Solicitation - HT9427-26-R-E017.pdf

WOMEN-OWNED SMALL

BUSINESS (WOSB)

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

REQUEST

FOR QUOTE

(RFQ)

INVITATION

FOR BID

(IFB)

REQUEST

FOR

PROPOSAL

(RFP)

SEE ADDENDUM

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

29. AWARD OF CONTRACT: REFERENCE OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON

BOARD (FOB) DESTINATION

UNLESS BLOCK IS MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

8(A)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30.

Solicitation/Contract Form Enterprise Dose Monitoring

Product Service Code: 7B20

HT942726RE017

Supplies or Services & Prices or Costs Additional Information/Notes

Item Supplies / Services Quantity Unit Unit Price Amount

Enterprise Dose Monitoring Software License, installation, training.

Multiple invoices are authorized.

System Identifier: Enterprise Dose Monitoring System Product Service Code: 7B20 Pricing Arrangement: Firm Fixed Price

1 Job

5 Year Dose Monitor Software Maintenance Agreement. Multiple invoices are authorized.

Service Rendered: Enterprise Dose Monitoring System Training Product Service Code: 7B20 Pricing Arrangement: Firm Fixed Price

1 Job

Description/Specifications/Statement of Work Addendum to 52.212-4

Amend Paragraph 52.212-4 (b) to include - The contractor shall provide the following, and affirm the ability to meet the minimum essential characteristics (MECS) for the Enterprise Dose Monitoring

The contractor shall deliver software and configure it as necessary to establish connectivity throughout the infrastructure. The ultimate service goal is to consolidate site local Dose Monitoring systems to a single enterprise dose monitoring solution to provide standardization across the Defense Health Agency (DHA). This task includes but is not limited to:

i. Implementation at government hosted virtual environment not directly associated with any currently deployed Picture Archiving and Communication System (PACS). This virtual environment will be used for the complete implementation of the solution to include training and Risk Management Framework (RMF) (if no current Authority to Operate (ATO)).

ii. Standardize system configurations throughout the DHA Enterprise

M E C

Description

1 Support for all ionizing modalities

2 Validated with volumes >10M exams/year

Ability to provide event alerts/notifications to include the ability to attach follow-up reports or notes in response to alerts. Should track who provided responses and be searchable

4 Must be IHE (Integrated Healthcare Enterprise) compliant

Must support SSDE calculated according to TG204 report or Water Equivalent Diameter and be American Association of Physicists in Medicine (AAPM) customer selectable

6 Must support multiple outputs to Radiology and Hospital Information Systems as well as PACS

Must support for the new Centers for Medicare and Medicaid Services (CMS) Computed Tomography (CT) Noise Index Electronic Clinical Quality Measures (eCQM) as well as metrics for both noise and repeat rate

8 Must support capability to export DHA doses to the Global Dose Registry for dose comparisons as needed by user.

9 Must display individual patient study detail as well as complete patient imaging lifetime dose record for studies created within DHA.

Pre-exam and post-exam (automatic) organ dose calculations for modalities which produce ionizing radiation

Realistic anatomy based on the International Commission on Radiological Protection (ICRP) reference phantoms, higher age resolution, the most up-to-date bone marrow dosimetry, and use of dose models for peds, adult, women/men, and different weights

Must have full integration with PowerScribe 360 and PowerScribe 1

Must support all the following values for analytics and reporting.

- Referring Physician

- Study Common Name

- Studies with Alerts

- Date Range

- Age

- Weight

- Gender (Male/Female only)

- Procedure Code

- Accession Number

- Patient MRN

- Patient Name

- Percentile

- Diagnostic Reference Levels (DRLs)

- Facility/Trust

- Department

- Device

- Dose Type

- Pregnancy status.

- Accession Number

- Alert Note

- Alert Rule

- Body Part

- Description

- Operator/ radiographer

- Performing Physician

- Modality Type

Must integrate for DICOM data bi-directional with DHA Radiology PACS

Must perform body part mapping or study common name procedure mapping

Must be able to limit functionality based on user role

Must support system access through use of CAC

Must have the ability to provide contrast tracking

Must provide Auto-generation of Leapfrog submission data

Must have the ability to capture exam acquiring radiation dose by Technologist

Must be able to support study splitting with dose per segment as well as organ per segment

Must provide an embedded viewer or dashboard or system administrators

Must include a dashboard for system administrators to monitor the solution

The contractor shall provide a detailed topography document to include how the enterprise system will be configured and deployed with submission.

The document will be updated to reflect any changes during implementation within 7 calendar days prior to Go-Live .(Deliverable #1)

Must offer/implement the most commercially available software version which has a DHA Enterprise level ATO. The entire solution must be commercially available at time of submission that meets or exceeds the MECs outlined in this document, no future features and functionality of the solution will be considered.

The contractor shall include maintenance support for the enterprise software solution over the contract period of 5 years.

