Salient Characteristics 08142025.pdf

Automation Systems, Supplies Dispensing, Decentralized Essential Characteristics

Essential Characteristic Minimum

Requirements

1. The vendor shall provide an automated Point of Use (POU) Medical Supply Dispensing System Yes

2. A fully functional POU system includes the following: equipment, software, cyber security, network, training, and installation. Yes

3. Clinical capabilities of a POU system shall include the following: -

a. Capable of role-based authority for recording, reporting, transactional analytics of supplies dispense/utilization. Yes

b. Shall be fully compatible/interface with existing Supply Management System (DMLSS / LogiCole). Yes

c. Shall be fully compatible/integrate with existing with MHS Genesis. Yes

d. Capable of automated inventory management by updating the Quantity On-

Hand (QOH) levels in real time. Yes

e. Capable to provide automation of updates in less than 1 hour of increment or decrement of an item, to the QOH level of items stored within the POU No

f. Able to edit quantity on hand, because of physical inventory. Yes

g. Able to automate syncing/updates of the POU’s QOH levels to the Supply Chain System of Record. Yes

h. Capable of automated inventory supply level management for medical supplies at a facility’s Supply Distribution Points and remote locations. Yes

i. Able to automate syncing and updating of the Periodic Automatic Replenishment (PAR) levels or normal level with DMLSS. Yes

j. Able to provide emergency or critical low stock level notification. Yes

k. Able to provide cataloged information for supplies such as Transaction

Identifier Code, Item Location Serial Identifier, Location Name, Materiel Item Identifier, Short Item Description, Customer Identifier, Threshold Level Quantity, Unit of Sale (UOS) Code or UOS Pack Code, UOS Price Amount, Delete Indicator, New Tracking Item Indicator, UOS Quantity, Item Serial Identifier, Manufacturer, Manufacturer part number, National Stock Number.

Cataloged data fields will be dependent on the catalog system used

Yes

l. Able to auto-generate supply reorder requests Yes

m. Capable of physical scalability for containment of medical supply inventory near the vicinity of patient care and main storage areas. Yes

n. Able to be physically sized and installed with multiple configurations for accommodation of different sizes of medical supplies (e.g. bandages, sutures, syringes, staples, gloves, masks, gowns, sealants, catheters, antiseptics, crutches etc.) required to conduct patient care in a facility.

Yes

o. Able to be physically sized and installed with multiple configurations for accommodation to fit system hardware into facility locations of differing sizes such as large main storage areas, medium supply storage rooms and storage closets, and smaller clinic areas without a specified storage area in the vicinity of patient care.

Yes

p. Capable to provide flexibility for secured physical storage for highly pilferable or expensive medical supplies, and unsecured physical storage of inexpensive medical supplies for ease of “take and go” retrievability by clinicians.

Yes

q. Ability to provide interoperability and functionality with the DoD Medical Health Record/Electronic Health Record system (EHRM) to track medical supplies to patients and medical procedures; enables patient billing, ability to create consult/order for exportation.

NA

r. Capable of providing reports with analysis on usage over time, costs over time, and analysis with recommended supply levels Yes

s. Compatible with the requirements for clean/sterile supply, breakout rooms, and bulk storage/warehouse in that the lowest shelves in storage areas must be solid. System shall have the ability for cleaning to avoid contamination of spaces.

Yes

t. Compatible with the requirements for clean/sterile supply, breakout rooms, and bulk storage/warehouse and does not interfere with positive air flow, 20-60% humidity, and 66-75 degrees Fahrenheit in these areas.

Yes

u. Capable of a minimum of 10 user accounts to be utilized simultaneously per

MTF

v. Compatible with MTF electrical requirements Yes

w. Capable of battery operation, in case of power outages NA

x. Capable of the following user interaction: Keyboard, touchscreen, CAC card or bar-code reader Yes

4. Maintenance requirements of a POU system shall include the following: -

a. Contractor shall provide a call back response for any needed repair(s) of the system within four (4) hours of a call from MTF during the normal working hours of 7 a.m. – 5 p.m. Local Time, Monday through Friday

Yes

5. Training requirements of a POU system shall include the following: -

a. On-site training shall be provided for a minimum of one (1) System Supervisor (Supply), and one (1) System Administrator (Supply) Yes

b. A minimum of one (1) biomed training slots shall be provided Yes

c. On-site end-user training shall be provided at time of system acceptance. Yes

d. The vendor shall provide a minimum of two (2) user/operator and two (2) service manuals. Yes

DESCRIPTION OF

MINIMUM

REQUIREMENT AND/OR

OBJECTIVE

MINIMUM REQUIREMENT

Authority to Operate (ATO) Agree to comply with all requirements outlined in the Defense Health Agency (DHA) Contracting Requirements for Medical Device and Equipment (MDE) Cybersecurity/Risk Management Framework (RMF) document.

Joint Medical Device Equipment Risk Assessment Questionnaire

Provide a completed Joint Medical Device Equipment Risk Assessment Questionnaire for the offered system.

All 3rd party components/applications included in the RFO must have their own MDERA filled out in its entirety.

