed National Military Medical Center (WRNMMC) in Bethesda, MD. This work will require a knowledge of facility layout, emergency procedures, strategies and operations. Work is spot checked and evaluated through observance of performance during emergency situations and review of work performed by government employees.

b. Incumbent must act independently and spontaneously in receiving, passing on, activation of emergency services/codes, and relaying messages to the appropriate authorities within the National Capital Region (NCR). Works under the general supervision of the Dispatch Center Supervisor or may receive work direction from existing shift leaders. Work priorities and general objectives are provided by "in charge" personnel at the beginning of the work period.

c. Independently determines work required, plans, and completes assignments and adjusts work based on emergency situation at hand.

d. Seeks assistance and/or discusses problems which do not conform to policies, procedures, and regulations which will significantly affect their individual work period assignment, or which should be referred to "in charge" personnel. Work is reviewed based upon end-of- shift reports and occasional input from others for general adequacy and timeliness. Knowledge of installation code procedures, special facilities, and 911 center operations is required.

1.5 Scope:

DHA PWS Template V9 June 29, 2020

a. The contractor will perform a full range of operating functions associated with different and unrelated processes, methods, and duties concerning the use of computerized communications equipment and peripheral equipment, receiving, understanding, and relaying information about emergency situations involving illness, accidents or other all- hazards where loss of life or property is possible.

b. The contractor will receive notice of an emergency situation (often involving the possible loss of life), give instructions or assistance, and relay emergency information by monitoring and operating equipment and devices in the communications center. The work affects the timely receipt, understanding, and dispatch of emergency services in situations involving illness, accidents, fire, or other emergency situations that may involve the loss of life or property.

c. The contractor will follow guidelines that established WRNMMC Emergency Code responses, Standard Operating Procedures (SOP) and guidelines consisting of operating and technical manuals which relate to computer, communications, and related equipment.

d. The work is sedentary. However, there is some standing, walking, bending, and stooping in checking problem conditions in the equipment, and occasional lifting of items such as computer paper and office supplies.

e. Primary Hours of Operation for WRNMMC 0730 - 1600

1.5.1 Contractor shall only invoice for hours worked.

1.6 Period of Performance (PoP): 08/1/2022 – 07/31/23

1.6.1 Transition: The contractor shall comply with transition-out requirements of the DHA for contractors who have been issued a CAC or who generate “records”, as defined by DOD (records manual), including DoD- directed disposition of records, and others displayed on the In/Out (I/O) Processing Portal.

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at Walter Reed National Military Medical Center (WRNMMC), which is located approximately 1 mile west of the Capital Beltway in Bethesda, MD.

1.7.2 Recognized Federal holidays: The contractor will be required to perform services on the following holidays:

1.7.3 Hours of operation: The contractor is responsible for conducting operations 24 hours per day, 7 days per week, 365 days per year. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

1.7.4 Conduct: Contractor personnel shall adhere to standards of conduct as established by the DHA Director.

1.8 Contractor travel: Reserved.

1.9 Other Direct Costs (ODC): Reserved.

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s quality control program is the means by which the work complies with stated requirements. After acceptance of the Quality Control Plan Quality Control Plan (QCP) the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. See Part 7, Technical Exhibit 1 - CDRL A001.

1.10.2 Quality assurance: The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel

1.11.1 CAC requirements: For all contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD contractor personnel.

1.11.1.1 The contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training. The contractor shall complete all requirements, training, and forms per the following DHA instructions:

1.11.2.1 The DHA’s Onboarding Checklist for Contractor Employees is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s Contractor training instructions embedded at Part 7 Section 7.1.2. (Government (DHA) requirements development staff must cut/paste onboarding checklist at https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf and embed most up-to-date form in Part 7, Section 7.1.2.)

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at: https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.2.4 The DHA’s new employee handbook at Part 7 Section 7.1.4.

1.11.3 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4 Key control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the CO.

1.11.4.1 In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.11.4.2 The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the CO.

