SOURCES SOUGHT SYNOPSIS.pdf

SOURCES SOUGHT SYNOPSIS

The East Services Branch, Health Readiness Contracting Office (HRCO), Joint Base San Antonio, Fort Sam Houston, TX is issuing this sources sought synopsis as a means of conducting market research to identify parties having an interest in and the resources to support this requirement for one (1) full-time equivalent (FTE) non-personal services/health care IT support for Extract Lab Management System (ELMS), United States Army Centralized Allergen Extract Laboratory (USACAEL). The result of this market research will contribute to determining the method of procurement. The applicable North American Industry Classification System (NAICS) code assigned to this procurement is 541512 Computer Systems Design Services.

THERE IS NO SOLICITATION AT THIS TIME. This request for capability information does not constitute a request for proposals; submission of any information in response to this market survey is purely voluntary; the government assumes no financial responsibility for any costs incurred.

If your organization has the potential capacity to perform these contract services, please provide the following information: 1) Organization name, address, email address, Website address, telephone number, and size and type of ownership for the organization; and 2) Tailored capability statements addressing the particulars of this effort, with appropriate documentation supporting claims of organizational and staff capability. If significant subcontracting or teaming is anticipated in order to deliver technical capability, organizations should address the administrative and management structure of such arrangements.

[Note: In accordance with FAR 10.001(b), agencies should not request potential sources to submit more than the minimum information necessary.]

The government will evaluate market information to ascertain potential market capacity to provide all personnel, equipment, supplies, facilities, contractor transportation, tools, materials, supervision, other items and non-personal services necessary to procure one

(1) full-time equivalent (FTE) non-personal services/health care IT support for Extract Lab Management System (ELMS), as defined in APPENDIX 1, except for those items specified as government-furnished property and services.

BASED ON THE RESPONSES TO THIS SOURCES SOUGHT NOTICE/MARKET

RESEARCH, THIS REQUIREMENT MAY BE SET-ASIDE FOR SMALL BUSINESSES

OR PROCURED THROUGH FULL AND OPEN COMPETITION, but will be awarded as a single award. Telephone inquiries will not be accepted or acknowledged, and no feedback or evaluations will be provided to companies regarding their submissions.

Submission Instructions: Interested parties who consider themselves qualified to perform the above-listed services are invited to submit a response to this Sources Sought Notice by 31 October 2025 at 2:00PM EST. All responses under this Sources Sought Notice must be emailed to cotrena.y.brownjohnson.mil@health.mil.

mailto:cotrena.y.brownjohnson.mil@health.mil

APPENDIX 1: Excerpt from Statement of Work

PERFORMANCE BASED STATEMENT OF WORK

KIMBROUGH AMBULATORY CARE CENTER, FT MEADE, MARYLAND

United States Army Centralized Allergen Extract Laboratory (USACAEL)

Extract Lab Management System (ELMS) Enhancement and Upgrades

1. 0. INTRODUCTION.

The Contractor shall provide non-personal services/health care IT support for the United States Army Centralized Allergen Extract Laboratory (USACAEL), Kimbrough Ambulatory Care Center, Ft Meade, Maryland. The successful offeror shall provide one

(1) full-time equivalent (FTE) for non-personal services. The location of USACAEL is US Army Garrison-Forest Glen, 2460 Linden Lane, Building 512, Silver Spring, Maryland.

The services will be of a nature and scope described in the paragraphs below. The Contractor will work in conjunction with other health care providers, professionals, and non-contract personnel. The Contractor FTE shall provide the non-personal services of a computer software specialty team licensed to perform services of the nature and scope described in this Performance Work Statement (PWS). This Performance Work Statement (PWS) pertains to services rendered for the continued maintenance, required cybersecurity assurances, further development and enhancement of the United States Army Centralized Allergen Extract Laboratory’s web-based Extract Lab Management System (ELMS). The web-based automation tool is used in the support of the DoD Tri- Service and VAMC worldwide mission of USACAEL to order, process, formulate and disseminate allergen vaccine diagnostic testing and patient treatment biological to over 450 medical treatment facilities worldwide.

The period of performance 15 February 2026 to 14 February 2030. This will include a base of one year, plus three option-years.

Base: 15 February 2026 to 14 February 2027 Option Year 1: 15 February 2027 to 14 February 2028 Option Year 2: 15 February 2028 to 14 February 2029 Option Year 3: 15 February 2029 to 14 February 2030

1.01. Background

The United States Army Centralized Allergen Extract Lab (USACAEL) developed an end-to-end solution for the electronic web-based processing of immunotherapy treatment sets in the early 2000’s named the Extract Lab Management System (ELMS).

