FedBid_RFP-18-180.pdf

A. This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued.

B. The Great Plains Area Indian Health Service (IHS) intends to award a Firm-Fixed Price, Non-Personal Service Type, Commercial Item, Purchase Order in response to Request for Proposal (RFP) RFP-18-180.

C. This solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-100.

D. This RFP is issued as 100% ISBEE and the associated NAICS Code is 541512, which has a small business standard of $27.5.

E. The unit pricing must be all inclusive (to include but not be limited to travel, lodging, per diem, fringe benefits, federal, state and local taxes) plus all other costs pertinent to the performance of this contract. Utilize your most competitive and reasonable rates.

Price Schedule

1. Vendor Neutral Archive for Multiple Medical Imaging Picture Archiving and Communications System (PACS): 1

EA @ $ _______

2. Professional Services (Installation, Configuration, Image Migration, etc.): $ _

3. Totaling $ ___

F. To provide a 'turn-key' vendor neutral archive solution to provide off-site redundant storage and disaster recovery/backup for eleven (11) separate PACS located throughout the Great Plains Area Indian Health Service (GPAIHS), Aberdeen, South Dakota.

G. Services will be provided at either the GPA Area Office in Aberdeen, South Dakota or the GPA IT Office in Sioux Falls, South Dakota. The exact location will be determined following award.

H. The period of performance will be Date of Award through One (1) Year.

I. FAR 52.212-1 Instructions to Offerors-Commercial Items (January 2017).

Proposals shall be submitted on company letterhead stationery, signed, dated and it shall include:

1. Solicitation number RFP-18-180.

2. Closing Date: September 25, 2018 at 12:00 pm CST

3. Name, address and telephone number of company and email address of contact person.

4. Technical description of the item/service being offered in sufficient detail to evaluate compliance with the requirements of the solicitation. This may include product literature, or other documents, if necessary.

5. Terms of any express warranty

6. Price and any discount terms

7. "Remit to" address, if different than mailing address.

8. A completed copy of the representations and certifications at FAR 52.212-3 (see FAR 52.212-3(b) for those representations and certifications that the offeror shall complete electronically).

9. Acknowledgment of Solicitation Amendments (if any issued)

10. Past performance information, when included as an evaluation factor, to include recent and relevant contracts for the same or similar items and other references (including contract numbers, points of contact with telephone numbers and other relevant information)

11. A statement specifying the extent of agreement with all terms, conditions, and provisions included in the solicitation.

Offerors that fail to furnish required representations or information, or reject the terms and conditions of the solicitation may be excluded from consideration.

In addition, Contractors shall provide the following:

• Shall meet the Minimum Requirements Criteria of the Statement of Objectives.

J. FAR 52.212-2 Evaluation — Commercial Items (October 2014).

(a) The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

1. Preferences and Desired Features

2. Past Performance

3. Meet the Current Archive Sizes and Modalities

4. Willing to execute a Business Partners Interconnection Security Agreement Template

Basis of award is Lowest Price, Technically Acceptable "LPTA" bid package. All of the above is required in order to be considered technically acceptable (See Instructions to Offerors).

K. FAR 52.212-3 Offer Representations and Certifications-Commercial Items (August 2018) See attachment for full text.

The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) website located at https://www.sam.gov/portal. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u) of this provision.

K. FAR 52.212-4 Contract Terms and Conditions-Commercial Item (January 2017) — See attachment; in by reference.

L FAR 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders-Commercial Items (August 2018) - See attachment for full text.

M. Attached are the Federal Acquisition Regulations (FAR) & Health & Human Services Acquisition Regulation (HHSAR) clauses that are applicable including below.

N. Offers will be accepted electronically, Submit via the FedBid System.

Questions in regards to this solicitation shall be submitted via FedBid no later than September 25, 2018, 12:00pm CST. Contractors will need a DUNS number, TIN number, and be registered with www.sam.gov.

https://www.sam.gov/portal http://www.sam.gov/

STATEMENT OF OBJECTIVES

Area-Wide Vendor Neutral Archive

(Picture Archiving and Communication System: UMDNS 16-247)

Background:

The Great Plains Area Office in Aberdeen, South Dakota, works in conjunction with its 19 Indian Health Service Units and Tribal managed Service Units to provide health care to approximately 130,000 Native Americans located in North Dakota, South Dakota, Nebraska, and Iowa. The Area Office's service units include seven hospitals, eight health centers, and several smaller health stations and satellite clinics

Objectives:

The purpose of this procurement is for a 'turn-key' vendor neutral archive solution to provide off-site redundant storage and disaster recovery/backup for eleven (11) separate PACS located at different sites. These include a mixture of GE Centricity IW, AGFA Impax, and Smaart.

Constraints:

The proposed system/solution cannot be a 'cloud based' solution hosted outside of the Indian Health Service network. The system will be hosted entirely within the IHS network with the physical appliances either in the GPA Area Office in Aberdeen, SD or the GPA IT Office in Sioux Falls, SD. Exact location will be determined following award.

