W81K00-23-Q-0124 - Solicitation Amendment 0001 - HPV Testing Requirements.pdf

W40M USA HCA

REGIONAL HEALTH CONTRACT OFF CENTRAL

POC: MEDINA L. WOODSON

3551 ROGER BROOK DR BLDG 3600

FORT SAM HOUSTON TX 78236-6200

0011891382-0001

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

A. The purpose of this Solicitation Amendment 0001 is to:

1. Incorporate the revised Statement of Work dated 20 July 2023 resulting from the question & answ er segment.

2. Include the Government answ ers to questions received in response to this solicitation.

3. Extend the solicitation closing date/time to 28 July 2023, 4:00 PM CST.

B. All other solicitation terms and conditions remain the same.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 22

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 20-Jul-2023

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X W81K0023Q0124

X 9B. DATED (SEE ITEM 11)

11-Jul-2023

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

20-Jul-2023

CODE

W40M USA HCA

MEDICAL READINESS CONTR OFFICE WEST

3160 MCINDOE BLDG 1103

JBSA FT SAM HOUSTON TX 78234-4504

W81K00 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE W81K00

FACILITY CODECODE

EMAIL:TEL:

W81K0023Q0124

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been added by full text:

QUESTIONS & ANSWERS

Vendor Questions and Government Response for Solicitation W81K00-23-Q-0124

1. Offeror Question: Attachment B ‐ The evaluation criteria for volume 4 price factor 5 requires us to submit a unit price and estimated quantities for items such as consumables and controls. Where would the government like this to be provided?

Government Response: Please include the total pricing for CLINs 0001, 0002 and 0003 under the unit price and total on the Attachment B pricing matrix for the Base Period and all four Option Years. Please also provide a separate proposal that includes a breakout of all instrumentation/equipment, reagents, consumables and controls included in the price of this contract. This pricing information will be incorporated into the contract.

2. Offeror Question: Attachment B pricing matrix, no subclins are listed?

Government Response: Correct, since this requirement will be utilizing a Cost‐Per‐Test arrangement, all pricing for the instrumentation, reagents, consumables and controls are consolidated and covered under one CLIN.

3. Offeror Question: Attachment A ‐ requirement Automated decapping and recapping request would be available on preanalytical instrumentation separate from the HPV analyzer.

Is this a separate job, intended to be part of this solicitation?

Government Response: After review of the Offerors questions, DPALS has agreed to remove this requirement from the SOO. Please see updates to the Statement of Objective section 6.22 as applicable.

4. Offeror Question: In reviewing the SAM.gov posting for the subject solicitation I believe the incorrect Attachment A may have been posted. When I open the file named Attachment A it is identical to the file titled Solicitation. Per the list of attachments on Page 78 of the Solicitation, I believe Attachment A should be the Statement of Work. Can you confirm if the incorrect Attachment A was loaded or if what is current in SAM.gov is accurate?

Government Response: The correct Attachment A with the Statement of Objectives was uploaded on SAM.Gov on 13 July 2023 for Solicitation W81K00‐23‐Q‐0124. However, the Statement of Objectives has been included as an attachment to this Solicitation, Amendment 0001.

5. Offeror Question: Under what circumstance would the government extend current contract for a limited period of 6 months until at which time an additional manufacturer becomes available in order to provide for open and full competition as per the FAR 6.01?

Government Response: The solicitation is posted as full and open competition. Any and all offerors who meet the requirements are permitted to submit a response to the Government’s solicitation.

6. Offeror Question: Does the instrument need to except both Thinprep and Surepath vials?

Government Response: The equipment must be compatible with Thinprep vials.

Surepath is excepted.

7. Offeror Question: Unless I am missing it, there seems to be missing attachments and details referenced in the initial posting. Missing the Statement of Objectives document. The SOO is reference throughout Attachment A.

Government Response: The correct Attachment A with the Statement of Objectives was uploaded on SAM.Gov on 13 July 2023 for Solicitation W81K00‐23‐Q‐0124. However, the

8. Offeror Question: We need testing volumes to determine appropriate instrument offering and pricing. This information was not made available on Pricing Worksheet ‐ Exhibit B.

Government Response: The Expected Annual Tests Volume are included in Table 1 of the Statement of Objectives. The correct Attachment A with the Statement of Objectives was uploaded on SAM.Gov on 13 July 2023 for Solicitation W81K00‐23‐Q‐0124. However, the

9. Offeror Question: Confirm Acquisition Method‐Cost Per Test.

Government Response: The Cost‐Per‐Test Arrangement is confirmed for this HPV testing requirement.

