RFI Attachment 1 MECS_Enterprise Dose Monitoring System.docx

Minimum Essential Characteristics (MECS) Enterprise Dose Monitoring

The contractor shall deliver software and configure it as necessary to establish connectivity throughout the infrastructure. The ultimate service goal is to consolidate site local Dose Monitoring systems to a single enterprise dose monitoring solution to provide standardization across the Defense Health Agency (DHA). This task includes but is not limited to:

i. Implementation at government hosted virtual environment not directly associated with any currently deployed Picture Archiving and Communication System (PACS). This virtual environment will be used for the complete implementation of the solution to include training and Risk Management Framework (RMF) (if no current Authority to Operate (ATO)).

ii. Standardize system configurations throughout the DHA Enterprise

Delivery and configuration of software

· Referring Physician

· Study Common Name

· Studies with Alerts

· Date Range

· Age

· Weight

· Gender (Male/Female only)

· Procedure Code

· Accession Number

· Patient MRN

· Patient Name

· Percentile

· Diagnostic Reference Levels (DRLs)

· Facility/Trust

· Department

· Device

· Dose Type

- Highly desired pregnancy status.

· Accession Number

· Alert Note

· Alert Rule

· Body Part

· Description

· Operator/ radiographer

· Performing Physician

· Modality Type

Additional required Information

20. The contractor shall provide a detailed topography document to include how the enterprise system will be configured and deployed with submission. The document will be updated to reflect any changes during implementation within 7 calendar days prior to Go-Live (Deliverable #1).

21. Must offer/implement the most commercially available software version which has a DHA Enterprise level ATO. The entire solution must be commercially available at time of submission that meets or exceeds the MECs outlined in this document, no future features and functionality of the solution will be considered.

22. The contractor shall include maintenance support for the enterprise software solution over the contract period of 5 years.

23. The contractor must include software updates/upgrades, to include any professional services required. The application version deployed is the current commercially available software version.

24. The contractor shall not make software updates/upgrades without written approval from the PACS Program Management Office (PMO).

25. The contractor shall provide applications training for 100 individuals hosted at the 12 PACS Hubs across the enterprise and the PMO. Training shall be conducted virtually once per PACS Hub with connected sites. One virtual session shall be recorded and saved for future training purposes.

Hub locations are as follows:

i. Tripler Army Medical Center, HI

ii. Brian D. Allgood, Korea

iii. Evans Army Community Hospital, CO

iv. Madigan Army Community Hospital, WA

v. Brooke Army Medical Center, TX

vi. Walter Reed National Military Medical Center, MD

vii. Womack Army Medical Center, NC

viii. Landstuhl Regional Medical Center, Germany

ix. Blanchfield Army Community Hospital, KY

x. Eisenhower Arch Community Medical Center, GA

xi. Portsmouth Naval Medical Center, VA

xii. Naval Medical Center San Deigo, CA

26. The contractor shall assign a Project Manager (PM) and have initial kick off meeting with PACS PMO within 30 calendar days of award. Meeting minutes must be provided by the contractor (Deliverable #2).

27. Kick off meeting with PACS PMO, PACS hubs, connected sites, and network hosting team between 60-90 calendar days of award. (Deliverable #3).

28. The contractor shall deliver a draft project plan at proposal submission and a final project plan within 30 calendar days after award of the contract; and every 30 calendar days until project completion. The project plan shall include detailed implementation information with specific tasks and a timeline for all sites at time of submission. (Deliverable #4).

Project plan shall include the following:

i. The project plan shall include the start of delivery of software within 60 calendar days of award of the contract and installation shall begin within 90 calendar days of award. All sites must Go-live (clinically in use) within 12-months of contract award.

ii. The project plan shall include detailed implementation information that highlights the key deliverables, timelines, and expectations of each party responsible for delivery, configuration, and final acceptance of the systems Comprehensive implementation plan to install all systems, including total number of project managers and implementation team(s) involved.

iii. Detailed steps and task owners for implementation as well as expected completion time for each task.

iv. Proposed timeline for production Go-live for all implementations. “Go-live” date is met by full clinical usage of the system with fulfillment of migration requirements related to Go-live with no reliance on the legacy system.

29. The contractor shall host weekly status meetings with the Government representatives; contractor shall provide meeting agenda 24 hours prior to meeting and provide meeting minutes within 48 hours of the meeting conclusion. Meeting minutes will be provided in PDF format. (Deliverable #5).

30. The contractor can propose a Virtual Environment Host for testing if desired.

31. The contractor shall validate functionality of software in accordance with RMF accreditation documentation. RMF/ATO must continually be updated to meet the requirement of MEC number 4.