The contractor must include software updates/upgrades, to include any professional services required to maintain the application version deployed to the current commercially available software version.

The contractor shall not make software updates/upgrades without written approval from the PACS Program Management Office (PMO).

The contractor shall provide applications training for up to 100 individuals hosted at the 12 PACS Hubs across the enterprise and the PMO. Training shall be conducted virtually once per PACS Hub with connected sites. One virtual session shall be recorded and saved for future training purposes.

Hub locations are as follows:

i. Tripler Army Medical Center, HI

ii. Brian D. Allgood, Korea

iii. Evans Army Community Hospital, CO

iv. Madigan Army Community Hospital, WA

v. Brooke Army Medical Center, TX

vi. Walter Reed National Military Medical Center, MD

vii. Womack Army Medical Center, NC

viii. Landstuhl Regional Medical Center, Germany

ix. Blanchfield Army Community Hospital, KY

x. Eisenhower Army Community Medical Center, GA

xi. Portsmouth Naval Medical Center, VA

xii. Naval Medical Center San Deigo, CA

The contractor shall assign a Project Manager (PM) and have initial kick off meeting with PACS PMO within 30 calendar days of award Meeting .

minutes must be provided by the contractor within 48 hours of the meeting conclusion (Deliverable #2).

1 Kick off meeting with PACS PMO, PACS hubs, connected sites, and network hosting team between 60-90 calendar days of award. (Deliverable #3).

The contractor shall deliver a draft project plan at proposal submission and a final project plan within 30 calendar days after award of the contract; and every 30 calendar days until project completion. The project plan shall include detailed implementation information with specific tasks and a timeline for all sites at time of submission. (Deliverable #4).

Project plan shall include the following:

i. The project plan shall include the start of delivery of software within 60 calendar days of award of the contract and installation shall begin within 90 calendar days of award. All sites must Go-live (clinically in use) within 12-months of contract award.

ii. The project plan shall include detailed implementation information that highlights the key deliverables, timelines, and expectations of each party responsible for delivery, configuration, and final acceptance of the systems Comprehensive implementation plan to install all systems, including total number of project managers and implementation team(s) involved.

iii. Detailed steps and task owners for implementation as well as expected completion time for each task.

iv. Proposed timeline for production Go-live for all implementations. "Go-live" date is met by full clinical usage of the system with fulfillment of migration requirements related to Go-live with no reliance on the legacy system.

The contractor shall host weekly status meetings with the Government representatives; contractor shall provide meeting agenda 24 hours prior to meeting and provide meeting minutes within 48 hours of the meeting conclusion. Meeting minutes shall be provided in PDF format. (Deliverable #5).

Contractor shall be provided an environment for a test system to be utilized for RMF and application testing.

The contractor shall validate functionality of software in accordance with RMF accreditation documentation. RMF/ATO must continually be updated to meet the requirements of MECS 23 and 24.

DoD Cybersecurity/Risk Management Framework (RMF):

Vendor must comply with RMF Security Technical Implementation Guides (STIG) requirements and scan for vulnerabilities with DoD provided Nessus vulnerability scan software monthly.

A. The DoD Cybersecurity/Risk Management Framework critical requirements for cybersecurity and supply chain risk management shall be included in all applicable solicitations and contracts for Information or Communication Technology (ICT), including medical devices. The language below addresses both the prohibition of components from foreign adversaries and the assurance of secure software development and vulnerability management practices.

Compliance with the requirements herein is a material contract requirement. The Contractor acknowledges that effective Information and Communications Technology Supply Chain (ICTS) management, including all constituent software, firmware, and hardware, is critical to DHA's mission and security and integrity of the DoD Information Network.

1. Vendors shall only offer items, including third-party vendor items, which already have an Authorization or Approval to Operate (ATO), or items for which the vendor, and third-party vendor if applicable, agrees to go through the RMF approval process and obtain an RMF ATO.

(a) Vendors, and any third-party vendor items, must meet all cybersecurity requirements listed in the MDE PMO Cybersecurity Requirements_RMF Requirements in Attachment

1. These cybersecurity requirements are listed as minimum requirements 01-19.

(b) Any offered system must meet DoD Cybersecurity/Risk Management Framework (RMF) and the attached MDE Cybersecurity/Risk Management Framework document;

Attachment 2 - MDE Cybersecurity_RMF Contracting Requirements V3.0). Vendors must provide a statement with its offer that they, and any third-party vendors, agree to the Cybersecurity/RMF Requirements, HIPAA requirements, and B2B requirements.

(c) Vendors are required to provide a completed CyberLOG-MDE PMO Medical Device and Equipment Risk Assessment (MDERA) Questionnaire (Attachment 3 -MDE PMO Cyber_MDERA v7.0) for the offered system along with its offer. This includes any third-party vendor items.

(d) Submitting an offer for any requirement under this initiative constitutes full agreement to all specific RMF requirements listed in this RFO and Attachment 2 (MDE PMO Cybersecurity_RMF Contracting Requirements V3.0).

