SOW-Pipette Calibration System- Lab (1).docx

STATEMENT OF WORK

Pipette Calibration System, Service Agreement, & Supplies

A. PURPOSE OF CONTRACT:

The Contractor shall provide a portable counter-top Pipette Calibration System (PCS) for the Phoenix Indian Medical Center (PIMC), Laboratory Department. PIMC has a need to implement a portable counter-top Pipette Calibration System (PCS) to improve quality assurance, ensuring precise and accurate data for compliance with regulatory agencies. This equipment will NOT be on the PIMC network nor will it be interfaced to the laboratory information system (LIS).

B. SPECIFICATIONS OF SERVICES:

The Contractor shall provide the latest software ArtelWare 2.4 installed prior to delivery. The Contractor shall provide a portable counter-top Pipette Calibration System (PCS) with the following specifications:

PCS Computers:

The Contractor shall provide a new version (upgradeable) of a portable counter-top Pipette Calibration System (PCS) if availability occurs at no additional cost to the Government and without affecting the price, length of contract, or original terms and conditions of the initial contract. The Contractor shall ensure the instrument software is running the latest operating system and has anti-virus software to align with the Indian Health Services IT policies.

The Contractor shall replace the portable counter-top Pipette Calibration System (PCS) if it becomes damaged or non-operational due to manufacturer default.

The technical staff of the Contractor who electronically monitor performance of equipment shall take mandatory Health Insurance Portability and Accountability Act (HIPAA) and the Computer Security Awareness Training.

The Contractor shall work with laboratory personnel for monitored access to the Indian Health Service, Phoenix Area computer network. All purchases that require use of, access to, or communications through the Federal IHS Domain or an IHS controlled network device, must meet all IHS, HHS, and DHS security compliance requirements. All access to IHS network-controlled devices or systems by a vendor or a vendor representative must meet all IHS, HHS, and DHS security compliance requirements. Contractor shall conform to the Indian Health Service Information Technology policies for remote connection and anti-virus software.

The Contractor shall provide training off-site and on-site for staff sufficient to establish competency in the labor and technical oversight processes involved in running the equipment supplied. This shall include two (2) off-site formal training slots for equipment, at no cost at Advanced Instruments Westbrook, Maine, USA facility. The training of the IHS Laboratory Staff will be where they have access to the equipment. Two training slots for the first year and one per year thereafter.

The Contractor shall perform independent risk analysis that document the level of risk for potential misuse of sensitive information associated with a particular data breach.

The Contractor shall be responsible for all costs, training, and associated expenses needed to maintain the associates’ software applications to the latest software versions allowed by the Indian Health Service Information Technology policies.

Contractor shall provide at no cost to the government, a replacement UPS device and instrument printer.

Contractor shall provide at no cost to the government, the latest version of Windows to comply with IHS IT policies; For example, PIMC is switching PCs over to Windows 11 and they want us to work with vendors to ensure applications are able to run on Windows 11.

IT REQUIREMENTS:

HHS Security and Compliance Requirements for Cloud Vendors

Section 1: FedRAMP Authorization Requirements

1.1 Cloud Service Authorization:

The Contractor shall ensure that all cloud-based services (Infrastructure-as-a-Service, Platform-as-a-Service, or Software-as-a-Service) used to store, process, or transmit federal information meet the following:

· FedRAMP Authorization Level:

The service must possess a valid FedRAMP Authorization to Operate (ATO) at the Moderate or High impact level, depending on the sensitivity of the information involved.

· Acceptable Types of FedRAMP Authorization:

· Joint Authorization Board (JAB) P-ATO

· Agency ATO granted by HHS or another federal agency

· Authorization Documentation:

The Contractor must provide:

· Current FedRAMP package (System Security Plan, POA&M, etc.)

· FedRAMP authorization letter

· Most recent annual assessment report and continuous monitoring evidence

1.2 Temporary Use of In-Process Solutions:

If the cloud service is not currently FedRAMP Authorized, the following conditions apply:

· A FedRAMP In Process designation listed on Marketplace.FedRAMP.gov must be presented

· Contractor must submit a FedRAMP waiver request to HHS, including:

· Project scope

· Risk mitigation strategy

· FedRAMP authorization timeline

· Waiver Period: Not to exceed 12 months. Vendor must achieve full authorization within that time.

Section 2: Remote Access Controls

2.1 Access Requirements:

Any remote access to systems supporting HHS data must comply with the following:

· Two-Factor Authentication (2FA):

All remote users must authenticate using FIPS 140-2 validated multifactor methods.

· Network Access Controls:

· Remote access must be limited to only authorized users and IP ranges.

· VPN or Zero Trust architecture must be used for administrative access.

· Privileged Access Management:

· All privileged sessions must be monitored, logged, and reviewed.

· Use of session recording, keystroke logging, and JIT (Just-In-Time) access controls are recommended.

2.2 System Isolation:

· Remote administrative access must occur through hardened bastion hosts or dedicated admin environments.

