STD Testing Product Description.pdf

CUI//SP- PROCURE

William Beaumont Army Medical Center Fort Bliss, Texas

GENERAL

1. DESCRIPTION OF WORK: William Beaumont Army Medical Center (WBAMC) Fort Bliss, Texas has a requirement for on-site testing for sexually transmitted diseases. The Contractor shall provide at minimum one (1) analyzer to meet the requirement for all tests listed in Appendix 1.

1.1. Installation: The equipment shall be installed at the following location: for base period:

William Beaumont Army Medical Center 18511 Highlander Medic St Ft Bliss TX, 79906

1.1.1. Contractor will provide 2 brand-new analyzers for WBAMC hospital laboratory, WBAMC will give ample notice as this equipment is needed onsite at the new facility four (4) weeks prior to first patient testing October 1, 2025. Contractor will assist with installation assisting and verification/validation of all analytes on the platform.

1.1.1.1. Contractor will provide on-site training for the Laboratory personnel

1.1.2. Reserved

1.2. This contract is a non-personal services contract under which the personnel rendering the services are not subject, either by the contract's terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the government and its employees.

1.3. The inspection and acceptance point for all services rendered under this contract will be by the contracting officer's representative (COR), Clinical Engineering Branch. Performance by the Contractor technician, the quality of services rendered, and any documentation or written material in support of same, shall be subject to continuous inspection, surveillance and review for acceptance by the COR or designated representative. Other performance evaluation factors will be monitored that are not quantified by numerical measurements, Contractor technician relationship with hospital staff/government contracting personnel and compliance with hospital policy and procedures.

1.4. Reagent/Consumables: Reagents will be ordered on an as-need basis. No drop shipments will be accepted.

1.4.1. Contract is written as a cost-per-kit agreement. All consumables, fluids, and calibrators shall be at no cost to the government.

1.4.2. All reagents and equipment shall be approved by the US Food and Drug Administration (FDA).

1.4.3. The Contractor shall provide all reagents/reagents packs, calibrators/standards, quality control materials, user-replaceable maintenance items, and analyzer specific tools/supplies to support the on-going delivery of laboratory services using the equipment outlined in this section.

1.4.4. All assays and test kits shall be FDA-approved. All related approvals or modifications to equipment, reagents, or parts of assay related to the testing product shall be provided in the event any changes are made during performance of the contract.

1.4.5. Reagents/consumables shall meet the requirements of the 24/7 WBAMC mission, workload, and test menu.

The Contractor shall provide the necessary materials in accordance with (IAW) the equipment’s operators manual

(OEM).

1.4.6. Reagents used for troubleshooting analytical systems shall be reimbursed (or replaced) by the Contractor at no additional cost.

1.4.7. Reagents shall have a shelf life of at least 4 months upon receipt, or as stated within the individual line item on the delivery ticket or invoice. Controls shall have a shelf life of 12-24 weeks. Shall be clearly marked with any required temperature controls, as necessary. The government acknowledges that the Contractor’s assays have a shelf life of 12 months from manufactured date.

1.4.8. The Contractor utilizes a third party for shipments whereby the government is able to identify the shipping status of reagents or materials via the third party’s website. Contractor shall use good faith efforts to ship products on the dates and quantities as specified by the customer; the government acknowledges that the dates are estimates.

Any supplies that are placed on back order shall be communicated electronically to the government, clearly identified on the shipping documents and delivered in a timely manner, not to exceed ten (10) working days. In the instance a back-order exceeds 10 working days and the government is unable to run patient samples, the Contractor shall provide testing service through local sub-contract at their cost.

1.4.9. Emergency orders shall be delivered within 24 hours after the order is placed

1.4.10. STI reagents shall be able to support ThinPrep PreservCyt solution that are the approved/proprietary collection method used in the WBAMC DPALS Cytology Section and Department of Defense (DOD) wide facilities that WBAMC supports.