This includes:

2. For all MDE identified by the Government as requiring a full Assess and Authorize (A&A) approval, including IV&V test, the vendor shall not make any delivery and shall not receive payment until the Authorizing Official (AO) approves the medical device and equipment to be installed at the site and connected to the MedCOI network. Delivery of all system components, including any 3rd party items, may take place prior to this milestone (AO approval) only if written permission is provided by the Contracting Officer.

3. For all MDE identified by the Government as requiring an Assess and Incorporate (A&I) approval, the vendor shall not make any delivery and shall not receive payment until the PMO has completed a review of submitted RMF documentation and technical results, And the Authorizing Official (AO) approves the medical device and equipment to be installed at the site and connected to the MedCOI network. Delivery of all system components including any 3rd party items, may take place prior to this milestone only if written permission is provided by the Contracting Officer.

4. For all MDE identified by the Government as requiring an Assess and Use (A&U) approval, the vendor must receive written confirmation from the MDE PMO or Contracting Officer that the Authorizing Official (AO) approves the medical device and equipment to be installed at the site and connected to the MedCOI network, then the vendor may proceed with delivery.

5. Prior to final acceptance and installation, as a part of acceptance testing, the vendor shall provide procedures for the accepting sites to ensure the delivered device matches the DHA authorized configuration. The vendor shall coordinate running Nessus and SCAP scans with the site and the assigned DHA Cybersecurity Analyst to verify compliance. Any deviations from the approved configuration will require the vendor to bring the system into compliance before final acceptance and payment.

6. The vendor shall maintain an DHA RMF ATO on all equipment/product versions, owned or operated by the DHA, and covered under this contract/order. If the vendor cannot support the DHA RMF ATO for all DHA contract/ordered versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the DHA RMF ATO, either at no cost to the Government or at a fixed price that is included in a subsequent SMA offering under the vendor's contract/order. During the period of time the vendor's product is installed on the DHA network, the vendor shall provide all required cybersecurity patches/updates/upgrades, including Operating System and application upgrades where necessary. Maintaining the DHA RMF ATO shall be included as part of the vendor's warranty. For updates/patches, executable files shall be distributed by the vendor accordingly, or implemented by the manufacturer's technical staff, dependent on the contract/order processes.

7. Maintaining DHA RMF ATO shall be included as part of the vendor's warranty period.

8. All RMF costs related to the initial purchase of the equipment must be added to the vendor's long-term contract prior to award.

9. Vendors must clearly state in their offer if there are any costs associated with RMF support for any support term, including life of the system.

RMF support is defined as the support required to maintain the DHA RMF ATO by providing all required cybersecurity patches/ updates/upgrades, including Operating System and application upgrades where necessary.

10. Failure to agree to the attached DHA Cybersecurity Requirements document, disclose third-party vendor items requiring DHA RMF ATO provide a completed Attachment 3 -MDE PMO Cyber_MDERA v 7.0 questionnaire, and provide or state any RMF related costs, may result in rejection of the vendor's offer. Failing to disclose that a system has third-party components requiring RMF Approval, the system cannot meet RMF requirements, failure to meet certification timeframes or failure to receive DHA RMF ATO, including third-party items, may result in termination for cause in accordance with FAR 52.212-4(m).

NOTE: Any weaknesses may be mitigated through other RMF requirements and vendor must indicate how any issue can be mitigated.

Unmitigated weakness could be severe as to lead to a vendor being unable to receive an ATO.

B. The following shall be provided as part of the vendor's technical proposal. The completeness and quality of these submissions will be used to assess the offeror's security maturity and will be a key factor in the Government's evaluation of competing proposals.

1. Prohibition on Foreign Adversary Sourcing and Certain Telecommunications and Video Surveillance Services and Equipment:

The Vendor represents and warrants that the 'company' and its subcontractors or suppliers thereof do not incorporate hardware (including components), software, or firmware to be supplied under a contract that is manufactured, assembled, or otherwise sourced, in whole or in part, consisting of the product types or services contained in the 'Covered List' at https://www.fcc.gov/ supplychain/coveredlist, or from any supplier who is an affiliate or otherwise controlled by a 'Foreign Adversary Country'. "Foreign Adversary Country" is defined as the Peoples Republic of China, the Russian Federation, North Korea, Iran, and Venezuela (Madura Regime), and any other actor identified by the Secretary of War or Office or the Director of National Intelligence. With regard specifically to the supply of classes of equipment only, these prohibitions do not apply to equipment or components that "cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that

Representations and declarations shall be made consistent with FAR such equipment transmits or otherwise handles."

52.204-24 and DFARS 252.204-7017, which are not limited to covered equipment or their components except as described in the "Covered List".

2. Bills of Material (HBOM/SBOM)

The Vendor shall provide a comprehensive Hardware and Software Bill of Materials (HBOM/SBOM) for all products to be provided in response to this solicitation or to be provided under this contract. Reference the CISA Hardware Bill of Material Framework for Supply Chain Risk Management and the CISA 2025 Minimum Essential Requirements for Software Bills of Material. The resultant BOMs must include:

(a) The supplier and/or manufacturer, and country of origin for each electronic component.