10. Offeror Question: Is Authority to Operate (ATO) required to bid ‐OR‐ will an approved Risk Management Cybersecurity Assessment be sufficient?

Government Response: An ATO is not required to submit a proposal, however offerors must review and be able to comply with the requirements as outlined in the Risk Management Framework Guidance provided.

11. Offeror Question: Upon further discussions internally, genotypes uniquely identified by our solutions are aligned with patient populations categorized as high risk for cervical cancer. In order to properly serve constituents, can specific demographics be provided for the patient population being testing?

Government Response: No demographics can be provided for the testing of the patient population.

Brooke Army Medical Center provides care to wounded Service Members, Active duty members, beneficiaries, and the San Antonio Community at‐large. With an average of 1,500 cases per month, BAMC is the most robust and productive healthcare organization within the Military Health System

(MHS).

REVISED STATEMENT OF OBJECTIVE

STATEMENT OF OBJECTIVES

HPV DNA Amplification/Detection Test

Department of Pathology and Area Laboratory Services (DPALS) Brooke Army Medical Center (BAMC)

1. Scope

1.1. The Contractor shall provide new molecular testing equipment, reagents, consumables, maintenance support and instrument warranties used in support of Human Papillomavirus (HPV) Deoxyribonucleic Acid (DNA) Amplification/Detection Testing for the Department of Pathology and Area Laboratory Services (DPALS), Microbiology Section, Molecular Laboratory at the Brooke Army Medical Center (BAMC), Joint Base San Antonio, TX 78234.

1.1.1. All supplies and warranties outlined in this Statement of Objectives (SOO) shall be supplied and serviced through a single Contractor (to whom the contract is awarded, to include any parts, equipment, or supplies not manufactured, provided or serviced by the Contractor).

1.1.2. All supplies and work performed in connected with warranties shall preserve the US Food and Drug Administration (FDA) approved status of the assays and instrumentation used.

2. Purpose Persistent infection with human papillomavirus (HPV) is the principal cause of cervical cancer. HPV 16 is by far the most common and oncogenic genotype. HPV DNA detection, in conjunction with cytology, is important in cervical cancer screening and the treatment of cancer precursors. Genotyping of different high-risk HPV types (including genotyping for 16 and 18) is helpful for the risk stratification of HPV-positive women. It is essential that these HPV DNA detection testing supplies are obtained as quickly as possible for BAMC and all its surrounding clinics/healthcare network to ensure protection of the public’s health.

In order to be able to conduct these tests, reagents and automated analyzers are needed for period of performance 1 October 2023 to 30 September 2024 with four (4) option years 1 October 2024 thru 30 September 2028. The equipment shall be able to connect to MHS Genesis and shall come with an un-interruptible power supply capable of providing power for at least 45 to 60 minutes. All equipment and supplies shall be approved by the FDA. The system is FDA Approved Guided programming. This requirement is needed NLT 1 October 2023. All detailed information regarding delivery and installation is provided in the SOO.

3. Ordering Period

Base Period: 1 October 2023 – 30 September 2024

Option 1: 1 October 2024 – 30 September 2025 Option 2: 1 October 2025 – 30 September 2026 Option 3: 1 October 2026 – 30 September 2027 Option 4: 1 October 2027 – 30 September 2028

3.1. The Government will order items on as needed basis and shall only pay for the actual number of tests ordered, received, and accepted by the Government. The quantities listed in the workload data table represent anticipated test volumes for the period of performance listed; however, quantities could increase and/or decrease during certain periods and/or months.

3.2. The inspection and acceptance for all deliverables rendered under this contract will be by the appointed Ordering Officer. The performance by the contractor technician, the quality of services rendered, and any documentation or written material in support of same, shall be subject to continuous inspection, surveillance and review for acceptance by the designated ordering officer representative. Other evaluation factors will be monitored that are not quantified by numerical measurements.

4. Hours of operation:

The Molecular Laboratory is in operation 24 hours a day, 7 days a week. Normal business hours for administrative personnel are Monday through Friday between the hours of 0730 – 1630 CST. Contractor shall coordinate maintenance scheduled with Ordering Officer (OR) and appointed on duty staff in absence of OR no less than 48 hours after receipt of notification.