1.5. The Contractor shall notify its employees of the United States Government's zero tolerance policy described in paragraph (b) of FAR clause 52.222-50 "Combating Trafficking in Persons" and the actions that will be taken against employees for violations of this policy.

1.6. The Contractor shall provide 24/7 phone support for all technical questions and troubleshooting. Should it be determined that a module has broken repair cannot be done onsite by the technologist, the Contractor shall have a replacement module shipped to arrive within 24 hours of the notification.

1.7. The Contractor shall ensure all deliveries arrive within one week of the order being received.

1.8. Preservation and packing. Preservation and packing shall be performed IAW best commercial practices and in such a manner as to afford adequate protection against any damage during shipment from source to destination. All packaging and shipping information shall be clearly marked as to contents on both the shipping documents and the shipping container/box. All deliveries shall be made Tuesday through Thursday, to exclude federal holidays.

1.9. Maintenance/Services: The Contractor service representative shall report to WBAMC, Medical Maintenance, basement floor, Room HB1250, phone number 915-569-1042, prior to performing maintenance/service of equipment located at WBAMC.

1.9.1. The Contractor shall provide scheduled and unscheduled services IAW the support equipment manufacturer’s standard service plan at no cost to the government, and provide records of all maintenance performed to include:

1.9.1.1. Customer service support Monday-Friday 6 am – 6 pm Mountain Time.

1.9.1.2. Labor, necessary replacement parts (excluding disposables), and Contractor travel expenses.

1.9.1.3. Preventive maintenance (PM) by manufacturer’s service technician according to operator’s or user’s manual (Monday – Friday).

1.9.1.4. Access to manufacturer technical support telephone support, Monday through Friday 6:00 AM to 6:00 PM MST. Technical Support Telephone Number: 888-484-4747.

1.9.1.5. Factory-authorized updates or modifications, including parts.

1.9.1.6. Service callback within 30 minutes.

1.9.2. The Contractor shall maintain all equipment installed under this contract except for repairs necessitated by willful damage or negligence on the part of the government. This includes emergency repairs as well as routine PM services, safety tests, calibrations/calibration verifications, and unscheduled repair services IAW procedures prescribed by the manufacturer of the equipment.

1.9.3. The Contractor shall provide calibration/verification of all analyzers every six months IAW OEM specifications, or sooner if analyzer exceeds internal quality control limits. All materials used during calibration/verifications shall be at no cost to the government.

1.9.4. The Contractor shall provide service/support updates to analyzer operational software throughout the life cycle of the contract.

1.10. Equipment/Analyzer: The Department of Pathology at WBAMC has a need for one (1) analyzer with the following characteristics:

Fully automated molecular (nucleic acid amplification technology: NAAT) analyzer capable of processing 275 samples within one eight-hour shift using only one technologist with minimal hands on time.

Capable of running multiple amplification assays at the same time from the same patient sample.

Capable of loading multiple (up to four) reagent kits at one time and preform automated onboard decontamination of samples.

All tests quested (see list below) shall be available for the platform to fulfill the government’s need.

Support ThinPrep PreservCyt solution that are the approved/proprietary collection method used in the WBAMC DPALS Cytology Section and Department of Defense (DOD) wide facilities that WBAMC supports.

2. CONTRACTOR REQUIREMENTS

2.1. "Contractor's service representative will be factory trained and have a minimum of two years of experience working on the contracted MD/MDS."

2.2. The Contractor shall not hire off-duty government employees who serve as inspector or COR in their government position, or any other persons whose employment would result in a conflict of interest.

2.3. Contractor shall use only OEM new or OEM-refurbished repair parts (SB 8-75-11, par 6-5a.(i)).

3. MATERIAL SAFETY DATA SHEETS (MSDS)

3.1. The Contractor shall provide material safety data sheets (MSDS) for each item delivered under this contract that is considered to be HAZARDOUS MATERIAL by the COR. The MSDS shall contain information on the hazards associated with each specific chemical or material. The MSDS shall be printed in the English language and shall contain, at minimum, the following information: identification of the specific hazard, the required practice for the safe use of the product, first aid procedures, and what to do in the event of a spill or other mishap or accident.