32. The contractor shall validate RMF Security Technical Implementation Guides (STIG) requirements and scan for vulnerabilities with DoD provided Nessus vulnerability scan software monthly.

33. The contractor shall resolve or mitigate all Critical and High vulnerabilities and most moderate vulnerabilities.

34. The contractor shall, upon site installation, validate configuration is fully operational. Once contractor confirms, official notification must be submitted to the Contracting Officer Representative (COR). Within 45 calendar days of configuration validation, DHA will perform acceptance testing (AT). If the solution has zero discrepancies during AT, warranty will start on the day the official notification was made to the COR. If discrepancies are noted, warranty will start once the items are addressed by the vendor and confirmed by the government.

35. The contractor shall maintain an ATO on all product versions owned by the DHA and originally purchased through the awarded contract. If a contractor cannot support the ATO for all DHA owned versions of the product, the contractor can meet this requirement by offering to provide all upgrades to the product that are required to maintain the ATO for 5-years in accordance with the contractual period of performance or as long as mutually agreed to by both parties. Contractors who cannot support all versions of the product and cannot offer upgrades required to maintain the ATO for 5-years shall not be considered. Maintaining the RMF ATO shall be included as part of the contractor’s warranty period. (Deliverable #6).

36. If the patches are separate from updates as required by the service agreement, the contractor shall offer the cybersecurity patches under a maintenance offering that provides for all required cybersecurity patches/updates needed to maintain the ATO.

37. The contractor shall agree to the DHA Cybersecurity requirements for all upgrades. Although there is an exception to cybersecurity policy process for upgrades similar to maintenance, the DHA does not envision granting exceptions to cybersecurity policy and would instead replace the software in lieu of approving upgrades that do not comply with cybersecurity policy.

38. The contractor shall ensure that personnel accessing information systems have the proper and current Information Assurance (IA) certification to perform IA functions at contract award in accordance with DoD 8140.03–M, IA Workforce Improvement Program. The contractor shall meet the applicable IA certification requirements as outlined in DFARS 252.239-7001.

39. The contractor shall have DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8140.03–M.

40. The contractor shall have appropriate operating system certification for IA technical positions as required by DoD 8140.03–M.

41. Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions. Contractor personnel who do not have proper and current certifications shall be denied access to DOW Information Systems for the purpose of performing IA functions.

42. All contractor employees that require access to DHA Information Technology (IT) must comply with the requirements of the DHA-Procedural Instruction 8140.01, Acceptable Use of the DHA IT, to include those contract employees with privileged access.

43. The contractor shall provide vulnerability scan and Security Content Automation Protocol (SCAP) scan results to DHA cybersecurity POC on a monthly basis. Contractor shall provide raw scan results and administrative reports, 30 calendar days after contract award and by the 10th of each month thereafter. (Deliverable #7).

44. The contractor shall submit a drawing for/from RMF/ATO package to clearly demonstrate any 3rd party vendors being quoted are within the vendors boundary. Initial drawing shall be submitted with their proposal and will be updated as required for RMF Certification and Accreditation to achieve ATO. (Deliverable #8).

45. Business-to-Business (B2B) remote connection cannot be guaranteed. At times the B2B may not be available due to a variety of issues. If this happens, the contractor is still responsible to implement, and to maintain the up time of the system. If needed, the contractor shall send someone to the site to address any issue if progress is not shown within 48 hours. Contractor shall include costs for onsite installation and maintenance in the event B2B connection is not available or is not approved for a connection. The absence or lack of remote connectivity shall not delay implementation of system or configuration.

46. The DHA will determine the need to perform AT at a single PACS hub or multiple hubs as the implementation progresses. AT will be performed by Subject Matter Experts from the DHA PMO.

MILESTONE PERFORMANCE SCHEDULE

Dose Monitoring System

Month Kick Off Meeting with DHA PMO and vendor, project plan presented and agreed to by Govt and vendor.

Month 2 - 3 Kick Off meeting with PACS hubs, Network hosting team and software/licenses delivered

Month 4-9 Implementation and configuration of software PACS desktop integration configuration

Month Configuration and integration testing with Super Users and DHA PMO

Month System Administrator and User applications training

Month System Go-live and DHA AT and validation

Deliverables Schedule

Deliverable #2:

Contractor shall assign a Project Manager (PM) and conduct initial kickoff meeting with PMO.

Deliverable #3:

Kick off meeting with PACS PMO, PACS hubs, connected sites, and network hosting team

Deliverable #5:

Weekly status meetings

Deliverable #6:

Maintaining ATO

Deliverable #7:

Vulnerability and SCAP scan results

Deliverable #8:

Artifacts and Documentation required for RMF Certification and Accreditation