USACAEL is a unique operation servicing over 450 Department of Defense (Army, Navy, Air Force, and Coast Guard) and VA (Veterans Administration) healthcare sites worldwide to include the United States, Europe and Korea. USACAEL prides itself in the quality assured formulation and delivery of over 25-30,000 patient immunotherapy treatment sets and some 80-95,000 vials of allergen extract products annually. The implementation of the ELMS system allowed for a marked decrease in ordering errors and a significant increase in quality control. ELMS is designated as the DHA enterprise system of record, for the ordering, processing and formulation of immunotherapy treatment sets, for the DoD and VA.

ELMS is a mature web-based .NET application running on a SQL Server backend. Over the years, additional features and functional areas have been added to the ELMS system, including Shot Tracking and administrative components. The ELMS system hosting migrated from Ft. Detrick to DHA in 2023. The migration to the DHA enclave, required that the ELMS contractor complete the necessary steps to receive an Authority-to-Operate (ATO). An ATO was officially approved in January 2025 and is good through October 10th, 2027.

To remain in compliance with the ATO, specific steps must be routinely followed, and documentation of those steps loaded into the government’s Enterprise Mission Assurance Support Service (eMASS).

The USACAEL Extract Lab Management System (ELMS) with reference to the DHA DCOPS Branch Infrastructure and Operations Division (IOD) Service Level Agreement falls under Platform as a Service (PaaS) regarding customer responsibilities.

1.0.2. The quality of care provided by the FTE Contractor shall be of a quality meeting or exceeding currently recognized national standards as established by the Joint Commission (JC). The FTE shall give the highest regard to patient dignity and observe the precepts of the American Hospital Association’s Bill of Rights for Patients. The

Contractor shall abide by the Medical Treatment Facility (MTF) rules, regulations and by laws, including Medical Staff By laws, as well as applicable Army regulations governing such things as medical records.

1.1. GENERAL.

1.1.1. This contract is a non-personal services contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the government and its employees.

1.1.2. Responsibility and Procedures. If any suit or action is filed or any claim is made against the contract FTE, which occurred because of work performed by the FTE under this contract, the FTE shall immediately notify the contractor and the Contracting Officer and the chief of the appropriate services and promptly furnish them copies of all pertinent papers received.

1.1.3. The contractor and Contractor FTE shall cooperate with the government, without further compensation, in the processing, review, settlement, or defense of the suit, action, or claim; and authorize government representatives to settle or defend the claim and to represent the FTE in, or take charge of, any litigation involved in such an action.

The Contractor FTE may, at the Contractor FTE’s own expense, participate in defense of such claim or litigation.

1.1.4. Confidentiality / HIPAA. The Contractor FTE shall abide by AR 40-3 and AR 40- 66 concerning the nature of limited privileged communication concerning patient related record data. The Contractor FTE shall abide by AR 40-66 concerning the confidentiality of patient record data, as embodied in federal statutes including the Privacy Act of 1974 and the Drug and Alcohol Act, Public Law 92-129 and HIPAA. The Contractor FTE shall direct all requests for medical information on patients to the Chief, Patient Administration Division. The Contractor FTE shall not release any medical treatment or personal information on a patient without first receiving written approval from the government. Government will provide the regulations upon request by the Contractor

FTE.

1.1.5. Removal of Contractor FTE’s. At any time during the performance of this contract, the Contracting Officer or COR may direct the contractor to immediately remove any Contractor HCP whose actions or impaired state raises reasonable suspicion that clear and present danger of physical harm exists to other contractor FTEs, and other government personnel or to the impaired individual. This provision will be used in emergency situations only and not for the purpose of bringing performance issues or other non-urgent concerns to the attention of the contractor.

1.1.5.1. If the need for a removal occurs, the COR will contact the contractor's point of contact and direct the contractor to remove that individual from the military facility and to not use that individual to perform any healthcare services required under this contract until the issue has been resolved by the Contracting Officer. The contractor shall formally meet with the COR to discuss further action in accordance with the MTF Quality Assurance and Inspection (QA&I) Plan and AR 40-68. A review of the basis for removal will be made by the Contracting Officer within 3 working days after the COR directed the removal.

1.1.5.2. If, after any investigation deemed necessary by the Contracting Officer and discussions with the contractor's representative, the Contracting Officer concludes that the Contractor FTE’s impairment requires permanent removal from performance under the contract, the Contracting Officer will notify the contractor that permanent removal is required. In the event of disagreements between the government and the contractor's representative concerning matters of impaired Contractor FTE’s, the decision of the Contracting Officer will be final. During the period between the removal and the final decision of the Contracting Officer, the contractor shall provide a backup/replacement Contractor FTE in accordance with the terms and conditions of this contract.

1.1.6. Conflict of Interest. Contractor shall not be an employee of the United States Government if the employment would create a conflict of interest. The Contractor FTE who is an employee of the Department of Defense, either military or civilian, shall not be employed unless such person seeks and receives approval in accordance with DoD 5500.7-R and MEDCOM Reg 600-3.