4. INFORMATION SECURITY

4.1. Telecommunication.

4.1.1. All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software must be approved through the DHA Software and Application Certification Assessment. Submission of DHA Application Request Worksheet must be completed within the six (6) months of contract award.

4.1.2. The Contractor shall follow Army Regulation 25-1, “Army Knowledge Management and Information Technology, AR 25-2, “Cybersecurity,” and DoD 6025.18-R, DoD Health Information Privacy Regulation.

4.1.3. In accordance with contract requirements, Contractors shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

4.1.4. The Contractor shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies and will provide, maintain and configure VPN concentrator that complies with DoD security standards.

4.1.5. All costs for VPN hardware and software shall be incurred by the Contractor.

4.1.6. The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chief Information Officer.

4.1.7. The Contractor shall validate that systems authenticate users through the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the vendor's technical users will maintain secure logon.

4.2. DEPARTMENT OF RISK MANAGEMENT FRAMEWORK (RMF) IMPLEMENTATION PLAN

4.2.1. The Vendor shall provide information for the Risk Assessment Analysis to the Government for all networking IT applicability.

4.2.2. Vendors shall only offer items, which already have an Authorization to Operate (ATO), or items for which the Vendor agrees to go through the DHA RMF process and obtain an RMF ATO.

4.2.3. Any offered system must meet DoD Cybersecurity/Risk Management Framework (RMF) and the attached Service Information Assurance (IA) requirements. Vendors are required to provide a statement with their quote that they agree to the Service Cybersecurity/IA Requirements, HIPAA requirements and B2B requirements that are attached to this RFO.

4.2.4. Vendors are required to provide a completed Joint Medical Device Risk Assessment Questionnaire (v1.1) for the offered system along with their offer. These should be provided by DHA Cyber Logistics.

4.2.5. RMF shall be evaluated as part of the System Capability Factor. Vendors must meet all the below RMF minimum requirements along with any additional RMF requirements listed/attached to the RFO. Vendors may be assigned strengths if they exceed any RMF minimum requirement and/or meet any RMF objective. Additionally, weaknesses may be assigned based on the vendor’s responses in the Joint Medical Device Risk Assessment Questionnaire (v1.1). RMF weaknesses may include; but are not limited to; deficiencies in architecture or software versions, other services having cancelled RMF efforts due to vendor non-responses or inability to get an RMF ATO, system having received a DATO from any service, and deficiencies that cannot be mitigated/accepted.

4.2.6. Submitting a quote for any requirement under this initiative constitutes full agreement to all specific Service IA requirements and the attached IA document.

4.2.7. Failure to agree to the attached Service IA requirements and to provide a completed Joint Medical Device Risk Assessment Questionnaire shall result in rejection of the vendors quote. Failing to disclose that a system cannot meet IA requirements, failure to meet certification timeframes or failure to receive ATO may result in termination for cause in accordance with FAR 52.212-4(m).

ESTABLISHING INTERFACE:

(a) The system shall bi-directionally interface with the Composite Health Care System (CHCS), Military Healthcare System (MHS) Genesis and the laboratory information system (LIS), as specified in the SOW.

(b) The system shall have the ability to receive HL7 order messages (ORM) and information from the LIS and provide DICOM Modality Worklist to the modalities.

(c) If the vendor is not already approved to connect to CHCS bi-directionally, the vendor shall agree to complete any bi-directional interface integration at no additional cost to the Government. Interface integration must be completed prior to final acceptance of the system.

4.3. SECURITY CLEARANCES

4.3.1. Personnel to be assigned to an Automated Data Processing (ADP)/IT position must undergo a successful security screening before being provided access to DoD information technology resources. Prior to an employee being granted interim access to DoD sensitive information, WBAMC must receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement shall (must) be met by Contractors, subcontractors and other who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under HIPPA. Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees shall (must) have at a minimum an ADP Sensitivity Designation of Level II to access the DoD Network.