If the host operating system is Microsoft Windows / Microsoft Server based and/or utilizes Microsoft SQL, or other Microsoft products, the IHS prefers to provide licensing through IHS bulk licensing agreements.

In keeping with hardware standardization, the IHS will give preference to hardware from Dell, with 5-7 years of pro support (transferrable to the IHS) and iDRAC Enterprise.

For virtual environments, the IHS will give preference to Hyper-V supported solutions.

All servers placed on the IHS network will have Symantec End Point installed. If there any constraints, directory or other exclusions, those must be explicitly annotated in the proposal submission.

All systems placed on the IHS network are subject to a patch management agent being installed for tracking and reporting purposes. If automatic monthly patching, or patching through the IHS SCCM environment will adversely affect the performance and/or operations of the system, this must be explicitly annotated within the proposal submission, along with any proposed alternate patch management schema.

Where possible, systems will be added to the IHS Active Directory Domain. Local administrator accounts will be disabled and only those with IHS AD credentials will be able to access the system. If joining the VNA system(s) to the AD Domain is not viable, this must be explicitly annotated in the proposal submission, along with the reasons why joining the systenn(s) to the AD Domain are not advisable or possible.

Image viewing software will be web based and able to be accessed in a thin-client environment.

Vendor must be willing to execute a Business Partners Interconnection Security Agreement (see attached) following selection, but prior to contract award. Failure, or refusal to sign the IHS BPISA will be grounds for retraction of award offer, and removal from competition/consideration.

All proposals must include full documentation to include, network diagrams, logic/dataflow diagrams, communications protocols, user/operator guides, a copy of the HIMSS/NEMA Manufacturer's Disclosure Statement for Medical Device Security, and all information necessary for the technical evaluation team to create an accurate security assessment as well as a use/operation assessment of the system.

All storage arrays will be 'live' media. 'Write Once/Read Many", optical disc, tape, or other removable media will not be acceptable for anything other than redundant back-up.

Preferences and Desired Features:

A 'sandbox' or other test/training environment should be available to be used to preview system/software updates, upgrades, patches, etc. prior to implementation on the 'live' or 'production' system. As well as providing an environment to train new users.

The ability to import, store, and view other DICOM capable modalities such as Ophthalmology and Cardiology is desired. As is the ability to store non-DICOM images, studies, documents, in their native format. Where this is not possible, utilizing a 'DICOM wrapper' will be considered.

Current Archive Sizes and Modalities:

See attached 'VNA sizing worksheet' spreadsheet. Note: The study size and volume shown for digital mammography is based on the legacy 2D systems being used prior to mid-2018. All facilities providing digital mammography are now using 3D/Tomo and the archive will need to be sized to accommodate.

Place, Hours, and Period of Performance:

The contractor and any sub-contractors will coordinate days and hours of work with the Contracting Officer's Representative and department supervisor where the work is to be performed so as to provide the minimal impact possible upon daily operations.

Work 'after hours', weekends and federally recognized holidays is permissible as long as it is arranged and scheduled in advance, and is in keeping with applicable labor laws, rules and regulations.

Code & Standards Compliance:

All work shall conform to current applicable standards and codes, including but not limited to:

Privacy Act of 1974 Federal Information Security Management Act (FISMA) HITECH — Health Information Technology for Economic and Clinical Health Act HIPAA — Health Information Portability and Accountability Act FITARA — Federal Information Technology Acquisition Reform Act

Government Furnished Items:

None

Contact Information:

Additional information or requirements clarification can be obtained by contacting the Contracting Office listed on the solicitation synopsis, or by contacting the Contracting Officer Representative (COR) at:

anthonv.stavneraihs.gov 605-226-7552

A copy of the current Business Partners Interconnection Security Agreement template is included with the solicitation package.

http://anthonv.stavneraihs.gov/

Service Unit General X-rays CT's Mammography Ultrasound MRI Avg per Yr in

GB

Rapid City 5994 215 1003 524 447 451 Eagle Butte 6292 3081 634 877 240 1366 Winnebago 10560 —840 300 840 652 Lower Brule 2880 200 95

Wagner 2500 50 Fort Yates/McL 4400 200 220 157

Rosebud 7492 2550 270 1777 1333 Pine Ridge 9830 6300 800 1800 2508 Sisseton 2289 285 348 142 Belcourt

6.8TB

Total : 52238 12986 3492 6586 687

Avg Study Size x 20MB x 300MB x 110MB x 185MB x 350M Avg per Year 1,044,760 3,895,800 384,120 1,218,410 240,450 6783540

MB 20,000,000 300,000,000 110,000,000 185,000,000 350,000,000

Ave per Year 1,044,760 3,895,800 384,120 1,218,410 240,450 6,783,540 Tomo studies GB 2,700,000,000

Estimate 15 years for priors without tomo images 101,753,100

Annual estimates forward with all mammo studies as tomos going

Annual Totals 1,044,760 3,895,800 9,428,400 1,218,410 240.450 15,827,820

7 year total with tomo 117,580,920

( /1,000,000)

Total VNA archive size 219,334,020

I 219 TB

Indian Health Service Business Partner Interconnection Security Agreement

<<Area/Facility>> and <<Partner Organization>>

I. Insert IFIS told business partner names and document date.

2. Press Cil+A to select entire document.

3 I' I ess l'9 to update related Fields.

DIS-Template-10-01 Version 2.0 <<Month Year>>

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

Controlled with Standard Dissemination For Authorized Use Only This information is intended for IHS use only. Disclosure may cause harm to IHS. Access is provided by request only and is not available via the organization's Intranet. This document contains information that may be exempt from public release under the Freedom of Information Act (FOIA) (5 U.S.C. 552).