2.0 SCOPE OF WORK:

This award is for the provision of continued maintenance, cybersecurity upgrades and certification/compliance (i.e., eMASS) renewals, modifications, and enhancements to the web-enabled Extract Lab Management System. The work will include technical project management, requirements analysis, design, development, implementation, and quality assurance necessary for the effective completion of all requested USACAEL project requirements, cybersecurity upgrades and DHA related hosting recommendations, requirements and maintenance as per the DHA Datacenter Operations (DCOPS) Branch Infrastructure and Operations Division (IOD) Service Level Agreement under Platform as a Service (PaaS) regarding customer responsibilities.

The contractor shall provide maintenance, enhancements, upgrades, and training services for the ELMS (Extract Lab Management System) web-based application. The contractor will be required to fulfill and perform the following activities:

• Work with USACAEL to implement updates to ELMS when guidelines or recommendations are changed.

o The application shall support the enterprise-wide compliance with allergy immunotherapy practice parameters as set forth by the Joint Task Force of the ACAAI and the AAAAI, from end to end, to positively connect patients to their treatment, plan, vials, correct dosage for each visit, pre and post shot special care, and provide alerts for defined circumstances.

• The system shall maintain a high level of operational / availability / responsiveness (system availability) that can be measured in terms of percentage of time end-user is able to access the system, exclusive of downtime of communications and other supporting systems (i.e., System up time/ (sys up-time+ sys down-time). The Contractor shall work with the platform provider (DCOPS) to ensure a high-level of system availability and up-time.

• The system shall provide role-based controlled access, for users, using a DOD CAC or VA PIV.

• The work will include technical project management, requirements analysis, design, development, implementation, and quality assurance necessary for the effective completion of all requested USACAEL project requirements, cybersecurity upgrades and DHA related hosting recommendations, requirements and maintenance as per the DHA Datacenter Operations (DCOPS) Branch Infrastructure and Operations Division (IOD) Service Level Agreement under Platform as a Service (PaaS) regarding customer responsibilities. As of August 2025, DCOPS supports Windows: Server 2019 or Server 2022 and Linux: Red Hat Enterprise Linux (RHEL) 8 or 9.

o The contractor shall be responsible for the completion and coordination of DCOPS Customer Responsibilities (listed below) for ELMS in support of USACAEL.

A. DHA DCOPS Platform as a Service (PaaS) Service Level Agreement (2025) Customer Responsibilities

Under the DHA Datacenter Operations’ Platform as a Service (PaaS) service tier, customer responsibilities per the Service Level Agreement V5.9, August 2025 include the following:

1. Deployment

Customer is responsible for:

• Completing and submitting the DHA Hosting Consolidated System Access Request Form (DD2875) for each system engineer requiring server access.

• Installing any server OS roles or features required for the functionality of their application that are not a part of the pre-built templates and/or baselining procedures.

• Obtaining, installing, troubleshooting, and configuring their application, application websites, application databases, database software and licensing, SSL certificates, and any additional required software not part of normal baselining procedures.

• Creating and maintaining any/all PPS documents.

• Completing any required STIGs that result from the installation of needed server

OS roles and features (for example, IIS server and site STIGs for Windows servers leveraging Microsoft Internet Information Services (IIS), and Apache STIGs for RHEL servers leveraging Apache).

• Completing any required STIGs from any additional required software not part of normal baselining procedures.

• Developing, testing, and notifying DCOPS Cyber Security of any STIG exceptions, to include justification(s)/mitigation(s). STIG exceptions will be maintained by the DCOPS GPO team within the PaaS customer-specific STIG exceptions Group Policy Object (GPO).

• Implementing data replication (or any other dependencies) between any production servers and permanent Continuity of Operations (COOP) servers that are part of a system’s design.

2. Patching & Security Vulnerability Remediation

Monthly OS patching will be performed in two groups, A side and B side, for each given server type to minimize the possibility of an outage or availability issue arising from patching activities. DCOPS shall assign servers to A side/B side using an even/odd server numbering scheme. Customer servers can be set to reboot or not reboot as part of patch deployments. Should customers choose the “no reboot” deployment, they assume responsibility for reboots, which are typically required to fully install patches and resolve security findings.

Customer is responsible for:

• Performing functionality testing of any patches in test/pre-production prior to their rollout to production. If DCOPS does not receive any feedback on patches impacting functionality, then DCOPS will proceed with production patching according to the schedules above. If any concerns are noted, DCOPS will make appropriate changes and/or notify EAS to modify enterprise deployments, as appropriate.

• Requesting monthly patching outside of the patching schedule listed above if needed. Any patching outside of the normal monthly patching schedule will have to be agreed to by DCOPS and the customer. Unique patching schedules are discouraged but can be considered based on system priority, availability of DCOPS engineers, patch urgency level, and in consideration of customer requirements for near-24/7 end-user availability. In most cases, specialty patching will consist of the deployment of patches with no associated reboot, which should prove non-disruptive and permit customers to perform reboots as they see fit.