5. Security requirements and safety:

5.1. SECURITY. The Contractor shall ensure its personnel comply with the local installation requirements for vehicle registration and operation on the military facility. Any vehicle entering the military installation shall have the minimum liability coverage required by the state in which the performance is located. The Contractor shall ensure its personnel comply with installation and military treatment facilities (MTF) personnel identification and access requirements.

5.2. Contractor and all associated sub-contractors personnel shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

5.3. SAFETY. The Contractor shall ensure its personnel comply with all installation and MTF safety regulations. Such regulations include, but are not limited to, general safety, fire prevention, and waste disposal. Copies of these regulations are available in the medical activity safety office or may be obtained through the appointed personnel. The government and the contractor’s service representative will exchange hazard communication information before the commencement of any repair. When required, the contractor’s service representative will comply with the Office of Safety and Health Administration (OSHA) lockout/tag-out standards.

6. Instrument/equipment requirement (owned by contractor):

6.1. The offeror shall provide two new (not refurbished) instruments for BAMC molecular lab.

6.2. Testing systems shall be FDA-approved primary screening for cervical carcinoma and shall include testing for the following: HPV High Risk pool plus HPV 16 & 18 Genotype simultaneously eliminating the need to re-run a sample; as well as a traditional High Risk pool (14 HR Genotypes) with no grey zone or indeterminate results.

6.3. Testing shall be performed on a fully automated In vitro diagnostics (IVD) platform. Each analyzer and all associated reagents shall be approved by the Food & Drug Administration (FDA). All analyzers and associated parts and accessories shall be new. No used, refurbished, or like-new equipment shall be provided in support of this contract at any time.

6.4. Testing for HPV shall be FDA approved and meet HPV testing needs in Atypical Cells of Undetermined Significance (ASCUS) and Negative for Intraepithelial Lesion or Malignancy (NILM) as detailed in recent American Congress of Obstetricians and Gynecologists (ACOG) guidelines and allowed to be used as a first-line primary cervical cancer screening test to detect high risk HPV including genotyping for 16 and 18.

6.5. Testing systems shall process at least 376 to 400 specimens per day using 2 instruments in an 8 hour shift.

6.6. Testing shall contain an internal control for cellularity check such as β globin.

6.7. Testing shall detect HPV DNA

6.8. Testing shall show no cross-reactivity with low-risk HPV genotypes.

6.9. Testing shall accept multiple primary vial formats, including liquid-based cytology PreservCyt containers, for automatic nucleic acid extraction so that no routine pipetting into secondary tubes is required.

6.10. Automated pipetting of specimens shall have a system to prevent cross-contamination by securely locking pipette tips in place to avoid motions that could create aerosols of samples/reagents. Pipetting aspiration and dispensing shall be monitored by pressure within the tips to detect low volumes and clogs to ensure valid results. The system shall have criteria that exist to report an error when low volumes and/or clogs are detected.

6.11. Testing shall offer detection and separation of multiple targets from 1 reaction tube.

6.12. The testing system shall provide bi-directional LIS communication with MHS Genesis to simplify test ordering and support the integrity of results so that no manual data entry is required.

6.13. The testing system shall offer a fully automated pre-analytical component that standardizes sample handling and automates mixing and uncapping of PreservCyt containers and automated barcode check and sample alignment. This pre-analytical step shall have minimal hands-on time requiring less than 5 minutes of setup.

6.14. Pipetting shall be performed utilizing aerosol barrier tips.

6.15. Platform shall be compatible with facility data transfer systems.

6.16. A data management system, to include middleware, not contained within the Molecular analyzer

6.17. The system shall provide a central data management hub, to which all major systems included in this SOW connect to Unit 1 - Sample processing/extraction unit; Unit 2 Amplification/detection unit.

6.18. The system shall not require remote communication to outside sources to be functional.

6.19. Software shall track instrument maintenance requirements.

6.20. The analyzers shall be able to recognize MHS Genesis generated bar-code labels (both code 39 and 128) on primary sample tubes.

6.21. Peripherals, to include Uninterruptable Power Sources (UPSs), electrical line conditioners as required, instrument-specific computer terminals/CPUs, printers to include toner for each as needed, and other equipment where required.