4.3.2. All Contractors that use the DoD gateways to access Government systems shall submit a DISA Form 41 or equivalent in accordance with COR guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface. Contractors shall complete and submit to TMA one Form 41 for their organization, attached to which shall be a listing of those individuals for whom background checks have been completed, submitted to the OPM, and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request must clearly delineate the ports and protocols used for each Internet Protocol (IP) address. The Contractor shall complete the form and submit to the Government for final processing.

4.3.3. All costs for the Contractors employee background investigations are the responsibility of the Contractor, unless the investigation is completed by the Government, which would be at no cost to the Contractor.

4.3.4. The terms and conditions of this clause must be completed no later than three (3) months post award.

4.4. BUSINESS TO BUSINESS (B2B) PARTNERS AND 3rd PARTY VENDORS

4.4.1. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

4.4.2. PERSONNEL SECURITY.

4.4.2.1. The Contractor shall comply with the following:

DoD Directive 8500.01, “Cybersecurity DoD Directive 5400.11, “DoD Privacy Program”

DoD 6025.18-R, “DoD Health Information Privacy Regulation” DoD 5200.2-R, “Personnel Security Program Requirements” Llocal regulations as deemed appropriate by the Information Assurance Officer AR 25-1, “Army Knowledge Management and Information Technology” AR 25-2 “Cybersecurity” AR 525-13 Antiterrorism AR 530-1 Operations Security (OPSEC) DOD Instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)

4.4.2.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

4.4.2.2.1. Follow the DoD guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT- III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

4.4.2.2.2. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility local area network (LAN).

4.4.2.2.3. Immediately report to the MTFs Security Office and deny access to any automated information system (AIS), network, or information if a Contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for any reason.

4.4.2.2.4. Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

4.4.2.3. AT Level 1 Training. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities, and controlled access areas shall complete AT Level 1 training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable.

The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR, or to the Contracting Officer, if a COR is not assigned, within 10 days after completion of training by all employees and subcontractor personnel. AT Level 1 Awareness Training is available at the following website: https://atlevel1.dtic.mil/at.

4.4.2.4. Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractors employees shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as direct by DOD, HQDA, and or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

4.4.2.5. OPSEC Training. Per AR 530-1, Operations Security, new contractor employees must complete Level 1 OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete annual OPSEC awareness training.

4.5. ELECTRONIC SECURITY.

4.5.1. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of WBAMC shall operate in accordance with controlling laws, regulations, DoD, and local policy.

4.5.2. Certification & Accreditation (C&A) requirements apply to all DoD and Contractor’s IS/networks that receive, process, display, store or transmit DoD information. The Contractor shall comply with the C&A process for safeguarding IS. Certification is the determination of the appropriate level of protection required for IS/networks.

Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

4.5.3. Accreditation is the formal approval by the Government to operate the Contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections; and with appropriate level of protection for the specified period.

4.5.4. The Contractor shall comply with C&A requirements, as specified by the Government that meet appropriate DoD Information Assurance requirements. The C&A requirements shall be met before the Contractor’s system is authorized to access DoD data or interconnect with any DoD IS/network that receives, processes, stores, displays or transmits DoD data.

4.5.5. Contractors shall confirm that their networks are locked down prior to initiating testing.

4.5.5.1. Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

4.5.5.2. Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

4.5.6. Any re-configuration or change in the system during the C&A testing process shall require a re-base lining of the system and documentation of system changes.

4.5.7. Information Assurance (IA) mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the Government shall be in compliance with all known applicable Department of Defense Computer Emergency Response Team (DoD-CERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

4.5.8. Disposing of Electronic Media. Contractor shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Contractor is required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

4.5.9. Information Assurance Vulnerability Management (IAVM). The Contractor shall implement an information assurance vulnerability management program for all AIS and corresponding subnets that are connected to or intermittently connect to DoD networks. The program shall meet the scope and intent of AR25-2 and WBAMC IA policies to provide protection against known threats and vulnerabilities. Compliance with DoD IAVM alerts and bulleting is required for these systems and shall be completed within the specified timeframe.