1.11.5 Lock combinations: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s QCP.

1.11.6 Contractor employees working under this contract shall be paid only for hours actually worked at the hourly rates established in the contract. Subsequently the Contractor shall only bill and be paid for hours actually worked. Contractor employees shall have a one hour or 30 minute unpaid lunch period. Payment to the Contractor will not be made for temporary work stoppage due to circumstances beyond the control of the Medical Treatment Facility, such as acts of god, inclement weather, power outages, or temporary closing of facilities.

1.12 Key personnel (Contractor): Reserved.

1.13 Data rights: Reserved.

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): Reserved.

1.14.2 Non-Disclosure Agreement (NDA): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA Contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The Contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notifies both the CO and Contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system (If applicable, if not delete 1.16.1 and 1.16.2 and replace to 1.16 Reserved). Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The Contractor shall be prepared for this process as it could take two (2) or more weeks. The Facilities Security Officer/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17. Personnel Security

1.17.1 The contractor shall comply with

DoD 8570.01-M, “Information Assurance Workforce Improvement Program,” December 19, 2005 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs”, DoDI 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” dated April 3, 2017. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 681-6777.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office will deny any access to any automated information system (AIS), network, or CUI if a contractor receives an unfavorable adjudication, or if information that would result in an unfavorable adjudication becomes available.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D- Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R- Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the contracting officer to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the quality assurance surveillance plan or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc. Reserved.

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

· Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Government Furnished Services required in support of this contract/task orders. These Services are described below: provide

3.1.1 Government Training / Orientation - In addition to the specified courses listed below, Contractor employees are required to attend or complete on-line any Department of Defense, Army, or Federal Government directed courses. Contractor employees are required to participate in all mandatory training.

3.1.2 Staff Orientation: New Employee. Contract employees shall participate in all staff orientation and/or training. Contract employees may need to attend a government sponsored initial orientation to familiarize them with policies and procedures.

3.1.3 Annual Training Updates. Contractor employees may be required to complete internal annual training.

3.1.4 Antiterrorism (AT) Training Level I. All Contract Service Providers (CSPs), to include subcontractor CSPs, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 90 calendar days after contract start date. The contractor shall submit certificates of completion for each affected CSP and subcontractor CSP, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all CSPs and subcontractor CSP. AT Level I awareness training is available at the following website: https://atlevell.dtic.mil/at.

3.1.5 HIPAA Privacy and Security Training: Contract employees will be required to complete on-line web-based training modules within the first 30 days of performance.

3.2 Facilities: The Government:

· Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Facilities in support of this contract/task orders. The Government provided Facilities are described below:

3.2.1 The Government will provide the use of available DHA facilities and support services, desks, materials, publications and forms, and equipment required for contract performance (except as designated). Contractor shall keep Government furnished supplies, equipment and work areas in a safe, orderly and clean condition. Contractor shall notify the Government whenever maintenance of equipment is required. Contractor shall abide by all requirements for physical security of property and equipment.

3.2.2 Space used by Contractor in performance of services may be used for other purposes during their absence. Items of clothing, personal effects, or equipment cannot be secured during their absence. The Government will not incur any liability for theft, damage to, or loss of such personal items.

3.3 Utilities: The Government:

· Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Utilities in support of this contract/task orders. The Government provided Utilities are described below:

3.3.1 The Government will provide all utilities available in the facility. The Contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

3.4 Equipment: The Government:

· Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below:

3.4.1 Telephones, facsimile machines, copiers and computer equipment are authorized for transaction of official Government business only and shall not be used for personal business. Personal long distance calls are not authorized and the cost of all personal long distance calls made may be deducted from the Contractor’s invoice payments. Telephones, facsimile machines and computer equipment are subject to communications security monitoring at all times.

3.4.2 Space used by Contractor employees in performance of services may be used for other purposes during their absence. Items of clothing, personal effects, or equipment cannot be secured during their absence. The Government will not incur any liability for theft, damage to, or loss of such personal items.

3.4.3 Contractor employees may be issued keys. The Contractor shall safeguard the keys from loss, theft or destruction, and must display all keys signed for at scheduled or unscheduled key control inspections. The Contractor shall be required to reimburse the Government for lost keys, or lockset (if locksets are required to be replaced) as a result of lost keys. The cost of replacement of keys/locksets may be deducted from payments to the Contractor.