Indian Health Service«Area/Facility» Business Partner Interconnection Security Agreement «Partner Organization»

«Month Year» DIS-Template-1 0-01

Document Information

SUPERSEDES

• This Business Partner Interconnection Security Agreement template supersedes D1S-Template-10-01, May 2012.

This interconnection security agreement supersedes < <Insert earlier version of the Interconnection Security Agreement, including tide and date, that this agreement replaces.>>

«Month Year» DIS-Template-1 0-01

Record of Changes Vers ion Date Name Descript ion Sect ion

1.0 07/2012 ISA and Doc Teams

First Draft All

2.0 01/11/2016 ISA and Doc Teams

Corrected typos, links, formatting, and styles. Organized sections. Added IPsiports/protocols attachment. Updated Incident Reporting Form. Expanded security categorization tables

All

«Month Year» DIS-Template-1 0-01

C ontents Document Information

Record of Changes

Contents

1. Purpose

1.1 Authority

1.2 Scope

2. Statement of Requirements and System Description

2.1 General Information and Data Description

2.2 Services Offered

3. Information and Network Descriptions i i iii iv

3.1 IHS Network

3.2 Partner Organization Network

3.3 Network Diagram(s)

3.4 Area/Site Connections

4. Security Responsibilities

4.1 User Community

4.2 Commitment to Protect Personally Identifiable Information (PII) and Protected Health Information (PHI)

4.3 Rules of Behavior

4.4 Training and Awareness

4.5 Security Documentation

4.6 Personnel Access Changes

4.7 Incident Response and Reporting

4.8 Disasters and Other Contingencies

5. Agreement Considerations

5.1 New Interconnections and Modifications

5.2 Compliance

5.3 Cost Considerations

5.4 Timelines

«Month Year» DIS-Template-1 0-01

.5 Limitation of Liability

6. Signatures

7. Glossary

Attachment A: Information Security POCs

Attachment B: Network Diagram(s)

Attachment C: Area/Site Connections

Attachment D: Ws, Ports, and Protocols

Appendix A: References

Appendix B: Review Log

Second Year Review

Third Year Review

Appendix C: IHS Incident Reporting Form

«Month Year» DIS-Template-1 0-01

1. Purpose The purpose of this interconnection security agreement (ISA) is to establish procedures for mutual cooperation and coordination between the Indian Health Service (IHS), an agency of the United States Department of Health and Human Services (HHS), and <<Partner Organization>> (hereinafter known as "both parties").

These procedures identify and implement information security safeguards and responsibilities required to establish an interconnection between the IHS network and <<Partner Organization>>'s network. This ISA is intended to minimize security risks and ensure the confidentiality, integrity, and availability (CIA) of both IHS information' and information owned by <<Partner Organization>> that is shared or transmitted through the network interconnection'.

This ISA documents interconnection arrangements and information technology (IT) security responsibilities for both parties, outlines security safeguards, provides technical and operational security requirements, and specifies the business and legal requirements for the information systems and networks being interconnected. This ISA authorizes mutual permission to connect both parties and establishes a commitment to protect data that is exchanged between the networks or processed and stored on systems that reside on the network. Through this ISA, both parties will minimize the susceptibility of their connected systems and networks to IT security risks and aid in mitigating and recovering from IT security incidents.

1.1 Authority

IHS is responsible for implementing and administering an information security program, which includes the use of this ISA, to protect its information resources in compliance with applicable public laws, federal regulations, and Executive Orders.

Such directives include, but are not limited to: the Federal Information Security Modernization Act of 2002 (FISMA); the Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, dated November 28, 2000; the Health Information Technology for Economic and Clinical Health Act (HITECH); the Health Insurance Portability and Accountability Act of 1996 (HIPAA); OMB Memorandum 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information; OMB Memorandum 09-29, FY 2009 Reporting Instructions for FISMA and Agency Privacy Management. IHS will

' Information is defined as "any knowledge that can be communicated or documentary material, regardless of its physical form or characteristics, that is owned by, produced by or for, or is under the control of the United States Government." (Executive Order 12958)

2 Network Interconnection is defined as "the direct connection of two or more IT [networks] for the purpose of sharing data and other information resources." (This is based on the definition of system interconnection in NIST SP 800-47, Security Guide for Interconnecting Information Technology Systems.)

«Month Year» DIS-Template-1 0-01 comply with the security requirements of the Federal Acquisition Regulation (FAR), clause 52.239-1, "Privacy or Security Safeguards."