4.6. INFORMATION SYSTEMS (IS)/NETWORKS PHYSICAL SECURITY.

4.6.1. The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor shall support a Physical Security Audit performed by the Government of the Contractor's internal information management infrastructure.

4.6.2. The MHS Physical Security Audit Matrix is available at:

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls.

4.6.3. The Contractor shall correct any deficiencies identified by the Government of the Contractor's physical security posture.

4.7. SPECIAL REQUIREMENTS FOR PROTECTED HEALTH INFORMATION.

4.7.1. Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the Contractors shall (must):

4.7.2. Notify the MTF HIPAA Security Manager.

4.7.3. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

4.8. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (June 2012) In accordance with DoD 6025.18-R “Department of Defense Health Information Privacy Regulation,” January 24, 2003, the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and in DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

(a) Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DoD 6025.18-R or DoD 8580.02-R.

Individual has the same meaning as the term “individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 160.103, limited to the information created or received by the Contractor from or on behalf of the Government pursuant to the Contract.

Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

Required by Law has the same meaning as the term “required by law” in 45 CFR 164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part 164, subpart C.

Terms used, but not otherwise defined, in this Clause shall have the same meaning as those terms in 45 CFR 160.103, 160.502, 164.103, 164.304, and 164.501.

(b) The Contractor shall not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

(c) The Contractor shall use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Contract.

(d) The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

(e) The Contractor shall, at their own expense, take action to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Clause. These mitigation actions will include as a minimum those listed in the TMA Breach Notification Standard Operating Procedure (SOP), which is available at: http://www.tricare.mil/tma/privacy/breach.aspx.

(f) The Contractor shall report to the Government any security incident involving protected health information of which it becomes aware.

(g) The Contractor shall report to the Government any use or disclosure of the ProtectedHealth Information not provided for by this Contract of which the Contractor becomes aware.

(h) The Contractor shall ensure that any agent, including a subcontractor, to whom itprovides Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

(i) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

(j) The Contractor shall provide access, at the request of the Government, and in the timeand manner reasonably designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

(k) The Contractor shall make any amendment(s) to Protected Health Information in a Designated Record Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government, and in the time and manner.

(l) The Contractor shall make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner.

(m) The Contractor shall document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

(n) The Contractor shall provide to the Government or an Individual, in time and manner reasonably designated by the Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

General Use and Disclosure Provisions Except as otherwise limited in this Clause, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the HIPAA Privacy Rule, the HIPAA Security Rule, DoD 6025.18-R or DoD 8580.02-R if done by the Government.

Specific Use and Disclosure Provisions

(a) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(b) Except as otherwise limited in this Clause, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(c) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

(d) Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1).

Obligations of the Government Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

(a) The Government shall provide the Contractor with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520.

(b) The Government shall provide the Contractor with any changes in, or revocation of, permission by

Individual to use or disclose Protected Health Information, if such changes affect the Contractor’s permitted or required uses and disclosures.

(c) The Government shall notify the Contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

Permissible Requests by the Government

The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Privacy Rule, the HIPAA Security Rule, or any applicable Government regulations (including without limitation, DoD 6025.18-R and DoD 8580.02-R) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

Termination

(a) Termination. A breach by the Contractor of this clause, may subject the Contractor to termination under any applicable default or termination provision of this Contract.

(b) Effect of Termination.

(1) If this contract has records management requirements, the records subject to the Clause should be handled in accordance with the records management requirements. If this contract does not have records management requirements, the records should be handled in accordance with paragraphs (2) and (3) below

(2) If this contract does not have records management requirements, except as provided in paragraph (3) of this section, upon termination of this Contract, for any reason, the Contractor shall return or destroy all Protected Health Information received from the Government, or created or received by the Contractor on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the Protected Health Information.