(b) Identification of any components sourced (in whole or in part) from a Foreign Adversary Country, Prohibited Source of Supply, or any non-TAA Compliant Country.

(c) Other information as is required under the representation provided in compliance to FAR 52.204-24 and DFARS 252.204-7017.

The SBOM and HBOM submitted and accepted by the Government at the time of award shall be considered the baseline for the delivered system and or equipment.

3. Secure Development Practices and ICT Supply Chain Risk Management (SCRM)

Using NIST SP 800-218 as a reference, and as applicable to the vendors' product(s) to be delivered under the contract, the vendor must demonstrate, based on its own documented procedures, a commitment to secure software development practices.

The vendor must also demonstrate that it has processes and procedures in-place for vetting third-party components (hardware and software), managing open-source software and related supplier and supply chain risks, managing changes to system and component configuration, and discovering and responding to vulnerabilities.

4. HBOM and SBOM Change Management

The vendor shall be responsible for change management and notification to the Government in cases where there have been changes to the baseline HBOM and SBOM post award. Notification of the COR will be required under the following conditions:

HT942726RE017

https://www.fcc.gov/supplychain/coveredlist

(a) Upon any Software/Firmware Update: An updated SBOM shall be delivered within 15 business days of the release of any software or firmware update which would impact the product or component baseline for subsequent deliveries under the contract.

(b) Upon Hardware Component Revision: An updated HBOM shall be delivered if any hardware component of the system undergoes a revision or part substitution which would impact the configuration of devices delivered under the contract.

(c) Upon Government Request: The Contractor shall provide the most current SBOM and HBOM within 30 days of a request from the COR.

5. Vulnerability Management, Continuous Monitoring and Notification of Non-Compliance

Post award, and every 90 days thereafter, the vendor shall monitor the list of prohibited equipment and or services at https:// www.fcc.gov/supplychain/coveredlist, or otherwise posted to SAM.gov. Should the vendor based on these Government sources or through any other source including any subcontractor or supplier, determine that any equipment or component violates these requirements relative to prohibited sources of supply, the Vendor shall:

(a) Notify the Contracting Officer within 3 business days of discovery and follow the other reporting procedures under FAR 52.204-25 and DFARS 252.204-7018.

(b) Within 30 days of discovery, provide a detailed mitigation strategy to address any potential security risks, including required configuration changes and/or upgrades that would remediate the potential risks.

(c) If the component is deemed critical to the operation of the system relative to the system functional requirements or specifications, and cannot otherwise be mitigated or remediated, provide an alternative sourcing plan for the affected component within 30 days of notification.

In addition, the vendor shall proactively monitor all components in the baseline SBOM/HBOM for new vulnerabilities. For any 'High' or 'Critical' severity vulnerability (CVSS v3.x score of 7.0 or higher), the Contractor shall notify the COR and the DHA Cyber Operations Center within 72 hours of discovery using secure mail or by contacting the DHA Cyber Operations Watch Desk at (866)-786-4432. This notification must include the CVE, a description of vulnerability, the affected components, potential impact, and immediate mitigation instructions. A formal remediation plan and timeline for corrective action shall be delivered within 30 days of notification.

6. Government Review, Validation and Approval

All mitigation strategies, remediation plans, and alternative sourcing plans are subject to the Defense Health Agency's (DHA) review and written approval. The Vendor's ability to adequately address ICT supply chain risks to DHA's satisfaction will be a critical factor in the assessment of contract performance. Independent review and verification can include, but is not limited to, analysis of the delivered SBOM/HBOM and sources of supply, physical inspection of components, vulnerability scanning of the system or components to validate hardware, software and firmware configuration. In case of non-compliance with these requirements, or misrepresentations, the Agency may implement whatever remedies under the contract that it deems appropriate or necessary. Current policy and regulations state that in some cases, non-compliance with these requirements will render the vendor, company, or a supplier ineligible for subsequent awards.

7. Support for Risk Management Framework (RMF)

The Vendor shall provide all necessary cooperation and required artifacts for the Government to obtain and maintain the necessary approvals under the Risk Management Framework (RMF) as required to operate the system A (Deliverable #6).

system or device which cannot attain the necessary approvals cannot reside on the DHA information network. Prior to first unit delivery, and not later than 30 days from the date of award, the vendor shall provide the following artifacts to the COR and Project Management Office's designated Information Systems Security Manager:

(a) System Architecture Diagram (required in all cases except where the configuration consists of a single stand-alone device)

(b) Completed DHA Security Questionnaire

(c) Hardware and Software Bills of Material (provided as part of the Solicitation or updated at time of Award)

(d) Comprehensive discovery, configuration, and vulnerability scans (all system components and devices), using Tenable Nessus