Cybersecurity Service Maintenance Agreement

The vendor shall ensure that RMF/Cybersecurity maintenance is included in all SMA offerings, and costs associated are detailed.

Define what is covered within the SMA to include deliverables and timeframes.

3rd Party Applications/Components

Any 3rd party applications/components must be clearly identified in the offering as being resold by the Prime Contractor. Prime Contractor submitting the RFO must have an agreement in writing with any 3rd party, or component being resold in the RFO to hold the 3rd party vendor accountable to comply with all IA Terms and Conditions necessary to achieve a system RMF ATO for their system.

If no agreement is in place, the Prime Contractor in the offering agrees in writing to be responsible for completion of the RMF ATO for all 3rd party components, to include the security lockdown (STIGS, Patching, Scans, etc.) of the equipment offered.

All 3rd party applications/components must meet all IA SRDs for the offering to be considered. Prime Contractor is responsible for ensuring all information from 3rd parties are included and accurate.

Provide Current Nessus Scans

Provide fully credentialed full audit/port scans using Nessus of all system components provided with the system, to include 3rd party applications/components listed in the offering. Scans must be completed within 30 days of submission date to be considered acceptable.

Operating System Operating System used on the Medical Device must have no less than 36 months before reaching its commercial End of Life (OS EOL).

For any OS with less than 36 months, provide a plan of action towards upgrading the OS. Include any costs associated with upgrading the OS after deployment, and specific timelines associated with availability of the updated OS. A strength or weakness may be assigned based on the details provided.

All 3rd party system/components must follow the above requirements.

Application major Components

All major component software applications (SQL, IIS, Net, Etc.)

used on the Medical Device must have no less than 36 months before reaching their commercial End of Life (OS EOL).

For any major component software applications (SQL, IIS, Net, Etc.)

used on the Medical Device with less than 36 months Commercial End of Life, provide a plan of action towards upgrading the application.

Include any costs associated with updating after deployment, and specific timelines associated with availability of the updated OS. A Strength or weakness may be assigned based on the details provided.

All 3rd party system/components must follow the above requirements.

Vulnerability management In accordance with SEC. 524B. of the FD&C Act - titled ENSURING

CYBERSECURITY OF DEVICES,

the vendor shall design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available postmarket updates and patches to the device and related systems on a reasonably justified regular cycle, or as soon as possible for critical vulnerabilities that could cause uncontrolled risks.

The vendor shall disclose if patching can be accomplished by the government, or if specialized support is required to maintain a compliant cybersecurity posture.

Vendor must describe established policies and procedures to distribute and install security updates within a documented timeframe, to include all critical security patches within 15 calendar days.

Response must include how often patches are reviewed/released, as well as information on how patches are distributed, and any costs associated with patch management.

Data At Rest Encryption System utilizes FIPS 140-2 level encryption for all PHI/PII data.

Auditing System is capable of providing a time specific audit trail on system events to include:

1. Login/Logout information of individual accounts

2. Modification and Deletion of

PHI/PII

3. The import and export of data to and from utilizing removable media

4. Execution of privileged/elevated functions.

5. Remote Service Activity

User Accounts All general users of the system must have individual user IDs to log into the application

All Admin accounts are separate from general user level access

All accounts support DoD password complexity requirements.

Multi-Factor Authentication

(MFA)

Vendor must indicate if the offered system can implement MFA.

Response must detail methods/requirements for implementation.

Live Environment Vulnerability Scanning

Live Environment Definition: System that is joined to the network and clinically in use.

Vendor must indicate if the offered system can be scanned by Nessus Security Center scanning protocols within military hospitals.

Must provide details and requirements for scanning and any directory exemptions necessary

For systems/components that cannot be scanned the vendor must detail how RMF configuration compliance is to be verified in the live environment.

Wireless Wireless supplicants must use FIPS 140 validated encryption to protect data-in-transit on the WLAN infrastructure.

Data In Transit Encryption Vendor must indicate if the offered system can natively encrypt data prior to transmission.

Details on encryption strength must be provided, along with any limitations to implementation.

Remote Access All remote access must comply with DHA B2B requirements as disclosed in the Defense Health Agency (DHA) Contracting Requirements for Medical Device and Equipment (MDE) Cybersecurity/Risk Management Framework (RMF) document.

Vendor must indicate if the offered system requires Remote Access, and if all communication can traverse through the DHA B2B solution.

Details on all data flows, and information traversing remote access boundaries must be disclosed.

Cloud Requirements/External IT Services

Vendor must indicate any external IT Services/Cloud requirements associated with the proposed solution.

Vendor must disclose all data flows, and information stored within the cloud, and what solution is provided as a part of the cloud/external IT services offerings.

All Cloud offerings must first be FEDRAMP approved prior to delivery/installation/acceptance of the device.

FEDRAMP approval must be commiserate with requirements for information categories (PHI/PII must meet IL-4 requirements).

Interface Interface shall support the DMLSS Legacy - Point of Care Inventory Management System (POC-IMS)

POC-IMS tracks the storage and distribution of any kind of inventory used in patient care environments.