This ISA was developed in compliance with federal guidelines, including NIST Special Publication (SP) 800-47, Security Guide for Interconnecting Information Technology Systems. NIST SP 800-47 states: "A system that is approved by an ISA for interconnection with one organization's system should meet the protection requirements equal to, or greater than, those implemented by the other organization's system." These guidelines establish the IT security measures that will be taken to protect the connected systems, networks, and shared data. IHS IT managers and IT security personnel will comply with the NIST guidelines in managing the process of interconnecting information systems and networks.

The ISA will be governed and construed in accordance with federal law. In the event of a conflict between the ISA and applicable federal law, federal law will prevail.

Furthermore, nothing in this ISA will be construed to authorize <<Partner Organization>> to act outside of the scope of any federal law. If any term or condition of this ISA becomes invalid or unenforceable, such term or provision will in no way affect the validity or enforceability of any other term or provision contained herein.

1.2 Scope

The scope of this ISA is based on, but not limited to, the following:

• Interconnection between the IHS information system(s) or network and <<Partner Organization>>.

• Existing and future users, including employees from both parties, contractors and subcontractors at any tier, and other federally and non-federally funded users managing, engineering, accessing, or utilizing the <<Partner Organization>> network.

• Related network components belonging to both parties, such as hosts, routers, and switches; IT devices that assist in managing security, such as firewalls, intrusion detection systems, and vulnerability scanning tools; desktop workstations;

servers; and major applications that are associated with the network connection.

«Month Year» DIS-Template-1 0-01

2. Statement of Requirements and System Description This ISA governs the relationship between IHS and <<Partner Organization>>, with regard to <<Partner Organization>>'s connection to and use of the IHS network, systems, and information.

2.1 General Information and Data Description

<<Insert a description of the information and data that will be made available, exchanged, or passed one way or both directions via the interconnection of both parties. Include the following information:

• The requirement for the interconnection, including the benefits derived.

• The names of the systems being interconnected.

• If <<Partner Organization>> will create, receive, view or otherwise have access to IHS Protected Health Information (PHI) -.

• The name of the agency or organization that initiated the requirement. If the requirement is generated by a higher-level agency or organization, indicate the name of the organization and the individual, if appropriate, who requested the interconnection.>>

2.2 Services Offered

IHS will:

• Provide the <<Partner Organization>> point of contact support via the IHS Office of Information Technology (OIT) Help Desk. (Available 6 a.m. to 6 p.m.

Mountain Time, Monday-Friday, at 1-888-830-7280. After hours assistance provided by the Network Operations and Security Center [NOSC] at 702-532- 8201.)

• Provide installation, configuration, and maintenance of IHS edge router(s) with interfaces to multiple IHS core and edge routers.

• << Insert additional IHS services that are offered as part of the agreement.>>

<<Partner Organization>> will:

• < <Insert Partner Organization IT Help Desk information regarding operating times, process, and contact information.>>

3 Protected Health Information is defined as individually identifiable health information that is transmitted or maintained in any form or medium, including electronic information. (45 CFR 160.103)

«Month Year» DIS-Template-1 0-01

• <<Insert any additional Partner Organization responsibilities or services that are offered as part of this agreement.>>

«Month Year» DIS-Template-1 0-01

3. Information and Network Descriptions This section details the IHS and partner data and networks, including data descriptions and security designations.

3.1 IHS Network

Organization: IHS

Function: < <Insert IHS's network function as it relates to this interconnection.>>

Location: <<Insert IHS 's physical site(s) location(s) as it relates to this interconnection.>>

Description <<Insert a description of data that will be made available, exchanged, or passed across the interconnection. Include the sensitivity or classification level.>>

Table 1 contains the security level for IHS information handled via the interconnection.

information Category (Enter High, Moderate, security

Level or Low objective) Integrity for each

Availability

Security Level <<Enter the Information Category>>

Confidentiality

Table 1: IHS Information Security Level

Overall Security Level Designation for IHS: <<Insert the highest level provided in the table above for this interconnection.>>

3.2 Partner Organization Network

Organization: <<Partner Organization>>

Function: << Insert partner organization's network function as it relates to this interconnection.>>

Location: <<Insert partner organization's physical site(s) location(s) as it relates to this interconnection.>>

Description: <<Insert a description of data that will be made available, exchanged, or passed across the interconnection. Include the sensitivity or classification level.>>

«Month Year» DIS-Template-1 0-01

The selection of the information types/systems is based on guidance provided by OMB Federal Enterprise Architecture (FEA) Program Management Office (PMO) Business Reference Model (BRM) 2.0, and FIPS Pub 199, Standards for Security Categorization of Federal information and Information Systems (which is based on N1ST SP 800-60, Rev 1 Guide for Mapping Types of Information and lnfOrmation Systems to Security Categories).

Table 2 is provided to assist the partner in determining the security categorization of the information being shared or exchanged by the interconnection.

Security Objective Low Moderate High Confidentiality Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

[44 USC, SEC. 3542]

The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

i

The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

Integrity Guarding against improper information modification or destruction, including ensuring information non-repudiation and authenticity.

[44 USC, SEC. 3542]

The modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

The modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

The modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

Availability Ensuring timely and reliable access to and use of information.

