STATEMENT OF WORK HEMATOLOGY EQUIPMENT.pdf

STATEMENT OF WORK

1. Equipment

The requirement is for a contract for one (1) hematology laboratory analyzer which includes equipment rental, 6 month maintenance support, and consumable supplies for Naval Hospital Guam, brand name or equal (BNE) to the Sysmex XN2000. The system shall be capable of performing at least the tests listed below for a minimum annual workload of 25,000 specimens for Complete Blood Counts, 500 for Body

Fluids and 2,500 for Reticulocytes.

The systems shall be capable of performing general hematology and reticulocyte testing. The system shall be capable of providing automated results for complete blood counts, white blood cell differentials, reticulocyte counts, and body fluid counts with 2 part differentials. The system shall be capable of performing linearity for white blood cell (WBC), red blood cell (RBC), Platelet, and Body

Fluids. The system shall be capable of providing a total count for body fluids, with a 2 part differential that includes both the absolute number and the percent of cells counted.

The system shall be capable of positively identifying patient samples using bar codes. The system shall be capable of performing differentials with histograms. The system shall be capable of flagging the user for immature cell lines and pediatric specimens. The system shall be capable of running specimens in an automated closed tube and manual open tube. The system shall be capable of performing and enumerating nucleated red blood cells. The system shall be capable of auto-correcting white blood cells, hemoglobin, hematocrit, mean corpuscular hemoglobin, and mean corpuscular hemoglobin concentration. The system shall be capable of differentiating between platelet clumps and giant platelets. The system shall be capable of using multiple size tubes including those with low volumes (i.e.

pediatric bullet tubes), using only a closed sampler mode. The system shall be capable of interfacing with the Composite Health Care System (CHCS) and Cerner Millennium. The system shall be capable of performing priority (STAT) testing and manual reflex testing. The system shall be capable of performing multiple tests on a single specimen sample. The system shall be capable of performing automated reticulocyte counts based on the parameters set by the manufacturer and the laboratory management.

The system shall be bench-top with maximum dimensions of 38” height, 38” width, 35” depth, and 325 lbs. weight, and must include a movable reagent compartment for in use reagents. The electrical requirements are 110VAC, 60 Hz. An uninterruptible power supply (UPS) is required.

System installation, validation, correlation, onsite training, and 6 month preventive maintenance coverage shall be included.

Corrective system maintenance coverage shall include response times as specified in the Statement of

Work, including 24-hour telephone support and on-site response within 24 hours. Application/end-user training and validation will be conducted by a certified SYSMEX application specialist. One-time

Application/end-user training will be conducted only during installation.

The units shall be compliant with the Food and Drug Administration (FDA) requirements to market and deliver medical products for use in the United States of America, even should delivery be requested outside of the United States. The claims made for the product shall comply with the regulations of the

FDA with respect to products for marketing and delivery of a medical product for use in the United

States of America, even should delivery be requested outside of the United States. The system shall be installed in compliance with OSHA requirements.

Contractor shall be an Original Equipment Manufacturer (OEM) authorized dealer, authorized distributor or authorized reseller for the proposed equipment/system such that OEM warranty and service are provided and maintained by the OEM. All software licensing, warranty and service associated with the equipment/system shall be in accordance with the OEM terms and conditions.

Upon delivery, the contractor shall be responsible for uncrating the unit/system, transporting it through the facility to the location of intended use for installation, and removing of all trash created in this process. If interim storage is required, the vendor shall make arrangements for the storage.

2. Reagent and supply delivery

a. All supplied items and reagents shall be certified for use with the Vendor equipment provided.

b. All supplied items and reagents that require special handling, e.g. refrigeration, time sensitive, open immediately, etc., will be marked in a clear manner with a label that is easily read, understandable and a minimum of 3” x 3” (9 sq. inches). The label will be placed in three (3) or more locations on the container (top & sides). Supplies/items that require refrigeration will have both the required Celsius and

Fahrenheit temperature identified.

c. The vendor shall maintain at least a 3-month inventory (including spare parts, necessary for analyzer maintenance) on island, with delivery of reagents within 24 business hours of request for reagents.

d. The vendor shall provide assistance with establishing new reference ranges when new QC materials are introduced.

d. The vendor shall provide deliveries to the delivery point identified below:

US NAVAL HOSPITAL GUAM

LABORATORY DEPARTMENT

BLDG 50 FARENHOLT RD

AGANA HEIGHTS GU 96910

3. Maintenance.

a. The Vendor shall provide trained, experienced, English-speaking personnel, labor, tools, diagnostic equipment, software, material, supplies, transportation, parts and equipment necessary to perform

Preventive Maintenance (PM), Calibration (CAL), Safety Testing (ST) and corrective maintenance.

b. The Vendor shall provide telephonic communications with the Government to discuss technical matters relating to the performance of this contract. A systems operator shall be made available to answer technical questions regarding system operations and applications.

c. Equipment listed in this contract will be maintained to meet and retain the original equipment manufacturers (OEM’s) specifications / equipment certification.

d. The vendor shall provide a Quality Assurance program for peer review.