· Administrative access should not traverse public cloud environments unless tunneled through secure HHS-approved mechanisms.

Section 3: Vulnerability Management and Patching

3.1 Patch Timeframes:

The Contractor shall maintain a vulnerability management program in accordance with NIST 800-53 and apply security patches as follows:

3.2 Vulnerability Scanning & Reporting:

· Contractor shall perform authenticated scans of all systems monthly using industry-standard tools.

· Results of vulnerability scans must be made available to HHS upon request and included in monthly security status reports.

3.3 Zero-Day Response:

For any zero-day vulnerabilities actively exploited in the wild (as identified by CISA KEV catalog), patches or mitigations must be implemented within 72 hours or a formal risk acceptance submitted to HHS.

Section 4: Subcontractors and Third-Party Services

· Contractor shall flow down all FedRAMP, remote access, and patching requirements to any subcontractor or cloud provider involved in service delivery.

· HHS reserves the right to audit subcontractors for compliance.

Section 5: Additional Compliance References This document supplements the following:

· Federal Information Security Modernization Act (FISMA)

· HHS Information Security Program Policy (IS2P)

· NIST SP 800-53 Rev. 5

· HHS ARS 5.0

· CISA Binding Operational Directives (BODs)

All purchases that require use of, access to, or communications through the Federal IHS Domain or an IHS controlled network device, must meet all IHS, HHS, and DHS security compliance requirements. All access to IHS network-controlled devices or systems by a vendor or a vendor representative must meet all IHS, HHS, and DHS security compliance requirements.

Supplies:

1. The Contractor shall have the capabilities to transport supplies Monday thru Friday on an overnight basis.

2. The Contractor shall provide ordered supplies and parts within five (5) business days of an order being placed.

3. The Contractor shall provide high quality supplies required, as noted for the base year and option years (See Pricing Schedule).

4. The Contractor must provide notification to the IHS COR immediately for items placed on backorder.

5. The Contractor must provide notification in writing immediately to the COR, if there are any changes in product availability and production and/or specifications.

6. The Contractor must be able to fulfill urgent delivery requirement for overnight delivery at no cost to the Government.

7. The Contractor must allow return or provide a full credit for items with expiration dates allowing for short or an unreasonable shelf life (less than 3 months). Return shipping and/or Restocking Fees are the responsibility of the Contractor.

The Contractor shall provide a designated representative to help resolve technical and/or contractual issues throughout the life of the contract.

The Contractor shall provide a designated customer service representative to handle all problems that arise with the ordering of consumables and reagents throughout the life of the contract.

C. PRICE SCHEDULE:

The unit prices on all supplies are FIXED PRICE throughout the life of the contract and will not increase.

**The quantity of tests are estimates only and can increase or decrease. **

Yearly Supplies:

(See attached spreadsheet(s) for description of items, quantities, unit of measure, and unit prices)

D. PERIOD OF PERFORMANCE:

The period of performance shall be for a base plus four (4) one year option years commencing from the date of award.

E. QUALITY ASSURANCE:

The Contractor shall provide services under the terms and conditions of this contract with staff capable of providing proper and adequate services and workmanship.

The Contractor shall be responsible for monitoring and evaluating the safety, quality and appropriateness of services provided and shall maintain the quality control program.

F. ENERGY-EFFICIENT PRODUCTS:

The Contractor shall provide products that earn the ENERGY STAR and meet the ENERGY STAR specifications for energy efficiency or items that meet the Department of Energy’s Federal Energy Management Program. The vendor is encouraged to visit energystar.gov for complete product specifications and updated lists of qualifying products. (See Energy Efficiency clauses).

G. SERVICE AGREEMENT:

The Contractor shall provide Preventive Maintenance and a Service Agreement for the pipette calibration system that must include all labor, travel, parts, and software upgrades at no additional cost to the Government.

The Contractor shall provide necessary support services to maintain operational status of the equipment.

The Contractor shall provide technical support and equipment repair support to include routine preventive maintenance plus required parts and the cost of travel, lodging, and per diem for technical support personnel, as well as freight for materials shall be paid for by the contractor

The Contractor shall provide the necessary service, parts, and maintenance as required/needed.

The Contractor will notify PIMC if there are any recall or changes regarding the equipment and supplies as soon as possible. The contractor will provide a solution for any recalls in a timely manner.

The Contractor will dispatch a qualified tech if necessary to perform service and maintenance if the problem cannot be resolved through phone tech support service in 24 hours at their expense.

The Contractor shall provide an on-call response within 60 minutes for weekends, holidays, and after normal duty hours for emergency tech support service. This work shall be continuous 24 hours a day, 7 days a week until completed.

The Contractor shall have remote capabilities to troubleshoot and address technical issues with the equipment.

· Services must be 24/7/365 (include weekends and holidays)

· Response within four (4) hours of the initial call and the Contractor must resolve problems within 24 hours of the service call.

· On-site service response, as needed and may include 24/7 support.