(3) If this contract does not have records management provisions and the Contractor determines that returning or destroying the Protected Health Information is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of Protected Health Information is infeasible, the Contractor shall extend the protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such Protected Health Information.

Miscellaneous

(a) Regulatory References. A reference in this Clause to a section in DoD 6025.18-R, DoD 8580.02-R, Privacy Rule or Security Rule means the section currently in effect or as amended, and for which compliance is required.

(b) Survival. The respective rights and obligations of Business Associate under the “Effect of Termination” provision of this Clause shall survive the termination of this Contract.

(c) Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with DoD 6025.18-R, DoD 8580.02-R, the HIPAA Privacy Rule or the HIPAA Security Rule.

5. PROGRAM MANAGEMENT

5.1. GENERAL. The Contractor shall provide comprehensive Program/Project Management services.

5.2. Program Manager (PM). The Contractor shall provide a dedicated PM, who shall be responsible for the initial instrument implementation, instrument upgrades, implementation of new methods or procedures and optimization of workflow processes and procedures.

5.2.1. The PM, and an alternate who shall act for the Contractor when the PM is absent, shall be designated in writing to the Contracting Officer and Contracting Officer Representative (COR) within 10 days of contract award.

5.2.2. The PM and alternate PM shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract.

5.2.3. The PM and/or alternate shall be actively engaged in all aspects of this PWS.

5.2.4. The Contractor shall provide an Information Technology Project Manager for implementation of the instrument interface and middleware.

5.2.4.1. The IT PM shall have demonstrated working knowledge of Information Security Requirements specific to DoD installations as detailed in Section 6 of this PWS.

5.2.4.2. The IT PM shall have a demonstrated working knowledge and competency in the installation, troubleshooting, validation and development of the instrument interface requirements as they relate to CHCS.

5.2.5. The PM or alternate PM shall be available during normal duty hours to meet on the installation with Government personnel (designated by the Contracting Officer) to discuss problem areas. After normal duty hours, the manager or alternate shall be available within 48 hours.

5.2.6. The PMs (both PM and IT PM) shall hold current certification as a Project Management Professional (PMP) through a nationally recognized accrediting agency (e.g. The Project Management Institute). Certificates shall be provided to the Government upon appointment to this contract.

5.2.7. The PMs shall have a working knowledge of the Government Extension to the PMBOK® (Project Management Body of Knowledge) Guide-Third Edition, as it applies to the Government sector.

5.2.8. The PM and IT PM shall not have other assigned Sales, Field Services or Technical Service responsibilities.

5.3. Specific instrument layout and selection of pre-analytic, post-analytic and track delivery systems will be determined by a detailed, comprehensive workflow analysis.

5.3.1. The workflow analysis shall be conducted IAW commonly accepted industry standards for maximizing efficiency as outlined in the PMBOK® Guide 3rd Ed, and Lean/Six Sigma principles.

5.3.2. The workflow analysis shall focus on maximizing efficiency, menu and throughput, and minimizing turn-around-times.

6. APPLICABLE TECHNICAL ORDERS, SPECIFICATIONS, REGULATIONS, AND MANUALS.

6.1. GENERAL. Applicable documents - The latest practicable local (Texas) and national (US) technical regulations are applicable for the manufacturing of the system. In case of differences between local and national regulations, the regulations containing the most stringent requirements shall govern. Contractor will comply with all U.S. laws pertaining to medical equipment. Contractor will also comply with all Department of Defense (DOD), Department of Army (DA), US Army Medical Command (USAMEDCOM), Central Regions Medical Command and William Beaumont Army Medical Center regulations and policies pertaining to medical equipment. Current issues of many DA publications can be accessed at http://www.usapa.army.mil/gils. Current issues of many forms can be accessed at http://www.usapa.army.mil/forms. Publications and forms not on the internet can be obtained from the MTF.