[44 USC, SEC. 3542]

The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

Table 2: Security Objectives and Categories

<<As determined from the table above, enter into Table 3 the appropriate security levels for the partner's information that is shared or exchanged via this interconnection.>>

<<Month Year» DIS-Template-1 0-01

Indian Health Service <<Area/Facility» Business Partner Interconnection Security Agreement <<Partner Organization>> information Category

Level (Enter High, Moderate, or Low for each security objective)

Security Level <<Enter the Information

Category>> Confidentiality Integrity Availability

Table 3: «Partner Organization>> Information Security Level NOTE: For assistance completing this section, contact the ISA support group at HQ_OITBPISA@ihs.gov.

Overall Security Level Designation for <<Partner,Organization>>: << Insert the highest level provided in Table 3, above, for this interconnection.>>

3.3 Network Diagram(s)

Attachment B: Network Diagram(s) of this ISA includes a topological drawing that illustrates the interconnection between both parties, including all components (e.g., firewalls, routers, switches, hubs, servers, encryption devices, and computer work stations). If applicable, both parties will provide IP addresses for all components identified in the topological drawing. Each party will notify the other of any requirements, such as additional router connections or increases in volume, associated with this ISA.

3.4 Area/Site Connections

Attachment C: Area/Site Connections of this ISA includes a list of all IHS Areas and sites interconnecting with <<Partner Organization>>. If applicable, <<Partner Organization>> will list the effective dates of the interconnections.

mailto:HQ_OITBPISA@ihs.gov

Indian Health Service <<Area/Facility>>

<<Month Year» DIS-Template-1 0-01

4. Security Responsibilities The following sections describe the responsibilities of each party as they relate to ensuring the security of applicable systems, networks, and personnel affected by this interconnection.

Both parties will:

• Maintain a level of security that is commensurate with the risk of, and magnitude of harm that could result from, the loss, misuse, disclosure, or modification of the information contained on the system.

• Subject to applicable statutes and regulations including the Freedom of Information Act, agree that the terms and conditions (and any proprietary information) of this ISA will not be disclosed to any third party outside of the Government without the prior written consent of the other party.

• Adhere to all HHS and IHS IT security policies, procedures, and guidelines in the execution of this interconnection. The IHS Information Systems Security Officer (ISSO) or ISA Coordinator will provide appropriate IHS security policies to the partner at the onset of this agreement. IHS policy is located at:

http://www.ihs.gov/ihm/index.cfm.

• Designate a technical lead for their respective network, and provide point of contact (POC) information to facilitate direct contacts between technical leads, to support the management and operation of the interconnection.

• Maintain open lines of communication between POCs at both the managerial and technical levels, to ensure the successful management and operation of the interconnection.

• Inform their counterpart promptly of any change in technical POC or interconnection.

• Submit to other designated POCs any proposed changes to either the network or the interconnecting medium, accompanied by a business justification for the change.

• Report through the designated POCs, as appropriate, any planned technical changes to the network architecture that affect the interconnection.

• Conduct a risk assessment for any new network architecture affecting this ISA, and modify and re-sign the ISA within one month prior to the implementation.

• Where feasible, ensure this interconnection is isolated from all other customer/business processes.

• Notify the respective POC(s) when a user's access and/or this interconnection are no longer required.

http://www.ihs.gov/ihm/index.cfm.

<<Month Year» DIS-Template-1 0-01

IHS will:

• Designate an IHS ISSO or ISA Coordinator to serve as liaison between both parties and assist the partner in ensuring that its security controls meet or exceed IHS and federal requirements.

• Configure the IHS network perimeter firewall in accordance with IHS, HHS, and federal guidelines and industry best practices.

• Install a firewall between the perimeter (demarcation point) of the partner's network and the IHS network, if deemed necessary by the IHS Chief Information Security Officer (CISO).

<<Partner Organization>> will:

• Designate an IT security POC who will act on behalf of the partner and communicate all IT security issues involving the interconnection to the IHS ISSO or ISA Coordinator.

• Maintain and make available to IHS upon request a list of all partner subnets connected to the IHS network, and periodically update the information on each owner, physical location, IP address, host name, hardware, operating system version, and application.

Attachment A: Information Security POCs contains a listing of responsible parties for each side of the interconnection.

4.1 User Community

Both parties will:

• Ensure that all employees, contractors, and other authorized users with access to IHS or partner networks, systems, or data related to this interconnection are not security risks, and that they meet the security and privacy requirements of the OMB (htip://www.whiLehousc.gov/omh/) and HHS Personnel Security/Suitability Program (http://wwwiths.goviasa/ohr/manual/files/98 1.pd I). For more information, contact the Federal Contract Officer or Project Officer assigned to this interconnection.

• Enforce the following IT security best practices:

Least Privilege: Granting each entity the minimum system resources and authorizations that the entity needs to perform its function.

Separation of Duties: Dividing roles and responsibilities so that a single individual cannot subvert or control the entirety of a critical process.