And within 60 days:

- Completed Controls Selection Worksheet (as provided by the Government for the system, component(s), or device(s)

No system components or devices are to be delivered, nor will the Government be responsible for payment for any system component or device, subject to the RMF process, until the minimum required artifacts are delivered and accepted by the Government. If the complexity of the system, component, or device requires configuration or integration, such that validation of the security configuration cannot be done independently, the vendor may propose a vendor site inspection and validation to occur not later than 90 days from award. The vendor will still be responsible for the 30 and 60 deliverables listed above excluding the comprehensive discovery, configuration, and vulnerability scans which would be done at the vendor site. The vendor site must be located in the continental United States (lower 48 States). Final artifacts will be due 30 days after the inspection and pending approval and acceptance by the Government.

8. Flow-down Requirements

HT942726RE017

Relative to the requirements for prohibited sources of supply under FAR Subpart 4.21 and associated clauses, the Vendor (Contractor) shall insert the substance of these requirements as well as the clause at DFARS 252.204-7018 in all subcontracts and other contractual instruments for the acquisition of commercial products or commercial services under the prime contract.

VENDORS MUST MEET ALL OF THE RMF MINIMUM REQUIREMENTS LISTED IN Attachment 1

The contractor shall provide vulnerability scan and Security Content Automation Protocol (SCAP) scan results to DHA cybersecurity POC on a monthly basis. Contractor shall provide raw scan results and administrative reports, 30 calendar days after contract award and by the 10th of each month thereafter. (Deliverable #7).

The contractor shall submit a drawing for/from RMF/ATO package to clearly demonstrate any 3rd party vendors being quoted are within the vendors boundary. Initial drawing shall be submitted with their proposal and will be updated as required for RMF Certification and Accreditation to achieve ATO.

(Deliverable #8).

Business-to-Business (B2B) remote connection cannot be guaranteed. At times the B2B may not be available due to a variety of issues. If this happens, the contractor is still responsible to implement, and to maintain the up time of the system. If needed, the contractor shall send someone to the site to address any issue if progress is not shown within 48 hours. Contractor shall include costs for onsite installation and maintenance in the event B2B connection is not available or is not approved for a connection. The absence or lack of remote connectivity shall not delay implementation of system or configuration.

The DHA will determine the need to perform AT at a single PACS hub or multiple hubs as the implementation progresses. AT will be performed by Subject Matter Experts from the DHA PMO.

MILESTONE PERFORMANCE SCHEDULE

Month Tasks/Milestones Completed

Month

Kick Off Meeting with DHA PMO and vendor, project plan presented and agreed to by Govt and vendor.

Month

2 - 3 Kick Off meeting with PACS hubs, Network hosting team and software/licenses delivered

Month

4-9

Implementation and configuration of software

PACS desktop integration configuration

Month

Configuration and integration testing with Super Users and DHA PMO

Month

System Administrator and User applications training

Month

System Go-live and DHA AT and validation

DELIVERABLES SCHEDULE

Deliverable Frequency Medium/Format Submit To

A p pl ic a bl e to

Deliverable #1: Detailed topography

With submission and 7 calendar days prior to Go-Live Contractor's discretion

COR

and Site

POC

M E C s

Deliverable #2:

Contractor shall assign a Project Manager (PM) and conduct initial kickoff meeting with PMO.

Within 30 calendar days of award and provide meeting minutes within 48 hours of the meeting conclusion

Contractor's discretion

COR

and Site

POC

M E C s

Deliverable #3:

Kick off meeting with PACS PMO, PACS hubs, connected sites, and network hosting team

Between 60-90 calendar days of award Contractor's discretion

COR

and Site

POC

M E C s

Deliverable #4: Detailed project plan/Site-by-site project plan

Draft with submission proposal; Final within 30 calendar days after contract award; and every 30 calendar days until project completion

Contractor's discretion

COR

and Site

POC

M E C s

Deliverable #5:

Weekly status meetings

Weekly status meetings, provide meeting agenda 24 hours prior to meeting and provide meeting minutes within 48 hours of the meeting conclusion

Contractor's discretion/ Minutes in PDF format

COR

and Site

POC

M E C s

Deliverable #6:

Provide artifacts to maintain ATO

Within 30 days of completion of each site installation and complete inventory at the completion of project. Vendor shall provide required scans, and patch updates every 30 calendar days

Contractor's discretion

COR

and Site

POC

M E C s 6.

Deliverable #7:

Vulnerability and SCAP scan results

Initial results due 30 calendar days after contract award and by the 10th of each month thereafter.

As required for RMF Certification and Accreditation to achieve ATO

COR

and

DHA

Cyber

POC

M E C s 7.

Deliverable #8:

Artifacts and Documentation required for RMF Certification and Accreditation

At proposal submission and as required for RMF Certification and Accreditation to achieve ATO.

As required for RMF Certification and Accreditation to achieve ATO

COR

and

DHA

Cyber

POC

M E C s 8.

