Statement of Work Contents

1. Project Title

2. Introduction

3. Background

4. Scope

5. Place of Performance

6. Period of Performance (PoP) — Purchase + Support

7. Points of Contact (POCs) & Escalation

8. Work Performance Requirements

9. Conformance Standards

10. Test Equipment Calibration

11. Contractor Qualifications / Requirements

12. Safety Requirements

13. Security & Privacy (Network, Data, Removable Media, External Connections)

14. Network & Hosting Baseline

15. Electrical / Power

16. Project Management & Milestones

17. Check-In/Check-Out & Badging

18. Interface Cables & Cable Management

19. Remote Technical Support

20. Telephone / Online Support & Communication

21. Scheduled & Unscheduled Maintenance

22. Service Levels (SLA)

23. System Testing & Validation

24. Updates & Upgrades

25. Interfaces

26. Service Reports & Electronic Service Log

27. Product Modifications, Recalls, EOL/EOS

28. Inspection & Acceptance

29. Delivery, Shipping & Materials

30. Waste & Jobsite Cleanup

31. Manuals, Release Notes & Service Bulletins

32. Training

33. Invoicing & Payment

34. Warranty

35. Abbreviations

1. Project Title VISN 23 BD IV Prep Expansion (CATO) with Mettler Toledo (MT) Support – Minneapolis VAHCS & VA Central Iowa

2. Introduction VISN 23 is expanding gravimetric IV compounding verification and workflow software (BD IV Prep/CATO) with associated hardware (MT balances) to standardize sterile compounding practices and sustain measurable safety, accuracy, and documentation compliance across facilities. This PWS/SOW covers supply, installation, validation, training, and a one-year subscription/support term post go live.

3. Background BD IV Prep (CATO) enables medication compounding workflows with integrated gravimetric verification; MT balances provide precision measurement essential to compounding safety.

Continued subscription/support (software updates, patches, remote support) and OEM hardware service are required to maintain cybersecurity posture, regulatory compliance (Joint Commission, VA Handbook 6500, NIST), and uninterrupted clinical operations.

4. Scope The Contractor shall provide and implement:

4.1. BD IV Prep (CATO) software subscription/licenses and monthly support for the full term per BD quotes.

4.2. BD IV Prep Gravimetric Packs (hardware, peripherals) with installation/configuration and validation.

4.3. Mettler Toledo install & 5-year coverage included where listed; integrate balances with BD IV Prep workflows and calibrate per OEM specifications.

4.4. Training, documentation, and go-live support for pharmacy staff and Biomedical Engineering.

5. Place of Performance

5.1. VA Central Iowa Health Care System (CIH) – 3600 30th St, Bldg 10, Des Moines, IA 50310.

5.2. Minneapolis VAHCS (MIN) – 1 Veterans Dr, Bldg 70, Minneapolis, MN 55417.

6. Period of Performance (PoP) — Purchase + Support

6.1. Purchase & Installation Period: Up to 12 months from CO award for delivery, installation, configuration, testing, training, and Go-Live acceptance (per site).

6.2. Initial Support Period: 12 months post Go-Live (included at no charge).

6.3. Work shall occur during 0800–1630 local time, Monday–Friday, excluding Federal holidays, unless otherwise approved.

7. Points of Contact (POCs) & Escalation Upon award, the COR will provide clinical, biomedical/HTM, logistics, and IT/security POCs for each facility. The Contractor shall furnish an escalation pathway—including after-hours contacts—for urgent issues requiring rapid resolution.

7.1 Definitions

7.1.1 Urgent: Core features unavailable; care critically disrupted

7.1.2 High: Significant disruption

7.1.3 Medium: Business disruption

7.1.4 Low: Routine assistance

8. Work Performance Requirements Provide 24×7×365 remote support; onsite service shall occur when remote remediation fails or upon COR request, with onsite dispatch within 1 business day; deliver software updates, licensing, security patching, interface maintenance, diagnostics/RCA, and project management to facilitate testing/validation to follow VA-approved scripts;

coordinate third-party dependencies (power/network/space).