4. Preventive Maintenance Services.

a. Normal Business Hour Maintenance Coverage will be Monday through Friday, between 8:00 A.M. to

5:00 P.M. local. Vendor shall provide full service preventive maintenance.

b. Preventive maintenance shall be performed in accordance with OEM recommendations.

c. Must provide onsite assistance with the Bi-Annual Calibration of each analyzer, to include all

Calibration supplies, per the requirements of the College of American Pathologists, and other Regulatory

Agencies. Calibration reports must be submitted to the laboratory, and any corrective actions must be taken to ensure that all calibration standards are acceptable.

5. Corrective Maintenance

a. Vendor shall provide on-site corrective maintenance between the hours of 8:00 A.M. and 5:00 P.M.

PST, Monday-Friday with unlimited service calls. Telephonic support shall be available 24 hours per day, 7 days per week.

b. A vendor service technician shall respond via telephone within two (2) hours after receipt of trouble call, and provide on-site service within twenty four (24) hours. Equipment shall be operational within 48 hours.

c. Government request for corrective maintenance will be placed by Biomedical Engineering Division

(BIOMED) personnel, to the Vendor. Corrective maintenance shall be completed during the hours specified in the contract.

d. Vendor’s response to requests for service may include telephone consultation with the equipment user/operator and a Vendor Field Service Engineer (FSE). Telephone consultation 1) shall provide instruction in determining operator error; 2) shall determine the most likely cause of the problem; 3) shall determine if resolution of the problem requires the dispatch of a FSE; and 4) should identify replacement parts likely to be required in order to return the equipment to 100% operational condition as specified by the OEM.

e. Vendor’s pricing shall be inclusive of all costs including parts, consumables, labor, travel and shipping.

f. The Vendor shall have his/her own service manuals, specifications, schematic diagrams, and parts lists to assist in the evaluation/repair of all equipment included in this contract.

6. Replacement Parts/Upgrades.

a. The Vendor shall have ready access to unique and/or high mortality replacement parts. All parts supplied shall be compatible with the existing system. In the event that replacement parts are required to be shipped, shipping shall be performed in the fastest reasonable means possible at no additional cost to the Government.

b. The Vendor shall replace all worn or defective parts necessary to restore the equipment to 100% operational condition as specified by the OEM.

c. Freight, postage, and storage charges associated with shipment and receipt of replacement parts and the return of parts shall be the responsibility of the Vendor.

d. All replacement parts shall be new and certified as OEM replacement parts. In the event that new parts are not available, rebuilt parts and sub-assemblies are allowed provided that they are warranted to be free of defects for a period of time that meets or exceeds warranties of similar replacement parts.

The Vendor shall specifically annotate on the Field Service Report the use and identification of rebuilt parts and the period of warranty. When discrepancies occur, the Government will make the final determination on whether a replacement part is of equal or better quality.

e. The Vendor shall include software revisions and upgrades (field service changes), which are required due to FDA or manufacturer announced safety-hazard recall, to include FDA Year 2000 Compliance

Directive, as part of the contract at no additional cost to the Government. Upgrades shall be performed as soon as possible after release, but no later than the first scheduled Preventative Maintenance inspection after release. For any updates that have been identified as critical, or required for the proper operation of equipment by the OEM, vendor shall provide installation within 30 days of release regardless of Preventative Maintenance schedules.

7. Government furnished property, Materials and Services.

a. The Government will be responsible for maintaining the proper environment, including utilities and site requirements necessary for the system to function properly as specified by the OEM.

b. The Government will operate the system in accordance with the instruction manual provided by the

OEM.

c. The Government will not be responsible for the damage or loss due to fire, theft, accident, or other disaster of Vendor supplies, materials, or for the personal belongings brought onto Government property by Vendor’s personnel.

8. Vendor Furnished Property and Material.

a. The Vendor shall provide all service literature, reference publications, laptop computers and diagnostic software to be used by the Vendor service technicians and as required for the completion of the services in accordance with this contract.