6.22. Sample Processing System to perform the requested processing:

6.22.1. Shall perform standardized sample handling to include automated barcode check and alignment

6.22.2. Shall perform automated mixing produces consistent homogeneity

6.22.3. Shall contain built in feature to reduce the risk of cross-contamination

6.22.4. Shall decap or recap 94 samples in less than 30 minutes (walkaway time)

6.22.5. The system shall not require remote communication to outside sources to be functional.

6.22.6. Platform shall operate using one computer.

6.22.7. Pedestal(s) capable of supporting each workcell system as appropriate, to include computer terminals or other automated instruments/peripherals as appropriate, providing a neat work area (e.g., reagent, cable and tubing control/maintenance).

6.23. The Instruments will be installed with backs of machines near wall. Each analyzer, including printer, monitor, UPS, and computer system, shall fit within the dimensions outlined in figure below and complete operations on one platform. Sufficient room for proper exhaust and heat clearance based on manufacture’s site specifications shall be maintained, with at minimum a 6” clearance between the existing wall and instruments. Any sliding compartments or access drawers for servicing cannot extend beyond the width of each individual unit outlined in figure below when fully expanded.

6.24. Lab Layout. The offeror shall provide a diagram or other graphical representation demonstrating how its proposed equipment fits within the dimensions below with its quote.

7. Reagent Requirements – Molecular Diagnostics Laboratory The Contractor shall provide the following at a minimum for Molecular Laboratory operations at the main hospital located at BAMC:

7.1. The contractor shall have FDA approved Reagents/consumables that shall meet the requirements of the Reference laboratory mission, workload, and test menu (see Tables 1).

7.2. The Contractor shall provide all reagents/reagents packs, calibrators/standards, quality control materials, user- replaceable maintenance items, and analyzer specific tools/supplies to support the ongoing delivery of laboratory services using the equipment outlined in this section.

7.3. Reagents/consumables shall meet the requirements of the 24/7 BAMC mission, workload, and test menu.

7.4. The Contractor shall provide quality control materials acceptable to the Molecular Laboratory Medical

Director. This includes third-party controls when requested/required by the laboratory.

7.5. In determining reagent requirements, the Contractor shall consider requirements for routine quality control runs (as defined by the Laboratory Director), routine calibration, periodic calibration/calibration verification in accordance with departmental policy and troubleshooting of out-of-control assays when calculating the yearly requirements.

7.6. Reagents used for troubleshooting analytical systems shall be reimbursed (or replaced) by the Contractor at no additional cost.

7.7. The Contractor shall sequester lots of required quality control materials and test reagents so that a change in lot will not be more frequent than once a year.

7.8. The Contractor shall provide, upon shipment, an electronic tracking mechanism whereby the Government is able to identify the shipping status of any equipment, reagents, or materials. Deliveries of required items shall be in monthly drop shipments on the second Wednesday of the month. Orders called in by the COR or ACOR shall arrive no later than one week from the requested date of delivery. Any supplies that are placed on back order shall be communicated electronically to the Government, clearly identified on the shipping documents and delivered in a timely manner, not to exceed ten (10) working days. In the instance a back- order exceeds 10 working days, the Contractor shall provide testing services through local sub-contract at their cost.

7.9. Emergency orders shall be delivered within 24 hours after the order is placed.

7.10. The Contractor shall provide paper and electronic copies of safety data sheets (SDSs) for each reagent item delivered under this contract (as appropriate).

8. Delivery of Equipment

8.1. Vendor shall provide transition plan for instrument(s)/equipment delivery, installation, and verification that aims at avoiding or minimizing interruption of in-house testing, expenses associated with send-out of samples to reference laboratory for testing, and impact to patient care.

8.2. Vendor shall indicate in transition plan what facility modifications will be required for instrument(s)/equipment delivery.

8.3. All equipment (owned by contractor) shall include delivery, installation, maintenance, and removal upon termination of contract. Contractor shall furnish all necessary calibrators/standards and quality control materials necessary to perform the initial method verifications per Clinical Laboratory Improvement Amendments (CLIA)/ National Committee for Clinical Laboratory Standards (NCCLS) guidelines.

8.4. The instrument(s)/ equipment shall be delivered to the Brooke Army Medical Center (4th floor), Molecular laboratory (room 428-5) within 30 days or less after contract award. Exact installation location shall be coordinated by contractor and government point of contact (OIC and/or NCOIC). Equipment setup, LIS connectivity, on-site training, and method verification studies, shall be completed by vendor personnel within six (6) weeks or less after contract award to ensure that equipment is fully operational.