Role-Based Security: Controlling access by assigning certain operations and appropriate permissions to specific roles.

http://www.whilehousc.gov/omh/) http://wwwiths.goviasa/ohr/manual/files/98

<<Month Year» DIS-Template-1 0-01

4.2 Commitment to Protect Personally Identifiable Information (PII) and Protected Health Information (PHI) Both parties will:

• Not release, publish, or disclose information to unauthorized personnel and will protect such information in accordance with provisions of the laws cited in Section 1.1: Authority and Appendix A: References, as well as any other pertinent laws and regulations governing the adequate safeguard of federal information and information systems.

• Ensure that information used, stored, or transmitted is protected commensurate with the risk of, and magnitude of the harm that could result from, the unauthorized access, use, disclosure, disruption, modification, or destruction of the information. FIPS Publication 200 and associated NIST SPs, including NIST SP 800-53, Rev 4, will be used to determine required controls according to the information categorization defined in Section 3. FIPS 140-2 validated cryptographic modules will be used when such controls are required.

<<Partner Organization>> will ensure that each of its employees and subcontractors who may have access to IHS information and information systems comply with the security required by FAR clause 52.239-1, "Privacy or Security Safeguards," and with IHS IT security policies, standards, and procedures. IHS IT policy is located at http://www.ihs.gov/ihm/index.cfm.

4.3 Rules of Behavior

Both parties will ensure that all users with access to IHS networks, information, and information systems, the <<Partner Organization>>'s interconnected systems/networks, and any data received as part of this interconnection will adhere to all current IHS Rules of Behavior (RoB). All users, including employees, contractors, subcontractors, and other authorized users, must accept the IHS RoB as part of the Information Systems Security Awareness (ISSA) training, upon enactment of this ISA and again annually thereafter. In addition, such users must sign and adhere to pertinent system-specific RoB, as applicable.

4.4 Training and Awareness

Both parties will have all employees, contractors, subcontractors, and other authorized users complete the IHS Information Systems Security Awareness (ISSA) training upon enactment of this ISA and again annually thereafter. The ISSA training can be found at www.ihs.gov/issa.

<<Partner Organization>> will, upon request, provide the IHS Project Officer or designee with the name of each user and the date each user completes initial and annual ISSA training.

http://www.ihs.gov/ihm/index.cfm.

http://www.ihs.gov/issa.

<<Month Year» DIS-Template-1 0-01

4.5 Security Documentation

Both parties will ensure that security is planned for, documented, and integrated into the system life cycle, from the IT system's initiation to the system's disposal, for any systems that are part of this interconnection agreement. See NIST SP 800-37, Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach.

IHS will review the IHS System Security Plans (SSPs) for its systems annually and update them as required by NIST SP 800-18, Rev 1, Guide for Developing Security Plans for Federal Information Systems.

<<Partner Organization>> will:

• Maintain an SSP on the systems affected by this interconnection agreement and update them whenever there is a major modification to those systems. The SSP will be compliant with the NIST SP 800-18, Rev 1.

• Make accessible to IHS all IT security program documents related to systems affected by this interconnection.

4.6 Personnel Access Changes

<<Partner Organization>> will provide notification to IHS via the ISSO or ISA Coordinator of any changes to user profiles, within three working days of the change.

This includes users who resign or change job responsibilities. This will ensure access is removed or maintained accurately on IHS systems and is in accordance with federal guidelines.

IHS will provide similar notification to the partner if IHS users access the partner's systems as part of this interconnection.

4.7 Incident Response and Reporting

Both parties will:

• Handle and report any security incident' on the networks or subnets within the scope of this ISA that could have an impact on the other as part of this interconnection. The Incident Response Team (IRT) will assist IHS and its partners with all incidents and breaches of PHI. Reporting incidents and breaches will allow each party to determine whether its network is at risk or has been compromised, and to take appropriate security actions.

4 Incident is defined as "a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices." (NIST Special Publication 800-61)

<<Month Year» DIS-Template-1 0-01

• Report security incidents within 30 minutes of discovery. Network users will report incidents via the online Incident Reporting Form located at https://disirf.ihs.gov/. For non-network users, a paper form is available and can be found in Appendix C: IHS Incident Reporting Form.

• Notify the IHS Incident Response Team at IRT@ihs,gov within 30 minutes of discovery for any breach' of IHS PHI, including unauthorized use or disclosure.

• Block inbound and outbound access for any IHS or partner information systems on the subnets within the scope of this ISA that are sources of unauthorized access attempts or the subject of any security event (such as malware), until the risk is remediated.

a Disseminate critical intrusion detection alerts to respective counterparts for all subnets within the scope of this ISA.

• Share information system event or audit records/logs to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity, to the extent that inappropriate use may be uniquely traced to the source for potential accountability and legal purposes.

4.8 Disasters and Other Contingencies

Both parties will immediately notify their designated counterparts, as defined in this ISA, in the event of a disaster or other contingency that disrupts normal operation of one or both of the connected networks. The IHS POC will notify appropriate personnel on the IHS side of the connection.

IHS will maintain appropriate system contingency plans in accordance with federal regulations.