9. Conformance Standards All products, services, and maintenance shall conform to Manufacturer specifications, AAMI, Joint Commission, NFPA-99, CDRH, IEEE, UL, OSHA, CAP, VAHCS standards, and applicable Federal/State/Local regulations.

10. Test Equipment Calibration Before onsite work, provide current calibration certificates (traceable to national standards) for test equipment used on VA-owned equipment.

11. Contractor Qualifications / Requirements Provide fully qualified, OEM-certified field service engineers (FSEs) and backup FSEs;

submit credentials upon request; subcontractors require CO approval.

12. Safety Requirements The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this agreement. The Contractor shall comply with any additional safety guidelines in place at a VA facility, which may include providing their own personal protective equipment (PPE).

13. Security & Privacy (Network, Data, Removable Media, External Connections)

Comply with VA Directive 6500 / VA Handbook 6500 cybersecurity requirements and Business Associate Agreement (BAA) requirements to complete required VA Form 6550 (Medical Device/Software Cybersecurity Analysis) artifacts (MDS2, topology, data-flow) or other forms within 10 days of VA request. Execute MOU/ISA for any external connections to VA systems; follow VA Handbook 6513 for secure external connections; use VA-approved S2S VPN; ensure cryptography is FIPS 140-3 validated (or current) or provide letter of attestation to upgrade before the 9/21/26 sunset-provide certificate numbers;

contractor shall submit all TRM materials and required remediation responses within 5 business days of VA request.; support VA Directive 6517 for any cloud components; allow SMAK-AM installation; surrender replaced storage media to VA; provide MAC addresses ≥1 week prior to delivery.

14. Network & Hosting Baseline Sites will host virtual servers on VISN 23 Nutanix HCI / Acropolis; VMware OVA/VMDK packages supported, Hyper-V not supported. VA provides Windows Server 2019 (or current) and Microsoft SQL 2019 (or supported DBMS). Describe AD/LDAP/SSO integration. Workstations shall meet VISN specs (TPM, SSD, encryption, RAM/CPU, FHD displays); no OEM Group Policies applied.

15. Electrical / Power Use existing VA electrical services (120 VAC; < 20 A per component).

16. Project Management & Milestones

16.1. Provide a Contractor Project Management Plan (CPMP) within 2 weeks of award; conduct kickoff within 3 weeks; hold weekly check-ins; Daily onsite status reports shall include progress notes and may include supporting photographs;

deliver acceptance letters post-service; conduct Lessons Learned/AAR within 3 weeks of completion. Include security documentation submission within 10 days of VA request and provide MAC addresses ≥1 week prior to delivery.

16.2. Project Milestone Table

Milestone Description / Activities Timeframe Responsible Party

1. Award Notification & Initial Coordination

Contractor acknowledges award, reviews obligations, receives POCs.

Within 5 business days of award

Contractor & COR

2. Submit Contractor Project Management Plan (CPMP)

Provide CPMP including narrative, schedule, risks, and reporting cadence.

Within 2 weeks of award

Contractor

3. COR/Facility Review & CPMP Finalization

COR and facility POCs review and approve

CPMP.

Within 3 weeks of award

Contractor & COR

4. Kickoff Meeting Review CPMP, communications plan, implementation plan, and escalation pathway.

Within 3 weeks of award

Contractor & VA (COR/POCs)

5. Security Documentation Submission

Submit MDS2, topology, data-flow, encryption docs, TRM info, BAA, and MOU/ISA.

Within 10 days of VA request

Contractor

6. Provide MAC Addresses

Submit MAC addresses for all network-capable devices.

At least 1 week prior to delivery

Contractor

7. Hosting Readiness & Technical Validation

Validate hosting environment, confirm compatibility, and ensure readiness.

Prior to installation window

Contractor & VA

8.

Licensing/Entitlement Activation

Activate BD IV Prep subscriptions and MT coverage.

Before installation

Contractor

9. System Installation / Configuration

Configure BD IV Prep, workstation clients, MT scales, and security settings.

As scheduled Contractor

10. Remote Access Enablement

Complete VA-approved S2S VPN or secure connection.

Prior to testing Contractor & VA

11. Interface Configuration & Testing

Validate VistA/Federal EHR interfaces and integrations.

