PWS Viewpoint Software _ Draft.pdf

PERFORMANCE WORK STATEMENT (REVISED)

OB/GYN SOFTWARE LICENSE AND MAINTENANCE SERVICES

LANDSTUHL REGIONAL MEDICAL CENTER (LRMC)

TABLE OF CONTENTS

SECTION TITLE

C-1 General/Scope of Work

C-2 Definitions & Acronyms

C-3 Government Furnished Items

C-4 Contractor Furnished Items/Services

C-5 Specific Tasks

C-6 Personally Identifiable Information, Protected Health Information, and Federal Information Requirements

C-7 Exclusion from Participation in Federal Health Care Programs

SECTION C-1: GENERAL/SCOPE OF WORK

1.1. GENERAL: The contractor shall provide a software license, maintenance, and technical support services for an "OB/GYN comprehensive patient and exam data, results and images-all in one view" software solution. The purpose is to ensure the optimum operation, availability, and efficiency of the system.

1.2. SUPPORT AVAILABILITY: The contractor shall provide remote system maintenance and support. Unlimited troubleshooting and technical support shall be available via telephone and email 24 hours a day, 7 days a week, 365 days a year, including all local national and U.S. holidays.

SECTION C-2: DEFINITIONS & ACRONYMS

2.1. DEFINITIONS:

• CONTRACTING OFFICER (KO): A person with the authority to enter into, administer and/or terminate contracts and make related determinations and findings.

• CONTRACTING OFFICER'S REPRESENTATIVE (COR): A government employee designated in writing by the Contracting Officer to act as his/her representative in administering a contract.

2.2. ACRONYMS/ABBREVIATIONS:

• AR: Army Regulation

• CLIN: Contract Line Item Number

• COR: Contracting Officer's Representative

• DA: Department of the Army

• DoD: Department of Defense

• FAR: Federal Acquisition Regulation

• KO: Contracting Officer

SECTION C-3: GOVERNMENT-FURNISHED FACILITIES, EQUIPMENT, MATERIAL AND

SERVICES

3.1. GENERAL: No facilities, equipment, materials, or services will be provided by the Government under this contract.

SECTION C-4: CONTRACTOR FURNISHED SUPPLIES/SERVICES

4.1. The contractor shall furnish all software, services, and deliverables as specified in Section C-5.

SECTION C-5: SPECIFIC TASKS

5.1. SOFTWARE LICENSE & MAINTENANCE: The Contractor shall provide the software license and all services necessary to ensure the "OB/GYN comprehensive patient and exam data, results and images-all in one view" application service is properly maintained for optimal operation and efficiency.

5.2. The software shall be a scalable ultrasound IT solution, featuring easy access to patients' medical and exam information in a single location.

5.3. The software shall enable recording, workflow view, and archiving of all documents, obstetrics and gynecology exams, exam results, and images.

5.4. The Contractor shall keep the licensed software in optimal operating condition, meeting all published requirements and manufacturer standard specifications through regular updates and patches.

5.5. The Contractor shall provide unlimited remote troubleshooting and telephonic support, available 24/7/365. Support must be available in the English language.

5.6. DELIVERABLES: The Contractor shall provide copies of the software license and all subsequent software updates. Digital copies shall be sent to the following two addresses:

* Landstuhl Regional Medical Center (LRMC), Information Management Division, Bldg.

3703, Dr. Hitzelberger Strasse, 66949 Landstuhl, Germany

* Landstuhl Regional Medical Center (LRMC), OB/GYN, Bldg. 3763, Attn: NCOIC, Dr.

Hitzelberger Strasse, 66949 Landstuhl, Germany

5.7. All supplied software shall be certified free of damaging properties such as viruses, Trojan horses, or worms. A statement of certification shall be submitted to the LRMC Information Management Division prior to software and updates installation.

5.8. The Contractor shall correct any reported software problem that prevents the application from working correctly within 24 hours after the problem was reported.

5.9. The Contractor shall provide a communication protocol for the submission of services requests, to include phone numbers, email addresses, and internet sites, to the COR within 10 days of contract award.

5.10. SOFTWARE CAPABILITIES & UPGRADES:

* Product Upgrades: The Contractor shall provide automatic delivery of the latest software version upgrades as they become commercially available within the subscription period.

* Product Updates: The Contractor shall provide all inline release updates as they become available.

* Patch Notification: The Contractor shall provide immediate email notification of product patches and verify successful installment.