• Requesting ad hoc patching requests due to the release of emergency/zero-day patches, a new server build, or other reasons. Requests are to be made by submission of a ServiceNow ticket and assigned to the appropriate queue based on the OS of the server(s).

• Performing patching/updates to third-party software that is not OS-related, notably Oracle Java, Oracle Database, MongoDB, Adobe ColdFusion, Perl, Python, Ruby, PHP, Apache, Tomcat API, or support libraries utilized by customer applications. This is not a comprehensive list of third-party software, but rather a series of examples to stress that customers maintain responsibility for third-party software that affects their applications.

• Performing all security vulnerability remediation, administration, requests, and renewals related to SSL certificates. However, DCOPS can provide procedural documentation on how to renew SSL certificates and can assist in this process upon request.

• Rebooting servers after patches have applied by DCOPS, if opting not to have DCOPS reboot them.

• Tracking when their server operating system goes end-of-life.

• Planning for the upgrade to a new server operating system, which requires

DCOPS Onboarding to build new servers and is done only at the request of the customer.

• Purchasing extended support subscriptions from Microsoft for Windows Server operating systems (typically available for three years after the end of standard support).

• Providing extended support keys to DCOPS PaaS Sustainment (if applicable).

3. Cybersecurity and Risk Management

Customer is responsible for:

• Obtaining their ATO, updating their ATO, completing Risk Assessments, or coordinating to be included in a broader ATO, such as a site or enclave ATO.

This is required prior to being hosted in any production environment. Note that hosted customer servers *are not* part of DCOPS-managed ATOs unless this is specifically agreed to between all parties prior to servers being made available to customers.

• Costs related to the accreditation including independent audits/IV&V.

• Creating and maintaining any/all IA and ATO-related artifacts.

• Requesting ACAS scans from DCOPS Cyber Security team.

• Performing STIG checks for any third-party software such as Apache Tomcat, Oracle Java, etc.

• Performing Application Security and Development (ASD) STIG checks and consulting with DCOPS Cyber Security about ASD checks that involve OS configurations.

• Completing all required Risk Management Framework (RMF) documentation in support of their own ATO.

• Performing all work in the Enterprise Mission Assurance Support System (eMASS) such as the creation and management of POAMs, security control responses, etc.

o DCOPS will provide documentation/explanation for POAMs that must be submitted because of inherent limitations in DCOPS hosting infrastructure.

o NOTE: All ACAS and STIG scans completed by DCOPS – specifically ACAS scans on DCOPS-hosted servers, as well as OS, .NET, and Windows browser STIGs – will be provided to the customer. The customer MUST then include that data in their own eMASS package for assessment.

• Modifying their eMASS packages.

• Requesting inheritance of controls through eMASS.

• Submitting a ServiceNow ticket detailing the document(s) or evidence being requested by the IV&V team for validating controls inherited from DCOPS.

• Responding to DCOPS Cyber Security requests for ACAS credential validation within 1 business day to ensure asset is reachable by the ACAS scanner.

• Requesting ad-hoc SCAP scans (if needed) and providing the asset list and list of STIGs being requested to be scanned.

• Responding to DCOPS requests for mitigation and justification verbiage for non-compliant IAVMs within 3 business days.

• Submitting tickets for AWS IAM related activities, including the creation, deletion, and modification of AWS IAM service accounts, roles, or policies.

• Ensuring that customer team members needing Write access to the AWS console have an ALT Token and up-to-date HIPAA and Cyber Awareness training certificates.

• Ensuring that customer team members needing Read-Only access to the AWS console have a CAC/PIV.

• Submitting tickets to rotate AWS CLI access keys bi-annually.

4. Backups/Restores

Customer is responsible for:

• Informing the DCOPS Backup and Storage team of any backup requirements or requests outside of the above parameters. Requests are to be submitted via a ServiceNow ticket.

• Obtaining IP addresses and implementing their PPS to mirror the configuration at their primary site when failover or a failover exercise is needed and permanently hosted COOP servers (i.e., warm/hot) were not part of a system’s design.

DCOPS does not have the ability or responsibility to perform those functions.

o *NOTE: If a COOP is needed, customers are strongly encouraged to have COOP servers accounted for as part of their architecture and deployed and configured at an alternate site instead of relying on server backups and restores for their failover/disaster recovery strategy.

• Appropriate VM snapshot management, as follows:

o DCOPS grants customers permission to perform basic administrative functions in vCenter by assigning customer personnel the "VM Owners" role. Customers may take, revert and consolidate snapshots on their virtual machines, among other functions.

o DCOPS follows Broadcom’s best practices for VM snapshots, which recommend keeping snapshots no longer than 72 hours and that individual machines should not have more than three VM snapshots in place at a time.

o DCOPS will automatically remove all snapshots once they reach 7 days in age. This process occurs via daily script and attempts to avoid virtual machine corruption that can be caused by aged snapshots. DCOPS strongly recommends that customers take and then promptly remove snapshots in accordance with vendor recommendations, rather than relying on this automated removal process. Customers may also consider reverting to a previous state by using a full server backup rather than a snapshot.