5 Breach is defined as the suspected or confirmed "unauthorized acquisition, access, use, or disclosure of PHI [or PII] which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information." (HITECH Act, Section 13400)

<<Month Year» DIS-Template-1 0-01

5. Agreement Considerations This section describes the general considerations for implementing this Interconnection Security Agreement.

5.1 New Interconnections and Modifications

New interconnections between IHS and <<Partner Organization>> are prohibited unless expressly agreed upon in a modification to this ISA, signed by both parties.

If any personnel changes involving the POCs listed in this ISA occur, the terms of this ISA will remain in full force and effect unless formally modified by both parties.

Any modifications that change the security posture of systems or networks related to this agreement must be formally documented and agreed to as a modification or addendum to this ISA.

5.2 Compliance

Non-compliance with the terms of this ISA by either party may lead to termination of the interconnection. IHS may block network access by <<Partner Organization>> if <<Partner Organization>> does not implement reasonable precautions to prevent security incidents from spreading to the IHS network. IHS is authorized to audit the security of <<Partner Organization>>'s network periodically by requesting that <<Partner Organization>> provide documentation of compliance with the security requirements of this ISA. <<Partner Organization>> will provide IHS access to the IT resources pertinent to this ISA, for the purpose of audits.

5.3 Cost Considerations

Both parties agree to be responsible for their own systems and costs of the interconnecting mechanisms and/or media. No financial commitments to reimburse the other party will be made without the written concurrence of both parties.

Modifications to either system that are necessary to support the interconnection are the responsibility of the respective system/network owner's organization. This ISA does not authorize, require, or preclude any transfer of funds without the written agreement of both parties.

5.4 Timelines

This ISA will become effective upon the signatures of the parties involved and remains in effect until it expires or is terminated by either party. This ISA is subject to annual review in accordance with federal directives and must be reauthorized when there is a modification to the security posture or, at a minimum, every three years. If one or both parties wish to terminate this agreement, they may do so upon 30 days' written notice. In the event of a security incident or suspected incident, IHS has the right to immediately terminate the connection and will provide notification of such to

<<Month Year» DIS-Template-1 0-01 the partner POC prior to termination, or within 24 hours after disconnection if emergency warrants the delay.

5.5 Limitation of Liability

Except to the extent covered by the Federal Tort Claims Act, THS will not be liable to <<Partner Organization>> or any other person for any indirect, special, incidental, or consequential damages of any character, including, without limitation, damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses, even if such party was informed of the possibility of such damages.

<<Month Year» DIS-Template-1 0-01

6. Signatures Both parties agree to work together to ensure the joint security of the connected networks and the data they store, process, and transmit, as specified in this ISA. Each party certifies that its respective network is designed, managed, and operated in compliance with all relevant federal laws, regulations, and policies. Each party also certifies that its respective network has been certified and accredited in accordance with NIST guidance and as mandated in the Federal Information Security Modernization Act of 2002.

We agree to the terms and conditions of this ISA.

IHS Management POC <<Partner Organization>> Management POC

(Name) (Title) (Name)

(Signature) (Date) (Signature) (Date)

IHS Information Security POC <<Partner Organization>> Information Security POC

(Name) (Name)

(Signature) (Date) (Signature) (Date)

Indian Heaith Service «Area/Facirity>>

«Month Year>> DIS-Template-10-01

7. Glossary See the online glossary on the HIS OTT Security website at http://sccurity.iiis.goviSco(ik)s.clin.

http://sccurity.iiis.govisco/

Indian Health Service «Area/Facility» Business Partner Interconnection Security Agreement «Partner Organization>>

«Month Year>> DIS-Template-10-01

Attachment A: Information Security POCs <<Partner Organization>> will designate an information security POC, who will communicate all information security issues involving <<Partner Organization>> to IHS via the IHS security POC. The <<Partner Organization>> POC will be the <<Partner Organization>> ISSO or another information security official who will be responsible for implementing and managing <<Partner Organization>>'s information security program and ensuring that <<Partner Organization>> information security controls meet or exceed IHS requirements.

IHS Security POC:

Address:

Work Phone:

Fax:

Email:

IHS Technical POC:

Address:

Work Phone:

Email:

IHS ISSO POC:

Address:

Work Phone:

Email:

<<Partner Organization>> Security POC:

Title:

Address:

Work Phone:

Fax:

Email:

24x7 contact number:

<<Partner Organization>> Technical POC:

Title:

Address:

Work Phone:

Fax:

Email:

«Month Year>> DIS-Template-10-01

Attachment B: Network Diagram(s)

«Month Year>> DIS-Template-10-01

Attachment C: Area/Site Connections

IHS Area/Site Interconnected Date Connected Currently Connected?

«Month Year>> DIS-Template-10-01

Attachment D: !Ps, Ports, and Protocols Source IP Address Destination IP Address Ports Protocols

«Month Year>> DIS-Template-10-01

Appendix A: References This ISA was developed in accordance with, but is not limited to, all relevant laws, policies, and regulations, including:

• Indian Health Manual (IHM) Part 8, Chapter 12 (http://www.ihs.goviihm/index.cfm?module=dsp ihm_pc_p8c12)

• IHM Part 8, Chapter 15 (hups://www.iits.gov/ihm/index.cfm?module=dsp ihm_pcp8c15)

• Indian Health Service Information Security Program SOPs (hups://homc.ihs.gov/ITSC-CIO/oit ifs!)