Before go-live Contractor & VA

12. QA Testing & Validation

Perform QA checks, verification, and corrective actions.

Prior to acceptance

Contractor

13. Training Delivery Provide clinical/technical/super-user training.

Before production use

Contractor

14. Go-Live & Acceptance

System enters production and acceptance paperwork finalized.

Upon completion Contractor & VA POCs

15. Initial Stabilization Support

Provide accelerated support during initial period.

First 30 days post-go-live

16. Monthly Service Reports

Provide incident summaries, updates, and SLA reporting.

Monthly Contractor

17. Quarterly Performance Reviews

Conduct performance and trend reviews.

Quarterly Contractor & COR

18.

Updates/Upgrades & Patch Cycles

Provide updates, upgrades, and urgent fixes.

Ongoing Contractor

19. Annual Option Year Review

Validate equipment and pricing for next option year.

150–180 days before PoP anniversary

Contractor & COR

20. Lessons Learned & After-Action Report

Conduct lessons learned session and deliver AAR.

Within 3 weeks of update cycle completion

17. Check-In/Check-Out & Badging Contractor shall check in/out with facility POCs, wear visible identification, comply with VA privacy training, parking rules, PPE; removable media scanning is mandatory per Biomedical Engineering prior to connection to any VA system.

18. Interface Cables & Cable Management Provide required interface cables and coordinate cable management/floor space to reduce hazards/clutter.

19. Remote Technical Support Provide 24×7×365 remote technical support and error correction for software, interfaces, reporting/analytics, and content modifications.

20. Telephone / Online Support & Communication Provide toll-free numbers/emails for normal/after-hours; allow unlimited support requests;

communicate incident details, safety impact, workaround, patch ETA, and status cadence;

share known issues in monthly service reports.

21. Scheduled & Unscheduled Maintenance Perform PM per manufacturer recommendations/standards; provide corrective maintenance for all failures, with remote triage in 1 hour and onsite dispatch within 1 business day, with ticketing; restore products/software to OEM specs; replace where repair is not feasible; coordinate scheduling with COR/POCs.

22. Service Levels (SLA)

22.1. BD IV Prep/CATO Remote Support: Available 24×7×365; priority targets—

Urgent initial callback ~1 hr, High ~4 hrs, Medium ~24 hrs, Low ~48 hrs; update interval—Urgent~2-4 hr, High ~4-8 hrs, Medium ~48 hrs, Low ~72 hrs.

22.2. System Availability Target: ≥96% operable time, excluding scheduled maintenance (Government surveillance target).

22.3. MT Hardware Dispatch: Prompt remote triage; onsite dispatch if remote remediation insufficient; Hardware shall be restored to service as quickly as possible, with target resolution within 72 hours for non-critical faults and documented in escalation.

23. System Testing & Validation Perform QA testing before installing patches/maintenance releases; execute connectivity/interface testing per mutually agreed test scripts; validate compliance with VA data standards; coordinate testing in TEST and LIVE environments; confirm interface readiness post-install.

24. Updates & Upgrades Provide updates (bug fixes/patches) and upgrades (major features) with validation and testing cycles; maintain up-to-date security patches; urgent priority updates (patient safety, regulatory, security, interface integrity) shall provide an action plan within 30 days and implement corrective action according to a CO-approved timeline.

25. Interfaces Implement, test, and support interface requirements between BD CATO and VA systems (e.g., VistA/Federal EHR, device integrations). Maintain vendor-side interfaces and coordinate changes/migrations with VA/third parties.

26. Service Reports & Electronic Service Log Within 72 hours of any service call (remote/onsite), provide a Service Report to facility POCs; maintain a VA-accessible Electronic Service Log tracking service calls, updates/upgrades, corrective actions, parts replaced, personnel, and RCA summaries;

provide monthly/quarterly summaries as requested.

27. Product Modifications, Recalls, EOL/EOS Notify COR/POCs within 48 hours of any recall/EOL/EOS/modification; provide identification, reasons, and steps for return/credit/replacement/corrective action within 5 business days; execute required actions across affected facilities.

28. Inspection & Acceptance Conduct joint inspection with facility POCs upon completion; correct any deficiencies prior to acceptance; provide remediation dates if not addressed immediately; disputes resolved by the CO.