5. Sustainment Support Requests

Support requests should be submitted to DCOPS via a ServiceNow incident. The types of support provided to PaaS customers and who is responsible is as follows:

• Hardware and Virtualization Infrastructure Troubleshooting – DCOPS Platforms.

• System Administrator Access Issues (VM console access, AVHE remote access, and SSH access for Linux nodes) – DCOPS Service Availability.

• Backup Health Monitoring and Restores – DCOPS Backup and Storage.

• Patching & Server Troubleshooting Requests – DCOPS PaaS Sustainment

(Windows) or DCOPS Onboarding (Linux).

• OS-Related Troubleshooting Requests – DCOPS PaaS Sustainment.

• Requests for server restores or snapshots – DCOPS Backup and Storage OR

DCOPS PaaS Sustainment.

• Asset Decommissioning Requests – DCOPS Program Operations.

• ACAS and STIG Security Vulnerability Remediation Requests – DCOPS PaaS

Sustainment Response times for DCOPS support tickets are defined by the prioritization as follows. Note that these times are those by which DCOPS will provide initial customer engagement and triage, not necessarily issue resolution.

o Critical (Priority 1) – 90 mins o High (Priority 2) – 6 hours o Medium (Priority 3) – 3 business days o Low (Priority 4) – 4 business days

6. Change Requests

If a change is required to a hosted system (adding/removing servers and/or server resources), then the customer will submit a ServiceNow incident to the DCOPS Onboarding queue with the details of the changes needed. Details of the changes should be provided via updates to the existing Onboarding Form in the following fashion:

• Highlight any cells changed in yellow. For new servers, highlight the entire row.

• Highlight any servers needing to be removed by highlighting the entire row in red.

Each customer must have designated POCs that are authorized to request changes on behalf of the POR. Any/all submitted change requests must come from these designated change requester(s). Once DCOPS Onboarding receives the ticket; they will review the requested changes. The full scope of the change may warrant an updated Lifecycle Cost Estimate (LCCE) be created and signed/accepted before the requested changes can be made. The decision on whether an updated LCCE is needed is at the discretion of DCOPS.

B. USACAEL specific work project responsibilities, technical project management, requirements analysis, design, development, implementation, and quality assurance

Continued operational support, maintenance, and enhancements, as directed by USACAEL, for the following:

1. Management of ELMS Application Reports and Queries

• Generated workload reports: CPT (Current Procedural Technology) and E&M (Evaluation and Management)

• Continued support in the generation of standardized periodic reports examples:

wait times, reaction rates, shots given, by time; all details for a day; daily workload summary; daily QA summary; dosages of emergency medication; refills due by patient; non-compliance; recalled lot numbers; etc.

• Continued support for the capability to produce tailored reports from custom queries and role-based permissions to include administrative, internal user and external user reports and data inquiries

• Generate data queries from MTF clinical staff requests for data in support of scientific projects, reports and presentations

• Capability must exist for reports to be made available in various formats: PDF, Word doc, HTML, Excel, etc

• Assure compliance with patient identification information safeguards for output reports such as: "For Official Use Only"; Privacy Act; HIPAA.

2. ELMS Application Sustainment and Training Activities

• The application shall have a System Administration capability. This capability shall enable/update role-based access and manage USERNAMES and passwords, as directed.

• Provide for a Super System Administration capability to implement system-wide changes (update fields, codes), set up custom reports to support research, as approved by the Executive Data Manager.

• The provision of on-line help on specific topics (i.e. how to query, how to create reports etc.)

• Provide a high degree of Operationally Reliability for business IM/IT web-based systems.

• Initial training on functionality shall be provided to the system administrator.

• Initial train-the-trainer training shall be provided to stand up schoolhouse module and refresher training.

• Continued updating, development and enhancement of a user training guide for

ELMS and the ELMS shot tracker

• Provide printable training materials.

• Follow-up training shall be provided for upgrades.