These regulations include, but are not limited to, the following:

6.2. The Publications have been coded as mandatory or advisory. The Contractor is obligated to follow those coded as mandatory only to the extent that they apply to this contract. Supplements, amendments, or changes to these mandatory publications may be issued during the life of the contract. Advisory publications may be used for information and guidance but are not binding for compliance.

6.3. Publications:

6.3.1. Mandatory:

Public Law 91-596 29 Dec 70 Occupational Safety and Health Administration Public Law 104-191 (Aug 1996) Health Insurance Portability and Accountability Act of 1996 Current Edition Joint Commission for Accreditation of Healthcare Organizations (JCAHO) Manual AR 40-1 Composition, Mission, and Functions of the Army Medical Department AR 40-2 Army Medical Treatment Facilities and General Administration AR 40-4 Army Medical Department Facilities/Activities

AR 40-68 Quality Assurance Administration AR 340-21 The Army Privacy Program (05 Jul 85) AR 380-19 Information Systems Security AR 380-76 The Department of the Army Personnel Security Program AFIP PAMPHLET 40-24; Clinical Laboratory Improvement Program (CLIP) policy mandated by DODI 6440.2 NFPA 99, Chapter 7.7.3.2. Advisory AR 310-25 Dictionary of United States Army Terms MEDCOM Pam 25-31 Index of Command Administrative Publications (15 AUG 01)

7. ADMINISTRATIVE

7.1. Reports. The Contractor shall submit reports to the COR or contracting officer as requested for use in monitoring Contractor performance. The Contractor shall provide the balance of the required information to the clinical engineering manager no later than 48 hours after services are completed."

7.2. Safety. The Contractor shall ensure its personnel comply with all installation and MTF safety regulations. Such regulations include, but are not limited to, general safety, fire prevention, and waste disposal. Copies of these regulations are on file in the medical activity safety office or may be obtained through the COR. The use of cellular phones and 2-way radios is expressly forbidden in all Medical Treatment Facilities and Health Clinics. "The government and the contractor's service representative will exchange hazard communication information before the commencement of any repair." "When required, the contractor's service representative will comply with the Office of Safety and Health Administration (OSHA) lockout/tag-out standards while performing sustainment on

MD/MDS."

7.3. Invoices and Payment Information.

Payment will be made by Defense Finance and Accounting Service, (DFAS Indianapolis), Indianapolis, IN (address in Block 18a), after receipt of services. Contractor submits their 2-n-1 invoice in the Wide Area Workflow (WAWF) system for payment. The Contracting Officer's Representative (COR) shall verify for acceptance to be submit to DFAS Indianapolis. Government Payment will only be authorized for services actually rendered. Advance payments under this contract are not authorized.

8. CONTRACTOR CONDUCT

8.1. The Contractor is responsible for the conduct of his/her employees. All services shall be provided IAW established standards, principles, and ethics of the profession and applicable professional specialty organizations, and shall ensure the highest regard to patient dignity.

8.2. The Contractor shall ensure that its personnel comply with MTF policies regarding personal appearance and conduct.

8.3. Inquiries. Contractor shall ensure that its personnel do not respond to any media inquiries. Any inquiries from the media shall be immediately relayed to the COR, who will relay them to the MTF Commander. There shall be no interviews, comments, or any other response without the knowledge and approval of the MTF Commander. Other than routine inquiries from external agencies, all other inquiries and complaints shall be brought to the attention of the Government.

8.4. Smoking. The Contractor shall ensure its personnel shall comply with the MTF smoking policy.

8.5. Complaints. Complaints will be validated by the COR and be reported in writing to the Contracting Officer and the Contractor for action, if it constitutes a failure to perform, as determined by the Government. The Contractor shall have no more than one substantiated complaint for each period of performance.