9. Vendor Report Requirements.

a. During normal duty hours, Vendor FSE personnel shall check-in with the Biomedical Engineering

Division upon arrival at the Government site and again prior to departure. The Vendor FSEs shall personally notify BIOMED personnel of problems that result in the equipment being left disabled upon their departure. If equipment is left disabled, a method of physical use prevention of the disabled equipment shall be implemented, and the disabled equipment shall be locked out with a letter of intent in compliance with OSHA regulation to prevent any patient hazards. After normal duty hours, Vendor

FSEs shall notify the Officer of the Day Desk and the systems operator designated by BIOMED personnel.

b. The Vendor shall provide to BIOMED personnel a full service report within two (2) days after completion of all services performed. Each service report shall at a minimum document the following data legibly and in complete detail:

i. Name of Vendor

ii. Contract Number

iii. Name of field service technician performing service

iv. Vendor log/control number

v. Date, time (beginning and ending), and hours on-site for service call

vi. Description of problem reported by user

vii. Equipment identification factors to include: manufacturer, make, model, serial number and Facility

Equipment Control Number (ECN)

viii. Itemized description of service performed to include: labor and travel costs, parts used, parts cost, parts number/nomenclature, part new or reconditioned, part manufacturer, and problem/corrective action taken or recommended

ix. Problem resolution or pending action

x. Total billing cost

xi. Signatures:

1. Field Service Technician performing services

2. BMET verifying service rendered (Identify Medical Treatment Facility)

xii. In the event that agents / sub-vendors are used in the performance of repairs, said agent shall be identified on the service report by company name and contact information (i.e., telephone number)

10. Vendor Responsibility.

a. The Vendor shall be responsible for the repair/replacement of damaged Government owned equipment and property due to the negligence of the Vendor or his representatives. All such replacement or repair shall be at the Vendor's expense and shall be inspected to the satisfaction of the

Contracting Officer or appointed representative.

11. Removal of Government Property

a. No equipment shall be removed without the approval of the Contracting Officer’s Representative and

Materials Management Department of the Medical Treatment Facility (MTF). Property passes for equipment removal shall be obtained by the Vendor via the Materials Management Department of the

MTF. Any failure to obtain such passes which results in detainment or prosecution of service Vendor personnel are the sole responsibility of the service Vendor personnel.

b. The Vendor shall provide a detailed description of removed items in writing on the Vendor’s company letterhead. For associated items / accessories, Vendor to provide a detailed written description and quantities of items to be removed. Description to include, as a minimum, manufacturer’s serial numbers and equipment control numbers (ECNs) of all equipment / items removed. In the event that items / subassemblies / accessories are repaired via “Repair by Replacement,” a detailed description of replaced items is to be included upon return of repaired components.

c. No additional charge shall be allowed for work performed off-site, or any additional time required. All charges resulting from a Vendor determined requirement to transport Government owned property, covered by this contract, to and from an alternate repair location shall be the responsibility of the

Vendor. The Vendor shall provide insurance coverage for damage to or loss of equipment while in

Vendor or service Vendor’s custody.

d. In regards to patient information confidentiality and privacy, all vendors and/or service vendor shall not remove equipment containing patient information from the Government site. The equipment hard drive shall be removed at the MTF prior to removal. Furthermore, equipment removed from the MTF will be prorated from the date of removal for service maintenance fees. If hard drives are to be replaced, they shall be left at the MTF for disposal.

12. Service beyond the Scope of the Contract

a. The Vendor shall immediately, but not later than 24 consecutive hours after discovery, notify

BIOMED, in writing, of the existence or the development of any defects in, or repair required to the scheduled equipment which the Vendor considers they are not responsible for under the terms of this contract.

b. At the same time of the notification, the Vendor shall furnish BIOMED with written estimate of the cost to make the necessary repairs. Repairs considered by the Contracting Officer to be outside the scope of this contract shall not be covered under this contract, but shall be ordered under a separate purchase order.

CYBERSECURITY REQUIREMENTS

Risk Management Framework (RMF)

The contractor shall comply with RMF requirements, as specified by the Defense Health Agency (DHA) that meet appropriate DoD, DHA and Navy Cybersecurity requirements. The contractor shall initiate the process by providing the required documentation necessary to submit their system to the Authorizing

Official (AO) for assessment and authorization (A&A) for all orders delivered against this contract. The requirements shall be met before the contractor's system is authorized to access DoD data or to interconnect with any DoD network or system that receives, processes, stores, displays or transmits DoD data. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the RMF process. This includes, but is not limited to;

Attending and supporting RMF and A&A meetings with Navy and DHA cybersecurity representatives as required.

Support/conduct vulnerability mitigation to comply with cybersecurity controls listed in National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-53; Security and Privacy

Controls for Federal Information Systems and Organizations and DHA Administrative Instruction 77. In order for a system to be authorized, there shall be zero Category 1 findings.

Support the A&A Team during system security testing.

Once the system has been authorized, the contractor shall maintain an acceptable security baseline consistent with the authorization granted by the AO throughout the life of the system. This includes ensuring that all vulnerabilities affecting the operating system, primary application, database and all third party software have validated and applied within 30 days.

Cybersecurity

The vendor shall establish appropriate administrative and technical safeguards to protect any and all data, to ensure the confidentiality, integrity, and availability of Government data under their control. At a minimum, this shall include provisions for vendor personnel security and electronic security.