3.4.4 Pagers. If pagers are issued, the Contractor shall safeguard the pagers from loss, theft or destruction, and must display the pager for a scheduled or unscheduled control inspection. The Contractor shall be required to reimburse the Government for lost pagers. The cost of replacement of pagers may be deducted from payments to the Contractor.

3.4.5 Items issued will remain the property of the Government and will not be removed from the work site. They are to be used, turned in, or disposed of as directed.

3.4.7 Emergency Healthcare. The MTF will provide emergency healthcare for injuries occurring while on duty. The Contractor shall reimburse the Government for such services.

3.5 Materials: Reserved.

· Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below: Standard Operating Procedures and Policies.

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

4.2 Secret Facility Clearance: Reserved.

4.3 Materials:

4.3.1 The Contractor shall submit reports to the COR and/or the Contracting Officer as requested for use in monitoring Contractor performance. Such reports may include, but are not limited to, equipment inventory and maintenance reports, current license status, initial and/or monthly/annually immunizations, contract employee status.

4.3.2 Point of Contact. Three (3) calendar days prior to performance of services, the Contractor shall designate, in writing, and provide to the Contracting Officer's Representative [COR] and Contracting Officer, the name, email address, and telephone number of the point of contact for all actions on this requirement.

4.3.3 Certificates/licenses/training shall be maintained in a current status at all times while performing services under this contract. If at any time during the contract the Contractor does not renew any of the required certifications/licenses prior to the expiration date, he/she will not be allowed to work at a Military Treatment Facility, Hospital, or Clinic. This expense shall be borne by the Contractor and will not excuse the Contractor from fulfilling the requirements under this contract.

4.4 Equipment: Reserved.

4.5 Facilities: Reserved.

PART 5

5.0 SPECIFIC TASKS

All contract employees provided by the contractor shall meet the qualifications for that specialty and perform essentially the same functions, within the scope of acceptable for their technical professional discipline and standard, as those required by DOD or government service technical professionals of similar experience and in similar duty assignments. Contract employee practices/productivity will be compared to that of other Contract employees assigned to the same medical center.

The Government has the right to test the contract employee the first day of the contract and any time during contract performance to determine whether the contract employee can perform all contract-required skills. If the contract employee cannot perform all those skills, the Government activity may request that the contract employee be replaced with a contract employee that can perform all the contract-required skills.

5.1 Medical Emergency Dispatcher: The contractor shall provide uninterrupted 24 hours per day, 7 days per week, 365 days per year operator coverage for the Medical Center Emergency Dispatch and Communication Center for Walter Reed National Military Medical Center (WRNMMC) in Bethesda, MD. FTEs are based on the Governments of two dispatchers during each eight hour shift.

5.1.1 Duties and Responsibilities:

a. Provides emergency communication reception and dispatching services. Determines the nature of the emergency in accordance with established guidelines.

b. Determines the response and services to be rendered based upon the emergency call received and dispatches the correct emergency team based upon the information received.

c. Maintains constant liaison with the scene of the emergency to include; fire officials, police, Command Duty Officer, and any other unit control centers involved with the emergency until official termination of the incident.

d. During periods of multiple emergencies, uses independent judgment to determine which calls need immediate attention. Additionally, prioritizes multiple emergency and non- emergency calls to determine appropriate response levels based on the needs of the caller.

e. Monitors various emergency radios including police, fire, and mutual aid frequencies.

f. Provides information to senior officials as requested. Conducts follow-up inquiries to track action being taken within the hospital.

g. Coordinates with military and civilian agencies in response to aid requests in accordance with locally established protocols.

h. Conducts daily pager tests at required intervals, ensuring proper response times. In the event a pager is not functional, will coordinate with the duty provider and Information Technology Department to repair or replace telecommunication equipment.

i. Maintains an activity log of all significant daily events, emergencies, processes, or notifications received through the communication center. Maintains an electronic daily activity log of all activities according to locally established protocols. Takes necessary measures to ensure information contained in each data entry is accurate and provides a clear picture of emergency and daily activities of the dispatch center.