* System Compatibility: The software shall be compatible with "Microsoft’s Windows 11" Operating System (OS) and/or "Certified for Windows Server 2019 or 2022" at the time of delivery.

* Integration: The software maintenance shall ensure continued integration between network computers and all scopes, including high-definition models.

* Functionality: The software maintenance shall ensure the continued ability to capture and manipulate OB/GYN images and video, and to produce and store procedure reports as an electronic medical record.

* Interoperability: The software maintenance shall ensure the ability to work with pre-existing proprietary Viewpoint software from GE Healthcare.

SECTION C-6: PERSONALLY IDENTIFIABLE INFORMATION, PROTECTED HEALTH

INFORMATION, AND FEDERAL INFORMATION REQUIREMENTS

6.1. General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws: This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract.

6.2. Records Management: When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management.

6.3. Freedom of Information Act (FOIA): The Contractor shall comply with established procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action.

6.4. Systems of Records: In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier.

6.5. Privacy Impact Assessment (PIA): Contractors are not required to submit PIAs to

DHA.

6.6. Data Sharing Agreement (DSA):

6.6.1. The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

6.6.2. If contract requirements may include human subject research, this Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004.

6.7. Privacy Act and HIPAA Training: The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act and HIPAA. The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the COR within 30 days of being assigned and annually thereafter.

6.8. HIPAA Business Associate Provisions:

6.8.1. Business Associate – General Provisions: The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules. This paragraph 6.8 serves as the required Business Associate Agreement (BAA).

6.8.2. Permitted Uses and Disclosures: The Contractor may only use or disclose PHI as necessary to perform the services set forth in this Contract or as required by law.

6.8.3. Specific Use and Disclosure Provisions: The Contractor may use PHI for the proper management and administration of the Contractor or to carry out its legal responsibilities, under specific conditions outlined in regulation.

6.8.4. Contractor Compliance with DHA Notices and Restrictions: The Contractor shall comply with any changes in or revocation of permission by an individual to use or disclose his or her PHI.

6.8.5. Permissible Requests by DHA: The Government will not request the Contractor to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by the Government.

6.8.6. Termination: Noncompliance by the Contractor with any requirement in these HIPAA Business Associate Provisions may subject the Contractor to termination. Upon termination, the Contractor shall return or destroy all PHI, unless determined to be infeasible.

6.8.7. Miscellaneous: The obligations of the Contractor under this section shall survive the termination of this Contract.

6.9. Breach Response:

6.9.1. Definitions Related to Breach Response: This section defines "Breach," "possible breach," "confirmed breach," "HIPAA breach," and "cybersecurity incident."

6.9.2. General: The Contractor shall implement breach response requirements immediately upon discovery of a possible breach.

6.9.3. Reporting Provisions: Immediately upon discovery, the contractor shall initiate an investigation. Confirmed cybersecurity incidents shall be reported to US-CERT within 1 hour. All breaches (possible or confirmed) shall be reported to the DHA Privacy Office within 24 hours of discovery using DD Form 2959.

6.9.4. Individual Notification Provisions: If the DHA Privacy Office determines that individual notification is required, the Contractor shall provide written notification to beneficiaries affected by the breach no later than 10 working days after the breach is discovered and identities are ascertained.

6.9.5. The Contractor shall, at no cost to the government, bear any costs associated with a breach of PII/PHI that the Contractor has caused or is otherwise responsible for addressing.

SECTION C-7: EXCLUSION FROM PARTICIPATION IN FEDERAL HEALTH CARE

PROGRAMS

7.1. The Contractor shall not employ or contract with any individual or entity to provide items or services if such person is listed on the HHS OIG List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List (the "Lists").

7.2. Prior to start of contract performance, the Contractor shall query the Lists and certify to the Contracting Officer that no such names appear on either of the Lists.

7.3. During performance of the contract, the Contractor shall query the Lists for any new persons providing services and certify to the Contracting Officer that their names do not appear on the Lists.

7.4. The Contractor is advised that MTF personnel will perform recurrent rechecks of the names of contractor personnel.

7.5. Should any person providing items or services under the contract appear on either of the Lists, the Contractor shall notify the Contracting Officer and promptly remove that person from the contract.

7.6. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract.

7.7. The Contractor is advised that steep civil monetary penalties are associated with billing the Government for items or services provided by a person on either of the Lists.

7.8. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information.