3. ELMS Additional Mitigation of Risk/Cybersecurity Upgrades, Maintaining Full Authority to Operate (ATO)

• IV&V (Independent Verification and Validation): Maintaining compliance, colocation within DCOPS, and supporting and maintaining full ATO (Authority to Operate); versus a conditional ATO. Efforts to include:

o Coordination and facilitation of the IV&V process, as needed to maintain compliance:

Participation in the IV&V process to include the review of all ELMS

STIGs (Security Technical Implementation Guides). ELMS contains several hundred STIGs

Documentation of STIG exceptions and/or justifications:

Mitigation of identified issues; development & configuration

• Documentation, development and maintenance of policies and procedures to address the CCI (Common Control Identifier) controls. There are over 700 CCI related STIGs that require a corresponding policy and/or procedure o Updating of the ELMS Security Management plan as requested by IV&V audits and as required by DHA

• ATO (Authority to Operate): Maintain a full Authority to Operate to include:

o Completing the IV&V process and related tasks as noted above o Coordination and facilitation of the ATO process o Documentation of POAMs (Plan of Action and Milestones) for any area of the system that requires an exception or not in compliance o Full management of the ELMS ATO process through eMASS, including uploading of all required documents, plans, policies, etc. and administration of the ELMS ATO application package

4. ELMS Technology Upgrades

The ELMS web-application currently runs on Microsoft .NET version 4.8 and utilizes web-forms. While Microsoft plans to continue support for .NET v4.8 much of the industry is moving towards the latest .NET core offering (version 8), for a multitude of reasons.

Upgrading an ASP.NET Web Forms application to .NET Core provides several key advantages, including significantly improved performance, better scalability, cross-platform compatibility, access to modern development practices, enhanced security features, and the ability to leverage cloud-native technologies, making your application more efficient, maintainable, and future-proof compared to the older Web Forms framework. Key benefits of migrating to .NET Core:

• Performance Boost: .NET Core applications generally run faster and use less memory due to a lightweight architecture, leading to a better user experience especially under high traffic scenarios.

• Cross-Platform Support: Unlike Web Forms which are limited to Windows, .NET Core can run on Windows, Linux, and macOS, offering flexibility in deployment options

• Modern Development Practices: .NET Core incorporates modern features like dependency injection, asynchronous programming, and a cleaner code structure, enabling easier development and maintenance

• Cloud-Native Ready: .NET Core is designed with cloud services in mind, making it easier to integrate with cloud platforms like Azure and deploy containerized applications.

• Improved Security: .NET Core actively incorporates security best practices and receives regular security updates, minimizing potential vulnerabilities

• Modular Architecture: The modular design of .NET Core allows you to use only the components you need, reducing application size and improving performance

• Community Support: .NET Core has a large and active developer community, providing readily available libraries, tools, and support for troubleshooting

• Unit Testing: Improved ability to unit test features within applications; critical to IV&V / ATO processes

Contractor shall develop and implement a plan to upgrade ELMS to .NET Core version 8 (or latest log term supported version, at time of implementation. It is anticipated that the .NET upgrade will occur in phases, with planning, discovery, and requirements completed during the base period and implementation in follow-on periods.

5. Program Management

The contractor shall retain the services of a Program Manager to coordinate all requirements and any changes or modifications to ELMS and perform the following services:

• Provide technical support and ELMS programmatic leadership, consultation, teaching and assistance to the United States Army Centralized Allergen Extract Laboratory

• Meet with USACAEL management, leadership and staff to identify and resolve system problems

• Test programs and new applications to identify errors and oversee corrections by contract programmers and engineers

• Consult with users, management, vendors and technicians to assess computing needs and system enhancements and modifications budget and expenditures

• Develop computer information resources, providing for data security and control, strategic computing and disaster recovery

• Assist with the ELMS operations of the Allergen Extract Laboratory, providing USACAEL management with reporting capabilities and administrative tools

• Provide management and expertise in identifying, developing, and implementing computer systems and other major systems operations against predefined standards of operation as documented by systems designers

• Prepare and present to senior management operational reports and progress reports on specific projects

• Approve, schedule, plan and supervise the installation and testing of new products and improvements to the existing computer systems.

• Plan, coordinate and implement security measures to safeguard information

• Develop and review with senior management workflow charts to understand impact of new systems on existing and future workflow processes.

• Assess, develop and implement training programs for staff and users in the use of software applications

• Provide technical and programmatic leadership, consultation, teaching and assistance to the United States Army Centralized Allergen Extract Laboratory

• Analyze database, provide data statistics and write Queries or reports when special reporting is needed by management

• Establish and maintain a working relationship with the hosting activity. This interface will provide the incumbent guidance for formulating automation requirements, and standard hardware and software technical support

6. Technical Criteria

Contractor shall have proven and demonstratable experience with the following:

• Extensive knowledge and experience with the FAM “A” FAM “D” (Functional Area of Managemnnt for Data and Activity) model

• Knowledge of numerous Allergy-Immunology field applications and related clinical applications-some of the tables of which have been integrated with ELMS in the past

• Advanced experience with .NET Technology

• A strong understanding of SQL databases and Query writing and preferred access to the “back end of the database” with required authorization and certification

• Experience working with databases maintained in 5th normal form

• Access authorization to the “back end of the database”

• Employment of security safeguards as necessary as per DoD recommendations for remediation

• Knowledge of the RMF, PIA, and ATO approval and compliance processes

• Familiarity with preparation and submission of the Privacy Impact Assessment (PIA)