Requirements Single, enterprise-wide dose monitoring system.

Packaging and Marking

Inspection and Acceptance Overall Contract Inspection/Acceptance Locations

Authorized Accepting Official

Acceptance Destination Instructions: See Contract Terms and Conditions for Inspection and Acceptance criteria.

DoDAAC: HT1267 CountryCode: USA

DHA PEO MEDICAL SYSTEMS

INTEGRATED CLINICAL SYSTEMS, 693 NEIMAN STREET

FORT DETRICK, MD 21702

UNITED STATES

David Ludwig Email: david.g.ludwig.civ@health.mil

Authorized Accepting Official

Acceptance Destination Instructions: See Contract Terms and Conditions for Inspection and Acceptance criteria.

DoDAAC: HT1267 CountryCode: USA

DHA PEO MEDICAL SYSTEMS

INTEGRATED CLINICAL SYSTEMS, 693 NEIMAN STREET

FORT DETRICK, MD 21702

UNITED STATES

David Ludwig Email: david.g.ludwig.civ@health.mil

Deliveries or Performance

Line Item Delivery Schedule Quantity Address and POC Special Handling/Notes

Delivery Requested By Delivery Date 15 Sep 2027

1 Job Place of Performance DoDAAC: HT1267 CountryCode: USA

DHA PEO MEDICAL SYSTEMS

INTEGRATED CLINICAL SYSTEMS, 693 NEIMAN STREET

FORT DETRICK, MD 21702

UNITED STATES

David Ludwig Email: david.g.ludwig.civ@health.mil

FoB Details Contractor Destination

Delivery Requested By Delivery Date 15 Sep 2031

1 Job Place of Performance DoDAAC: HT1267 CountryCode: USA

DHA PEO MEDICAL SYSTEMS

INTEGRATED CLINICAL SYSTEMS, 693 NEIMAN STREET

FORT DETRICK, MD 21702

UNITED STATES

David Ludwig Email: david.g.ludwig.civ@health.mil

FoB Details Contractor Destination

Contract Administration Data

DFARS Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

252.201-7000 Contracting Officer's Representative. Dec 1991 252.232-7003 Electronic Submission of Payment Requests and Receiving Reports. Dec 2018

DFARS Clauses Incorporated by Full Text

252.232-7006 Wide Area WorkFlow Payment Instructions. (Jan 2023)

WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) As used in this clause- Definitions.

"Department of Defense Activity Address Code (DoDAAC)" is a six position code that uniquely identifies a unit, activity, or organization.

"Document type" means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

"Local processing office (LPO)" is the office responsible for payment certification when payment certification is done external to the entitlement system.

"Payment request" and "receiving report" are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Electronic invoicing.

Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) To access WAWF, the Contractor shall- WAWF access.

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before WAWF training.

submitting payment requests through WAWF. Both can be accessed by selecting the "Web Based Training" link on the WAWF home page at https://wawf.eb.mil/

(e) Document submissions may be via web entry, Electronic Data Interchange, or File Transfer Protocol. WAWF methods of document submission.

(f) The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this WAWF payment instructions.

contract or task or delivery order:

(1) The Contractor shall submit payment requests using the following document type(s): Document type.

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items-

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

2in1 Invoice

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) ) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF "combo" document type to create some combinations of invoice and receiving report in one step.]

(3) The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating Document routing.

payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC HQ0490

Issue By DoDAAC HT9427

Admin DoDAAC HT9427

Inspect By DoDAAC N/A

Ship To Code N/A

Ship From Code N/A

Mark For Code N/A

Service Approver (DoDAAC) HT1267

Service Acceptor (DoDAAC) HT1267

Accept at Other DoDAAC N/A

LPO DoDAAC N/A

DCAA Auditor DoDAAC N/A

Other DoDAAC(s) N/A

(4) The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance Payment request.

with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F. Receiving report.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity's WAWF point of contact.

To be determined at time of Award

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)

Special Contract Requirements

Addendum to Revolutionary FAR Overhaul (RFO) 52.212-1 Instructions to Offerors - Commercial Items

This Request for Proposal (RFP)is in support of an Enterprise Dose Monitoring System, Defense Health Agency (DHA), Medical Device and Equipment Program Management Office (MDE-PMO).

This requirement is being solicited as 100% Small Business set-aside under the North American Industry Classification Code (NAICS) 513210, Software Publishers. The size standard for NAICS 513210 is $47,000,000 million.

1. Specific Requirements.

This requirement will result in a Firm-Fixed Price (FFP) contract. Performance requirements for this contract are provided in the Minimum Essential Characteristics (MECs).