8.6. Contractor Representation. The Contractor shall designate a Contract Officer Technical Representative (COTR) for the contract. The COTR shall be the only authorized representative of contractor authorized to discuss with the COR, any and all sustainment services required by the contract and ensure response to requests for performance of the contract. The COTR shall have the authority to make decision for the Contractor. The Contracting Officer or the COR shall be notified promptly whenever the POC changes. COTR shall be submitted no later than 10 days after award of contract, and shall include as a minimum name, title, and telephone number.

9. GOVERNMENT /CONTRACTOR FURNISHED PROPERTY

9.1. Government. The COR will provide the contractor access to the MD/MDS covered under the contract.

10. CONTRACTOR

10.1. The Contractor shall provide each employee an identification badge which shall be displayed on their outer garment at all times when responding to a service call at IACH. The badge shall include, at a minimum, the employee's name, current picture, Company name, and job title.

10.2. Other than validation kits and certain other materials as described in the instructions for use provided by Contractor, all materials, other than those materials specified as Government furnished, required in the performance of this contract shall be furnished by the Contractor.

10.3. Availability of manufacturer's service literature needed in the performance of the contract will be Contractor's responsibility and will remain Contractor-owned at the termination of the contract. The Contractor shall obtain the currently available literature of the original equipment manufacturer (OEM).

10.4. MD/MDS sustainment performance under the contract includes the unlimited replacement of defective parts IAW the terms of Contractor's Standard Limited Warranty or Extended Warranty, if applicable.

10.5. Contractor shall notify the COR when replacement parts are needed to complete service are not available.

10.6. The government will not be responsible for any damages or loss of Contractor supplies, materials, or equipment nor is the government responsible for any damages or loss of the Contractor employees' personal belongings, due to fire, theft, accidents or other causes.

10.7. The Contractor shall report immediately to the government point of contact, or the Chief of Equipment Management Branch (EMB), all accidents which may arise out of or in connection with the performance of services required within the scope of this contract.

11. SCOPE OF WORK

11.1. Contractor employees shall check-in at room 0B110, ground floor, Clinical Engineering Branch, with the COR, ACOR, OIC, NCOIC, or EMB Supervisor before proceeding to complete sustainment services.

11.2. Persons Authorized to Make Calls. Only those people listed below and the contracting officer are authorized to give the Contractor instructions, place service calls, or request updates status. The government representative will call and leave their name and number. The Contractor shall return the call or come directly to the Medical Maintenance Branch to verify instructions prior to initiating any action.

11.3. Contracting Officer's Representative (COR). The COR will not be appointed. However, the Contracting Officer will designate a primary point of contact in which the Contractor will receive guidance.

11.4. Any service performed without the prior approval of one of the individuals above shall be at no cost to the government.

11.5. Unscheduled Replacement.

11.5.1. DELETED

11.5.2. DELETED

11.5.3. DELETED

11.5.4. DELETED

11.6. Service Reports.

11.6.1.1. Upon completion of services by the Contractor's service representative, a written service report shall be provided to the clinical engineering staff. In the event all information is not available to the contractor's service representative when services are performed, the initial service report shall include all available information. This report is initiated by the Contractor at the completion of each service and at the minimum will include: Contract number, Contractor's name, COTR's name (full printed and signed name), Equipment Control Number and serial number of MD/MDS being sustained.

11.6.1.2. The time required to complete the work, price of labor (hourly rate), and a list of parts replaced with part numbers and list prices for each part used. Hours are in tenths and rounded up to the nearest tenth of an hour.

Example 1.1 is one hour and six minutes.

11.6.1.3. After performing calibration/verification/certification services, the COTR shall affix and/or update DD Form 2163 (Medical Equipment Verification/Certification) IAW the instructions provided in TB 38-750-2, or by the clinical engineering activity's internal SOP.

12. OTHER REQUIRED TASKS

12.1. Contractor's service representative shall report to the Clinical Engineering Branch, Building 650, Room 0B110 and sign-in the Contractor's Log by indicating company name, individuals name, time of arrival, and destination.

When departing IACH, the COTR must report back to Clinical Engineering and provide the service report as required if available.

12.2.