• A strong understanding or working relationship with the hosting organization’s certification and authorization requirements

• Experience with procurement and submission of the SSL Certificate

• A Strong understanding and previous demonstrated experience complying with DoD and DHA Security requirements o RM approval process o PIA (Privacy Impact Assessment) process o ATO (eMASS, IV&V)

7. Ad Hoc Support Services

The Contractor shall provide responsive, on-demand support to address impromptu requests initiated by clinic providers and/or internal staff of the United States Army Centralized Allergen Extract Laboratory (USACAEL). All requests originating from clinic providers shall be reviewed, vetted, and prioritized by USACAEL staff prior to being directed to the Contractor for action. The Contractor shall only perform such support activities as authorized by USACAEL and within the scope, funding, and cost limitations of this contract.

Such requests may include, but are not limited to:

• Delivering technical information and guidance

• Supporting problem-solving and issue resolution

• Troubleshooting application functionality or user access concerns

• Assisting with workflow optimization within the application

• Addressing requests for new application features

• Providing technical expertise to meet end-user requirements

The Contractor shall ensure that all support provided is accurate, timely, and consistent with applicable standards, policies, and procedures, while minimizing disruption to clinical and laboratory operations.

In addition, the Contractor shall assist USACAEL staff with unplanned technical requirements that may arise during routine operations. This support may include generating system data reports, assisting with system testing or configuration changes, resolving system integration issues, and collaborating with Government personnel to ensure compliance with security and operational policies.

The Contractor shall work in close coordination with USACAEL staff to prioritize requests, escalate critical issues as appropriate, and deliver solutions that support mission objectives and align with the technical requirements of the ELMS application.

C. Contractor planning responsibilities for coordination and transition activities with incumbent contractor

Transition-in period: Transition-in performance is defined as the following:

coordination of the Contractor with the Government in planning and implementing a complete transition to the Contractor’s support model and submit a Transition-in Plan (Deliverable 2). The Government will designate a transition period for the incoming Contractor to coordinate and work with the incumbent Contractor. The Government will make all required facilities, equipment, and materials accessible to the Contractor during the Transition-in Period. The Contractor shall provide the Government with a Transition-in Plan to include the following items:

• Review evaluation and transition of current support services

• Government-approved training and certification process

• Transfer of all System/Tool documentation to include, at a minimum: user manuals, system administration manuals, training materials, configuration control documents and all other documents required to operate, maintain, and administer systems and tools

• Transfer of compiled and uncompiled source code, to include all versions, maintenance updates and patches

• Orientation phase and program to introduce Government personnel, programs, and users to the contractor's team, tools, methodologies, and business processes

• Applicable DHA briefing and personnel in-processing procedures

• Coordinate, if applicable, with the Government to account for Government keys, ID/access cards, and security codes

During the transition-in period, the contractor shall prepare to meet all contract requirements and ensure incoming personnel are functionally trained and qualified by the full performance start date except cybersecurity requirements, which must be fully adhered during transition and full performance periods. The remaining incoming personnel shall be trained and qualified within 30 days.

The contractor shall comply with transition-in requirements of the DHA, for contractors needing to be issued Common Access Card (CAC) identification, including Department of Defense (DoD) and DHA-directed training and forms submission, prior to network access.

Transition-out period: The transition-out plan shall facilitate the accomplishment of a seamless transition from the incumbent to incoming contractor/Government personnel at the expiration of the contract. The Contractor shall provide a Transition-out Plan

(Deliverable 3) for transitioning work from an active contract to a follow-on contract/order or Government entity. This transition may be to a Government entity, another Contractor or to the incumbent Contractor under a new contract/order. In accordance with the Government-approved plan, the Contractor shall assist the Government in planning and implementing a complete transition from this Contract and/or orders issued under this Contract to a successful provider. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of copies of existing policies and procedures, and delivery of required metrics and statistics.

3.0 BACKGROUND INFORMAIION.

3.0.1. The contractor shall comply with federal, state, and local laws and regulations applicable to the performance of this contract.

3.0.2. The contractor shall not accept any instructions issued by any person other than the Contracting Officer or the Contracting Officer's Representative (COR) acting within the limits of their authority.

3.0.3. Safety Requirements: The Contractor FTE shall maintain safety and health standards compliant with requirements of the Occupational Safety and Health Administration (OSHA).

3.0.4. CRIME CONTROL ACT OF 1990. No performance under this contract will be allowed without full compliance with the Crime Control Act of 1990 and Department of Defense Instruction 1402.5 dated 19 January 1993. All contract providers having access to Government computer systems and/or providing care to children (17 years of age and under) must be subject of a favorable background investigation. Background checks will be based on fingerprints of individuals obtained by a law enforcement officer and inquiries will be made, based on the Standard Form 85-P completed by the contract provider through the Federal bureau of Investigation (FBI) and state criminal history repositories. All individuals who are required to complete the Standard Form 85-P Questionnaire for Public Trust Position (including individuals who will access CHCS) shall provide the SF85-P documentation on a 3 ½” computer diskette or as otherwise required by the MTF.