2. Delivery Date.

The estimated final delivery date for this contract is as follows:

CLIN CLIN Description Estimated Final Deliverable Date

0001 Enterprise Dose Monitoring Software, Installation and Training 15 SEP 2027

0002 Maintenance 15 SEP 2031

3. Proposal Content and Instructions for Preparation ofProposals.

This section specifies the format and content that the Offeror shall use in this RFP. The Offeror must submit a proposal that is legible and comprehensive enough to provide the basis for a sound evaluation by the Government. Information provided should be precise, factual, and complete. Legibility, clarity, completeness, and responsiveness are of the utmost importance. The proposal shall be in the form prescribed by, and shall contain a response to, each of the areas identified in the Addendum to 52.212-1.

Paragraph 52.212-1(a)(4) is hereby amended to include:

The proposal shall be submitted in two separate volumes:

Volume I* - Technical Proposal.

Volume II - Business Proposal.

*No pricing information shall be included in Volume I.

Administrative Format Instructions.

Each volume should contain the following items in addition to the technical/descriptive data required by this RFP:

- Cover Page which includes the following:

- RFP Number;

- Offeror name, mailing address, and website address;

- Unique Entity ID;

- Commercial and Government Entity (CAGE) Code;

- Date submitted and proposal expiration date;

- All of the above-cited information for each entity on the proposed team, if a team is proposed;

- Type of Company (i.e., small business, 8(a), woman owned, veteran owned etc.) as validated via the System for Award Management (SAM);

- Company Point of Contact (POC), Phone and Email address; and

- Table of contents, which provides sufficient detail as to allow the important elements to be easily located; and

- Each page of each document should have a footer indicating the name of the Offeror, "page X of Y," and the following legend "Source Selection Information: See FAR Part 3.104."

Formatting.

Proposal content shall be in Microsoft Office for Windows format (1997-2003 or newer), either .doc or .docx file and/or searchable Adobe Acrobat(PDF file), with one (1) inch margins all around, Times New Roman font of not less than ten (10) point font size.

Page .Limits

The Volume I - Technical Proposal is limited to twenty (20) single-sided pages. Pages should be numbered consecutively throughout the document and not by sections. For any sections of a proposal with a defined page limit, pages exceeding the specified limit will be removed and not forwarded for evaluation. The following sections are not subject to the 20-page limit:

- Cover Page (Not to exceed one (1) single-sided page);

- Table of Contents; and

- Pricing Sheet

The Volume II - Business Proposal does not have a limit.

Volume I - Technical Proposal. The Offeror's Technical Proposal shall clearly reflect the Offeror's ability to execute and comply with the performance requirements identified in the MECs located in the addendum to 52.212-4. The Offeror's Technical Proposal, including any supporting documentation, is to be clear and concise.

Factor 1: Technical Capability.The Offeror shall submit a written Technical Capability that effectively demonstrates its overall ability to deliver the requirement in accordance with each of the subfactors below.

S u b f a c t o r

Description

1 Support for all ionizing modalities

2 Validated with volumes >10M exams/year

3 Ability to provide event alerts/notifications to include the ability to attach follow-up reports or notes in response to alerts. Should track who provided responses and be searchable

4 Must be IHE (Integrated Healthcare Enterprise) compliant

5 Must support SSDE calculated according to TG204 report or Water American Association of Physicists in Medicine (AAPM)

Equivalent Diameter and be customer selectable

6 Must support multiple outputs to Radiology and Hospital Information Systems as well as PACS

7 Must support for the new Centers for Medicare and Medicaid Services (CMS) Computed Tomography (CT) Noise Index Electronic Clinical Quality Measures (eCQM) as well as metrics for both noise and repeat rate

8 Must support capability to export DHA doses to the Global Dose Registry for dose comparisons as needed by user.

9 Must display individual patient study detail as well as complete patient imaging lifetime dose record for studies created within DHA.

Pre-exam and post-exam (automatic) organ dose calculations for modalities which produce ionizing radiation

Realistic anatomy based on the International Commission on Radiological Protection (ICRP) reference phantoms, higher age resolution, the most up-to-date bone marrow dosimetry, and use of dose models for peds, adult, women/men, and different weights

Must have full integration with PowerScribe 360 and PowerScribe 1

Must support all the following values for analytics and reporting.

- Referring Physician

- Study Common Name

- Studies with Alerts

- Date Range

- Age

- Weight

- Gender (Male/Female only)

- Procedure Code

- Accession Number

- Patient MRN

- Patient Name

- Percentile

- Diagnostic Reference Levels (DRLs)

- Facility/Trust

- Department

- Device

- Dose Type

- Pregnancy status.

- Accession Number

- Alert Note

- Alert Rule

- Body Part

- Description

- Operator/ radiographer

- Performing Physician

- Modality Type

Must integrate for DICOM data bi-directional with DHA Radiology PACS

Must perform body part mapping or study common name procedure mapping

Must be able to limit functionality based on user role

Must support system access through use of CAC

Must have the ability to provide contrast tracking

Must provide Auto-generation of Leapfrog submission data

Must have the ability to capture exam acquiring radiation dose by Technologist

Must be able to support study splitting with dose per segment as well as organ per segment

Must provide an embedded viewer or dashboard or system administrators

Must include a dashboard for system administrators to monitor the solution

The contractor shall provide a detailed topography document to include how the enterprise system will be configured and deployed with submission. The document will be updated to reflect any changes during implementation within 7 calendar days prior to Go-Live .(Deliverable #1)

Must offer/implement the most commercially available software version which has a DHA Enterprise level ATO.