• HHS information security policies and procedures (httn://www. Iths.gov/ocio/po I icy/index.him lliSecurity)

• Health Information Technology for Economic and Clinical Health Act (HITECH Act), Title XIII, Subtitle D of the American Reinvestment and Recovery Act (ARRA) of 2009, Pub. L. No. 111-5, 123 Stat. 115

• Office of Management and Budget Memoranda (hups://www.whitehouse.gov/omb/memoranda default/):

07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information (https://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoran da/fy2007/m07-16.pdf)

09-29, Reporting Instructions for FISMA and Agency Privacy Management (https://www.whitehouse.gov/sites/default/files/omb/assets/memoranda fy 2009/m09-29.ml0

• Federal Information Processing Standards (FIPS) Publications

• National Institute of Standards and Technology (KIST) Special Publications (SPs) and Draft SPs (http://csrc.nist.govIpublications/PubsSPs.luml)

• Federal Continuity Directive (FCD), FCD 1, Federal Executive Branch Continuity of Operations, October 2012 (hup://www.fema.gov/media-library-data/1386609058779-b084a7230663249abld6da4b6472e691/2012-Federal- Continuity-Directivel.pd

• Presidential Decision Directives (PDD) (httn://www.loc.go /nine wski i feet' ves.html):

• PDD 67, Enduring Constitutional Government and Continuity of Government Operations, October 21, 1998.

http://www.ihs.goviihm/index.cfm?module=dsp http://www.iits.gov/ihm/index.cfm?module=dsp http://homc.ihs.gov/ITSC-CIO/oit http://www.iths.gov/ocio/po http://www.whitehouse.gov/omb/memoranda https://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoran https://www.whitehouse.gov/sites/default/files/omb/assets/memoranda http://csrc.nist.govipublications/PubsSPs.luml) http://www.fema.gov/media-library-

«Month Year>> DIS-Template-10-01

Homeland Security Presidential Directive/HSPD-7, Critical Infrastructure Identification, Prioritization, and Protection, December 17, 2003.

«Month Year>> DIS-Template-10-01

Appendix B: Review Log This Business Partner Interconnection Security Agreement is valid for three years, but must be reviewed every year to document any relevant modifications and ensure that appropriate security measures are in place.

Second Year Review Both parties have reviewed this agreement and reaffirm that the information is still current unless otherwise noted in the comments section below.

We reaffirm the terms and conditions of this Business Partner Interconnection Security Agreement.

Comments: <<Document any relevant changes to this agreement>>

IHS Management POC <<Partner Organization>> Management POC

(Name) (Title) (Name)

(Signature) (Date) (Signature) (Date)

IHS Information Security POC <<Partner Organization>> Information Security POC

(Name) (Name)

(Signature) (Date) (Signature) (Date)

NOTE: All users must complete the IHS Information Systems Security Awareness training and accept the IHS Rules of Behavior upon hire and annually thereafter.

«Month Year>> DIS-Template-10-01

Third Year Review Both parties have reviewed this agreement and reaffirm that the information is still current unless otherwise noted in the comments section below.

We reaffirm the terms and conditions of this Business Partner Interconnection Security Agreement.

Comments: <<Document any relevant changes to this agreement>>

IHS Management POC <<Partner Organization>> Management POC

(Name) (Title) (Name)

(Signature) (Date) (Signature) (Date)

IHS Information Security POC <<Partner Organization>> Information Security POC

(Name) (Name)

(Signature) (Date) (Signature) (Date)

NOTE: All users must complete the IHS Information Systems Security Awareness training and accept the IHS Rules of Behavior upon hire and annually thereafter.

«Month Year>> DIS-Template-10-01

Appendix C: IHS Incident Reporting Form Important: Initial notification must be exclusively made to the IHS Incident Response Team (IRT) no later than 30 minutes from discovery. All incidents must also have a resolution completed.

Contact the IHS IRT: Email: IRT@ihs.gov; Business Hours: 1-888-830-7280 (OIT Help Desk).

After Hours: 702-562-8201 (NOSC).

Check One: ['Incident Notification Update ['Resolution

IR Primary Handler:

Does the incident involve Personally Identifiable Information (PII)? Yes No (Ifyes, complete P/I box)

KEY INFORMATION

Date/Time of Incident Discovery:

Date/Time Incident Occurred:

Facility name.

Discoverer of incident:

Contact person and contact information:

Alternate contact and contact information:

<If equipment was lost/stolen, list the government barcode number(s) for the stolen equipment>

<Describe the roles of the people involved, be it contractors, government employees, etc.>

<Provide number of individuals impacted or estimated to be impacted.>

<List people to keep notified of incident and people who should NOT be notified. >

INCIDENT SUMMARY

<High level summary of incident, elaborating on key information above.> mailto:IRT@ihs.gov;

«Month Year>> DIS-Template-10-01

DETAILED INCIDENT DESCRIPTION

…