4.0 OPERATIONAL SECURITY REQUIREMENTS.

4.0.1. The vendor performs the work requirements for this contract at an offsite location.

The contractor does not require access to a DoD facility or installation.

The contractor employee will be issued a CAC only if duties involve one of the following:

(1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. Should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes for contractors requiring Common Access Card

(CAC).

In general, the CAC card is required for access to Government computer databases and is given to the security guards when entering the military installation. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. If necessitated, the Contractor and all associated sub-contractors’ employees shall provide information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy.

For those contractors that do not require CAC but require access to a DoD facility or installation. Contractor and all associated subcontractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility, and area commander installation/facility access and local security policies and procedures

(provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

4.0.2. ADP SECURITY. The Contractor FTE under this contract shall have access to and/or process information requiring protection under the Privacy Act of 1974. These positions are considered “ADP Sensitive” positions. Compliance with DoD Directive 5200.28, DoD 5200.2-R, AR 25-2 and AR 380-67 (for Army), and applicable regulations for other services, is mandatory for ADP Sensitive positions.

4.0.3 MEDIA INQUIRIES. The contractor shall not respond to any media inquiries. Any inquiries from the media shall be immediately relayed to the COR who will relay them to the MTF Commander. There shall be no interviews, comments, or any other response without the knowledge and approval of the MTF commander. Other than routine inquiries for external agencies, all other inquiries and complaints shall be brought to the attention of the contractor

5.0 STANDARDS OF PERFORMANCE.

5.0.1 The government requires that the contractor shall provide technically competent application software maintenance and enhancement to provide for a high level of quality delivery of services.

5.0.2. JC Standards. Contractor shall take part in Department or MTF programs if necessary or as required to meet JC standards.

5.0.3. Performance Reports are provided by the COR to ensure acceptable performance of the contract.

5.0.4. The Contractor shall be responsible for the security of all electronically accessed patient record information.

5.0.5. Neither the Contractor nor any of its contract service providers shall disclose or cause to disseminate any information concerning operations of military activities. Such action(s) could result in violation of the contract and possible legal actions.

5.0.6. All inquiries, comments or complaints arising from any matter observed, experienced, or learned of because of or in connection with the performance of this contract, the resolution of which may require the dissemination of official information, shall be directed to the contracting officer representative (COR) and the contracting officer.

5.0.7. The Contractor shall only conduct business with designated government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

5.0.8. U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports are maintained by the Contractor, but remain the property of the U.S. Government. These files/results must be surrendered to the COR.

5.0.9. As deemed necessary, the Contractor shall comply with agency personal identity verification procedures as required and identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

5.0.10. The Contractor shall comply with agency personal identity verification procedures in all subcontracts when the subcontractor is required to have physical access to a federally controlled facility or access to a Federal information system.

6.0. SCHEDULE/PERIOD OF PERFORMANCE

6.0.1. The contractor shall be required to perform services on a schedule established by USACAEL management as detailed in the independent government estimate for services and in coordination with Contractor scheduled work activities and required deadlines. The normal hours of work are generally Monday through Friday, between the hours of 6:00 am to 5:30 pm (excluding federal holidays). The exact hours of duty for this contract will be coordinated between the Contractor and the COR.

6.0.2. Holidays. The following is a list of legal federal holidays as referred to elsewhere in the contract/task order.

Martin Luther King’s Birthday, 3rd Monday in January

President’s Day, 3rd Monday in February

Memorial Day, Last Monday in May

Juneteenth. June 19th

Independence Day, July 4th

Labor Day, 1st Monday in September

Columbus Day, 2nd Monday in October

Veteran’s Day, November 11th

Thanksgiving Day, 4th Thursday in November

Christmas Day, December 25th

NOTE: Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above.

6.0.3. Overtime is not authorized.

6.0.4. PERFORMANCE QUALITY. The Contractor shall establish and maintain a Quality Control Plan that shall ensure the requirements of the contract are provided as specified in the PWS. Within thirty calendar days after contract award, copies of a comprehensive written QCP shall be submitted to the COR and within 5 working days when changes are made thereafter.

6.0.5. PHASE IN /PHASE OUT PERIOD. To minimize any decreases in productivity and to prevent possible negative impacts on additional services provided, the Contractor shall have necessary personnel, at no additional cost to the government, during the ninety (90) days phase in/ phase out periods. During the phase in period, the Contractor shall become familiar with test requirements to commence full performance of services on the contract start date.

7.0. NON-CREDENTIALED PERSONNEL DOCUMENTATION

No later than 7 working days upon notification of acceptance of the Contractor by the COR, the Contractor must…