The entire solution must be commercially available at time of submission that meets or exceeds the MECs outlined in this document, no future features and functionality of the solution will be considered.

The contractor shall include maintenance support for the enterprise software solution over the contract period of 5 years.

The contractor must include software updates/upgrades, to include any professional services required to maintain the application version deployed to the current commercially available software version.

The contractor shall not make software updates/upgrades without written approval from the PACS Program Management Office (PMO).

The contractor shall provide applications training for up to 100 individuals hosted at the 12 PACS Hubs across the enterprise and the PMO. Training shall be conducted virtually once per PACS Hub with connected sites. One virtual session shall be recorded and saved for future training purposes.

Hub locations are as follows:

i. Tripler Army Medical Center, HI

ii. Brian D. Allgood, Korea

iii. Evans Army Community Hospital, CO

iv. Madigan Army Community Hospital, WA

v. Brooke Army Medical Center, TX

vi. Walter Reed National Military Medical Center, MD

vii. Womack Army Medical Center, NC

viii. Landstuhl Regional Medical Center, Germany

ix. Blanchfield Army Community Hospital, KY

x. Eisenhower Army Community Medical Center, GA

xi. Portsmouth Naval Medical Center, VA

xii. Naval Medical Center San Deigo, CA

The contractor shall assign a Project Manager (PM) and have initial kick off meeting with PACS PMO within 30 calendar days of award Meeting minutes shall be provided by the contractor within 48 hours of meeting .

conclusion (Deliverable #2).

Kick off meeting with PACS PMO, PACS hubs, connected sites, and network hosting team between 60-90 calendar days of award. (Deliverable #3).

The contractor shall deliver a draft project plan at proposal submission and a final project plan within 30 calendar days after award of the contract; and every 30 calendar days until project completion. The project plan shall include detailed implementation information with specific tasks and a timeline for all sites at time of submission.

(Deliverable #4).

Project plan shall include the following:

i. The project plan shall include the start of delivery of software within 60 calendar days of award of the contract and installation shall begin within 90 calendar days of award. All sites must

Go-live (clinically in use) within 12-months of contract award.

ii. The project plan shall include detailed implementation information that highlights the key deliverables, timelines, and expectations of each party responsible for delivery, configuration, and final acceptance of the systems Comprehensive implementation plan to install all systems, including total number of project managers and implementation team(s) involved.

iii. Detailed steps and task owners for implementation as well as expected completion time for each task.

iv. Proposed timeline for production Go-live for all implementations. "Go-live" date is met by full clinical usage of the system with fulfillment of migration requirements related to Go-live with no reliance on the legacy system.

The contractor shall host weekly status meetings with the Government representatives; contractor shall provide meeting agenda 24 hours prior to meeting and provide meeting minutes within 48 hours of the meeting conclusion. Meeting minutes shall be provided in PDF format. (Deliverable #5).

Contractor shall be provided an environment for a test system to be utilized for RMF and application testing.

The contractor shall validate functionality of software in accordance with RMF accreditation documentation. RMF/ ATO must continually be updated to meet the requirements of MECS 23 and 24.

DoD Cybersecurity/Risk Management Framework (RMF):

Vendor must comply with RMF Security Technical Implementation Guides (STIG) requirements and scan for vulnerabilities with DoD provided Nessus vulnerability scan software monthly.

A. The DoD Cybersecurity/Risk Management Framework critical requirements for cybersecurity and supply chain risk management shall be included in all applicable solicitations and contracts for Information or Communication Technology (ICT), including medical devices. The language below addresses both the prohibition of components from foreign adversaries and the assurance of secure software development and vulnerability management practices.

Compliance with the requirements herein is a material contract requirement. The Contractor acknowledges that effective Information and Communications Technology Supply Chain (ICTS) management, including all constituent software, firmware, and hardware, is critical to DHA's mission and security and integrity of the DoD Information Network.

1. Vendors shall only offer items, including third-party vendor items, which already have an Authorization or Approval to Operate (ATO), or items for which the vendor, and third-party vendor if applicable, agrees to go through the RMF approval process and obtain an RMF ATO.

(a) Vendors, and any third-party vendor items, must meet all cybersecurity requirements listed in the MDE PMO Cybersecurity_RMF Requirements in Attachment 1. These cybersecurity requirements are listed as minimum requirements 01-19.

(b) Any offered system must meet DoD Cybersecurity/Risk Management Framework (RMF) and the attached MDE Cybersecurity/Risk Management Framework document;

Attachment 2 - MDE Cybersecurity_RMF Contracting Requirements V3.0). Vendors must provide a statement with its offer that they, and any…