· Unlimited emergency service calls during normal business hours, after business hours, on weekends and holidays.

· All necessary warranted repair parts and labor associated with each service call.

· The contractor shall provide Phone Support (24-hour toll free technical telephone troubleshooting assistance).

· All required engineering updates and reliability enhancements.

H. DELIVERABLE INSTRUCTIONS:

The Contractor shall deliver and install equipment and be operation-ready within 90 days calendar days of award.

The Contractor shall deliver pipette calibration system, as specified in the solicitation requirement to the PIMC Materials Management Department, Building #9, 4212 N. 16th Street, Phoenix, Arizona, 85016, for Government tagging and recording of serial numbers.

Once Materials Management tags the instrument(s), the BioMed Department will evaluate for electrical and safety checks.

The Contractor will then install the instrument(s) at the PIMC Laboratory Department. Should the contractor need additional information they can contact Zerveni Oliver, Microbiology Supervisor, at 602-581-6266.

The Contractor shall start and test the equipment to ensure proper operation and provide the COR an opportunity to witness the testing.

I. INVOICE SUBMISSION AND PAYMENT:

The Unit Price is an all-inclusive cost. All-inclusive cost is defined to include, travel, lodging, per diem, fringe benefits, i.e. life insurance, social security, federal, state and local taxes, plus all other costs pertinent to the performance of this purchase order.

The Contractor must allow a return or provide a full credit for errors on the invoicing.

The contractor shall include the following information on each invoice in accordance with the prompt payment act (5 CFR Part 1315.9(b)):

1. Contractor's name and address

2. Invoice number and date

3. Entire award number or other authorization number for delivery of goods or services (Order number and Order line item number)

4. Description (including dates of service), quantity of goods or services rendered, unit of measure, unit price and extended price of the items delivered

5. Shipping and payment terms

6. Name, address and location of where to send payment

7. Duns number and taxpayer identifying number (TIN)

8. Contact name (where practicable), title and telephone number

**Invoices without the above information will be returned to the contractor resulting in delay of payment.**

Invoices shall be prepared and submitted electronically into the Invoice Processing Platform (IPP) and in accordance with rates and terms as stated in the contract.

The Government reserves the right to accept or reject services if the level of work is unsatisfactory.

J. POINTS of CONTACT:

Acquisition Contract Specialist: TBD

A copy of the invoice should be sent electronically to the Contract Specialist(s) at the email address listed above.

Service Unit Representative: Deana.Thompson@ihs.gov

A copy of the invoice should be sent electronically to the Service Unit Representative(s) at the email address listed above.

K. COMPENSATION:

The Contractor shall be compensated at the agreed contract amount based on invoices submitted and only for services in direct performance of this contract.

L. PAYMENT:

Electronic funds transfer (EFT) method under this contract shall make payment. The Contractor shall submit invoices to the supervisor at the end of each determined timeframe in which the Contractor performs work. The designated receiving official shall make payment upon receipt of proper invoice and appropriate acceptance.

M. TAX:

The Federal Government DOES NOT WITHHOLD taxes from the Contractor, any Local, State, or Federal taxes. It is the Contractor’s sole-responsibility to pay their own taxes and other personal obligations that they may have.

N. ARIZONA STATE TAXES:

Contractor is responsible for determining and paying all required taxes. Award amount shall not be adjusted due to failure of the offeror to include taxes into the quotation.

O. DESIGNATED CONTRACTING OFFICERS REPRESENTATIVE (COR):

Deana Thompson, Phoenix Service Unit, Phone: 602-319-8954, Email: deana.thompson@ihs.gov is hereby designated as COR for this service. The COR’s responsibilities will be to coordinate with the contractor the technical aspects of this service and the review of performance hereunder.

P. CONTRACTING OFFICER REPRESENTATIVE (COR):

The Contracting Officer shall designate the COR representing the Government for the purpose of this contract in writing. Such designation will set forth the duties specifically delegated in regard to the performance of this contract. A copy of the designation will be provided to the contractor.

The COR is responsible for Contractor accountability, monitor contract performance, and assist the Contractor in the resolution of program problems encountered during the performance of this contract.

The COR shall be responsible for:

· Monitoring the Contractor’s technical progress, including the surveillance and assignment of performance and recommending to the Contracting Officer changes in requirements

· Interpreting the Statement of Work

· Performing technical evaluation as required

· Performing technical inspection and acceptance required by the contract

· Assisting the contractor in the resolution of technical problems encountered during performance

The COR’s responsibilities will be to coordinate with the contractor the technical aspects of this service and the review of performance hereunder.

The COR does NOT have authority to modify or change the terms and conditions of the contract.

Q. CONTRACTING OFFICER:

The Contracting Officer is the only person with authority to act as the agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the Statement of Work (2) modify or extend the period of performance (3) change the delivery schedule (4) authorize reimbursement to the contractor for any costs incurred during the performance of this contract or (5) otherwise change any Terms and Conditions of this contract. The Government my unilaterally change it’s COR designation.