The proposed system shall be capable of supporting the use of Defense Information Systems Agency

(DISA) approved antimalware applications. The Navy uses McAfee Host Based Security System (HBSS) as their solution.

The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support, either fully or partially the operation without performance degradation of the medical system/device. In cases where the operation of HBSS is not technically achievable, the vendor shall provide detailed justification and a Plan of Actions and Milestones

(POA&M) describing steps towards compliance with this requirement.

The vendor must provide their Antivirus (AV) policy and a list of AV Exceptions (if applicable) to the

NMLC prior to AV installation on the system/device. AV must be installed on all devices before they are placed on the Navy network.

Systems shall be configured in such a way to allow for the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, real-time processes), by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

Vulnerability Management

Vulnerability mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating systems, servers, development platforms and the application being delivered to the Navy shall be in compliance with all known applicable guidelines. The vendor shall agree to be proactive in working with the Navy to mitigate new threats as they emerge.

All vendor validated and approved patches, up to and including the date of install, must be loaded on the system prior to system go-live. Security scans will be run during government acceptance testing. All

Category I (CAT I) findings must be remediated prior to government acceptance of the system. A CAT I vulnerability is any vulnerability, the exploitation of which will, directly and immediately result in loss of

Confidentiality, Availability, or Integrity. There shall be no more than 10 Category II (CAT II) findings at the time of government acceptance.

CAT II vulnerabilities are any vulnerability, the exploitation of which has a potential to result in loss of

Confidentiality, Availability, or Integrity.

Domain Name System Realm/Directory Services

Contractor will be required to provide technical evidence, if applicable, whether client/server topology based medical systems can integrate with Directory Services and support LDAP authentication.

Local Privileged and Administrative User/Local System Accounts

Contractor shall create a single local user account with administrative/root level privileges for purposes of conducting system repairs and maintenance only. This account shall be separate and distinct from the built-in local administrative/root account provided by the Operating System and shall comply with DoD policy. All factors required to complete successful identification, authentication and authorization against the built-in local Administrative/Root level account shall be provided to the MTF Biomedical

Engineering Department.

Complete administrative system rights shall be provided to the government System Administrator for the purpose of conducting device vulnerability scans as needed.

DHA Business to Business (B2B) Gateway. All contractor systems that will communicate with DON systems will interconnect through the established DHA Business to Business (B2B) gateway.

Contractors will connect to the B2B gateway via a contractor procured Internet Service Provider (ISP) connection and assume all responsibilities for establishing and maintaining their connectivity to the B2B gateway. This will include acquiring and maintaining the circuit to the B2B gateway and acquiring a

Virtual Private Network (VPN) device compatible with the DHA VPN device. Maintenance and repair of contractor procured VPN equipment shall be the responsibility of the contractor.

Contractors shall configure their network to support access to government systems (e.g., configure ports and protocols for access).

Contractors shall provide full time connections to a TIER1 or TIER2 ISP. Dial-up ISP connections are not acceptable.

Contractors will comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies prior to accessing DoD/DHA networks. All contractors will be required to complete a DISA

Form 2875, System Authorization Access Request form (SAAR) and submit it to the Navy PACS Office for processing. Contractor personnel will be required to complete applicable DoD cybersecurity training.

IPv6

The proposed system shall be Internet Protocol version 6 (IPv6) capable or the vendor shall provide a detailed project, migration or planning documentation to show when the proposed system shall be IPv6 capable.

Minimum IPv6 capabilities include:

Conformant with the IPv6 standards profile contained in the DoD IT Standards Registry (DISR);

Maintaining interoperability in heterogeneous environments with IPv4;

Commitment to upgrade as the IPv6 standard evolves;

Availability of vendor IPv6 technical support.

The contractor shall be able to demonstrate or provide documentation to prove that their product is

IPv6 capable

Health Insurance Portability and Accountability Act (HIPAA)

The contractor shall comply with the HIPAA Act of 1996 (Public Law 104-191) requirements, specifically the administrative simplification provision s of the law and the associated rules and regulations published by the Secretary, Health and Human Services (HHS). This includes the Standards for Electronic

Transactions, the Standards for Privacy of Individually Identifiable Health Information and the Security

Standards.

Applicable References:

DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) NIST

SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems of

February 2010, as amended NIST SP 800-53 Security and Privacy Controls for Federal Information

Systems and Organizations, of 30 April 2013, as amended DoD Instruction 500.01 of 14 March 2014, DoD Cybersecurity DHA Administrative Instruction 77 of 28 May 2015 DoD Instruction 6025.18-R, DoD

Health Information Privacy Regulation DoD Instruction 8580.02, Security of Individually Identifiable

Health Information in DoD Health Care Programs