j. Maintains maps, checklists, online data logs, and charts. Maintains checklists and is fully proficient in the use of these checklists during emergency operations.

k. Provides input to the supervisor regarding maintenance and updating of checklists. Maintains on and off base maps and other visual aids frequently utilized as quick information references for responding emergency personnel.

l. Operates and maintains telephones, radios, automated data processing equipment, printers, and other devices installed in the dispatch center. Monitors radio and telephone communications with police, fire, and hospital units during emergencies. Refers non- emergency callers to appropriate agencies as needed.

m. Receives, relays, and transfers phone calls and documents messages. Operates Hospital Code Alarm system. Receives and processes all significant information received in accordance with established protocols. Operates WRNMMC paging system to make announcements.

n. Prepares and maintains reports and records relating to emergency responses. Prepares an incident report for the locally utilized database management system, using correct codes and categories in the preparation of the report in accordance with locally established guidelines. Provides statistical data to supervisors. Compiles, collates, and verifies emergency and non-emergency response data generated by or processed through the communications center and enters appropriate information into the local reporting systems.

5.2 Special Qualifications:

a. Knowledge of standardized computer operations.

b. Knowledge of the logs, reports, and filing procedures to perform necessary operator logging and documentation.

c. Knowledge and skill to coordinate the work of the E-911 center with installation-wide emergency services and other offices having a relationship.

d. Knowledge of basic emergency medical techniques and procedures sufficient to relay appropriate information to callers and emergency response teams.

e. Ability to analyze information given over the telephone in emergency situations.

f. Ability to communicate and interact orally with a variety of individuals in emergency situations.

g. Require a High school diploma, College education preferred.

h. Plus, one (1) year of responsible work experience as an emergency or non-emergency dispatcher/call center operator, public safety officer, security, military or healthcare services, or relevant work experience using a two-way radio.

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified.

6.2 The Automated Data Processing/Information Technology (ADP/IT) levels and position sensitivity designation for positions under this contract is:

6.2.1 ADP/IT II: Non-critical sensitive position

6.3 PII/PHI, and Federal information requirements (refer to Clause Section for DHA Procedures, Guidance and Information 224.90 if applicable).

6.4 Training:

6.4.1 Contractor employees performing cybersecurity / cyberspace functions shall comply with the following requirements:

6.4.1.1 Training: All contractor and associated subcontractor employees working Cybersecurity (Information Assurance (IA))/Cyberspace functions must comply with DoD training requirements in Department of Defense Directive (DoDD) 8140.01 and DoD 8570.01-M.

6.4.1.2 Certification: The Contractor shall ensure that personnel accessing information systems have the proper and current IA certification to perform IA functions in accordance with DoD 8570.01–M, IA Workforce Improvement Program. The Contractor shall meet the applicable IA certification requirements, including:

6.4.1.2.1 DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

6.4.1.2.2 Appropriate operating system certification for IA technical positions as required by DoD 8570.01–M.

6.4.1.2.2.1 Upon request by the Government, the Contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

6.4.1.2.2.2 Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing IA functions.

6.4.2 User requirements: All contractor employees that require access to Defense Health Agency Information Technology (DHA IT) must comply with the requirements of DHA-PI 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

6.5 General cybersecurity requirements – Information Systems: This section 6.5 through

6.5.12 is applicable only for those acquisitions where DHA will transmit Covered Defense Information (CDI) for action on a contractor’s IS system. The covered contractor information system shall be subject to the security requirements in DHA AI 042, “Security of Unclassified DoD Information on non-TMA Information Systems”, DoDI 8582.01, “Security of Unclassified DoD Information on non-DoD Information Systems”, and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-171) in effect at the time the solicitation is issued or as authorized by the Contracting Officer. (User will need to include all cybersecurity requirements if applicable. See DHA-IPM 18-015 https://health.mil/Reference- Center/Policies?page=4#pagingAnchor Cybersecurity Program Management).