29. Delivery, Shipping & Materials Coordinate deliveries with Supply Chain; tag bill of materials by area/room; parts delivered no more than 7 business days prior to installation; materials must be new in OEM unopened containers labeled with OEM name/model/serial, PO, and Tech POC; provide shipping/tracking info in advance.

30. Waste & Jobsite Cleanup Remove/dispose of all waste and packaging daily; provide a waste removal plan; transport waste offsite; repair/patch any contractor-caused damage, documenting pre/post conditions and remediation.

31. Manuals, Release Notes & Service Bulletins Provide unlimited electronic access to user/admin manuals, technical service documentation (schematics, diagnostics, parts lists), release notes, service bulletins, and training materials; materials shall match manufacturer service documentation.

32. Training Provide role-based clinical (pharmacists, techs, super-users) and technical (Biomedical) training, onsite and/or remote, scheduled for at least two shifts; include job aids/quick-reference guides and provide training completion records.

33. Invoicing & Payment Submit monthly invoices in arrears mapped to line items and periods (facility, quantity, unit price, total, service dates) through VA FSC e-invoice; include PO, contract number, line items, PoP/dates; consolidate line items per month.

34. Warranty Provide minimum 1-year warranty for parts, labor, software/services from written VA acceptance; new/replacement hardware added during PoP is covered and falls under warranty for the first 12 months; factory-trained personnel perform installation/maintenance during warranty; software updates provided at no charge where applicable.

35. Abbreviations AAMI – Association for the Advancement of Medical Instrumentation; AAR – After-Action Report; AHA – American Hospital Association; BAA – Business Associate Agreement; BD – Becton Dickinson / CareFusion; BHH – Black Hills Health Care System; CATO – BD Cato Medication Workflow / IV Prep System; CAP – College of American Pathologists; CCE – Connectivity / Communication Enhancement; CDRH – Center for Devices and Radiological Health; CIH – Central Iowa Health Care System; CO – Contracting Officer; COR – Contracting Officer’s Representative; CPU – Central Processing Unit; DBMS – Database Management System; DR – Disaster Recovery; EHR – Electronic Health Record; ePHI / EPHI – Electronic Protected Health Information; FIPS – Federal Information Processing Standards; FSE – Field Service Engineer; GRI – Grand Island VA; HCI – Hyperconverged Infrastructure; HIPAA – Health Insurance Portability and Accountability Act; HTM –

Healthcare Technology Management; IOW – Iowa City VA Health Care System; ISSO – Information System Security Officer; ISO – Information Security Officer; JCAHO – Joint Commission on Accreditation of Healthcare Organizations; LIN – Line Item Number; LTS – Long-Term Support; MDS2 – Manufacturer Disclosure Statement for Medical Device Security; MIN – Minneapolis VA Health Care System; MOU/ISA – Memorandum of Understanding / Interconnection Security Agreement; MT – Mettler Toledo; NWI – Nebraska-Western Iowa Health Care System; OIT – Office of Information and Technology;

OS – Operating System; PaaS – Platform as a Service; PHI – Protected Health Information;

PoP – Period of Performance; POC – Point of Contact; PPE – Personal Protective Equipment; PWS/SOW – Performance Work Statement / Statement of Work; RCA – Root Cause Analysis; RSS – Remote Support Services; S2S VPN – Site-to-Site Virtual Private Network; SaaS – Software as a Service; SCCM – System Center Configuration Manager;

SMAK-AM – System Monitoring and Accountability Knowledge – Anti-Malware; SQL – Structured Query Language; SSO – Single Sign-On; STC – St. Cloud VA Health Care System; TSC – Technical Support Center; TPM – Trusted Platform Module; TRM – Technical Reference Model; UPS – Uninterruptible Power Supply; UL – Underwriters Laboratories; VA OIT – VA Office of Information and Technology; VHA – Veterans Health Administration;

VISN – Veterans Integrated Service Network; VMDK / OVA – VMware Virtual Machine File Formats; VistA – Veterans Health Information Systems and Technology Architecture;

WSUS – Windows Server Update Services.