6.5.1 The contractor shall self-certify that the information system is compliant with the applicable NIST security controls annually by submission of a Security Assessment Report (SAR) and security test plan for compliance of testing security controls.

6.5.2 The Contractor shall implement NIST SP 800-171, prior to the award of the contract.

6.5.3 The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer, for consideration by the DoD Chief Information Officer (CIO). The Contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

6.5.4 If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.

6.5.5 If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline(https://www.fedramp.gov/) and that the cloud service provider complies with requirements in paragraphs 6.5.6 through 6.5.10 for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

6.5.6 Cyber Incident Reporting Requirement:

6.5.6.1 When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall:

6.5.6.1.1 Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support; and

6.5.6.1.2 Rapidly report cyber incidents to DoD at https://dibnet.dod.mil/portal/intranet/

6.5.6.2 Cyber incident report. The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements at https://dibnet.dod.mil/portal/intranet/.

6.5.6.3 Medium assurance certificate requirement. In order to report cyber incidents in accordance with this clause, the Contractor or subcontractor shall have or acquire a DoD- approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see https://public.cyber.mil

6.5.7 Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DoD Cyber Crime Center (DC3) in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

6.5.8 Media preservation and protection. When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

6.5.9 Access to additional information or equipment necessary for forensic analysis. Upon request by DoD, the Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

6.5.10 Cyber incident damage assessment activities. If DoD elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

6.5.11 (Applicable if hosting DoD information in a non-DoD Information System) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., HIPAA) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan. The vendor must make the system security plan within 5 business days upon the CO request.

6.5.12 The Contractor shall maintain within the United States or US territories all Government data that is not physically located on DoD premises, unless the Contractor receives written notification from the Contracting Officer to use another location, in accordance with DFARS 239.7602-2(a).

6.6 Risk Management Framework (RMF) for DoD IT: All Information Systems (IS), Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DoD Instruction (DoDI) 8510.01, RMF for DoD IT and comply with annual Federal Information Security Management Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

6.6.1 All systems subject to RMF must present evidence of authorization in the System Security Plan (SSP), SAR Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD Component PIT system accreditation decision that is current within 3 years within 5 business days of CO request. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) by contract award.

6.6.2 The contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 RMF.

6.6.3 The contractor shall configure the information system in accordance with Defense Information System Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).

6.6.4 The contractor shall ensure that the information system conforms to the requirements of DoDI 8551.01 “Ports, Protocols, and Services Management (PPSM)”.

6.6.5 The contractor shall ensure that the information system shall authenticate all entities as specified in DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access.

6.6.6 The contractor shall Public Key enable the information system, implementing digital signature and encryption requirements specified in DoDI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling.”

6.6.7 The contractor will be responsible for compliance with the United States Cyber Command issuances and IA Vulnerability Management (IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

6.6.8 The contractor shall support reciprocity, by providing all NIST security documents directed information to the government.

6.6.9 The contractor shall implement system level protection and detection capabilities that are consistent with their contract for NIST Security requirements that meet DoD and DHA Cybersecurity Architectures.

6.6.10 Cyber Incident Reporting Requirement: The contractor shall comply with the incident management requirements of Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, “Cyber Incident Handling Program”.

6.6.11 Information security continuous monitoring (ISCM). ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all IS and PIT systems under this requirement in accordance with NIST SP 800- 137.

6.7 Commercial Cloud Computing Services: Reserved.

PART 7

7.0 ATTACHMENTS/TECHNICAL EXHIBIT LISTING

7.1 The following forms are to be completed by the FSO/Security POC, or COR once the contractor is granted the proper background investigation.

7.1.1 Documents will be provided to companies that provide a proposal for this requirement.

PART 7, ATTACHMENT 1 PERFORMANCE REQUIREMENTS SUMMARY

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective (The Service required—usually a shall statement from Part 5)

Performance Requirements Summary (PRS) # 1.

The contractor shall provide a designate a point of contact prior to start date of the contract

PRS # 2

Maintain professional licenses, certifications

contract Credentials records submitted to COR

PRS # 3

Complete any mandatory annual medical/government required training