8.5. SAFETY DATA SHEETS (SDS): The contractor shall provide safety data sheets (SDS) for each item delivered under this contract that is considered to be HAZARDOUS MATERIAL. The SDS shall contain information on the hazards associated with each specific chemical or material. The SDS shall contain at a minimum the following information: identification of the specific hazard, the required practice for the safe use of the product, first aid procedures, and what to do in the event of a spill or other mishap or accident.

8.6. The contractor shall be responsible for installation, which consists of in-house delivery, positioning, and mounting of all equipment listed on the delivery order and connections of all equipment and interconnecting wiring and cabling if applicable in coordination with the facility biomedical engineer.

Upon receipt of notice to proceed with installation, it shall be the contractor's responsibility to inform the Contracting Officer of any problems which may be anticipated in connection with installation, or which will affect optimum performance once installation is completed. In the event that progress of the installation is interrupted through no fault of the contractor, the continuous installation referenced in the preceding paragraphs may be terminated until such time as the cause of delay has been eliminated, and then shall be resumed within 24 hours after the contractor has been notified that work may again proceed.

8.7. Vendor shall provide equipment installation and possible reinstallation at minimal costs if the equipment is required to be moved due to construction or laboratory redesign.

8.8. All reagents shall be available for delivery within one business day of contract award date.

Delivery shall be to the following address:

Brooke Army Medical Ctr Bldg. 3600 3551 Roger Brooke Dr

Fort Sam Houston TX 78234

The Point of Contact (POC) for all deliveries:

NCOIC or Supervisor, Microbiology Laboratory Department of Pathology and Area Laboratory Services San Antonio Military Medical Center Tel: (210) 916-5005

9. Installation and Validation During the installation and validation of the equipment and tests to be performed by the Contractor, the Contractor will coordinate scheduled meetings with technical experts of the Laboratory to discuss milestones and to provide updates on completion date. Following the completion of the installation of the new equipment and validation of the tests to be performed, the Contractor will meet with technical experts from the Laboratory at times mutually agreeable to discuss areas of interest to the Laboratory or hospital staff. When the validation of the equipment and tests are to be performed, the Contractor shall provide all reagents, calibrators, controls and any other materials used at no additional cost to the Government. The contractor will provide analyzed data to laboratory supervisor for approval. If the validations are not found to be adequate, the Contractor will be responsible for repeating studies in a timely manner in order for the laboratory to meet go live deadlines.

10. Preventative maintenance, failures and repairs

10.1. The contractor shall provide all personnel, equipment, tools, materials, supervision, parts, transportation, and other items and services necessary to perform all required repairs and scheduled preventive maintenance/safety inspections and calibrations of their equipment. Contractor shall coordinate with the designated point of contact all scheduled maintenance within ten (10) business days prior to performing preventative maintenance services.

10.2. The performance of scheduled periodic preventive maintenance, safety checks, and calibrations that are not normally performed at the operator level will be performed by contractor service personnel in accordance with requirements as specified in the contractor’s instrument maintenance manual. The contractor shall be responsible for furnishing maintenance, services, repairs, and parts as required by manufacturer in order to maintain the system in optimal operating condition.

10.3. The contractor shall provide a full-service plan to include the recommended unscheduled and preventive maintenance service for their instrument/equipment period. Service shall include repair and replacement of defective parts, complete maintenance program (as required by the manufacturer’s maintenance manuals), and hotline telephone service, in order to assist customer in troubleshooting problems.

10.4. Preventive maintenance services shall be performed in accordance with the manufacturer’s standard/procedures. A preventive maintenance service shall include, but is not limited to, safety, calibration, complete operational testing, lubrication, adjustments, and cleaning of equipment to which the operator does not have access. This also includes the installation of all non-operator parts required to ensure proper operation.

10.5. Upon notification of equipment failure own by contractor, the contractor shall respond to telephonic requests for unscheduled repair within 24 hours. Shall the instrument/equipment become inoperable, the contractor’s Repair Service Engineer / technician shall be on-site within 24 hours of initial notification for routine/emergency failures. If the equipment is out of service for longer than 72 hours (from the time-of-service technician’s arrival on site), the contractor shall notify the government point of contract on duty, in writing, as to the reason(s) (i.e. non-availability of parts, etc.) for non-compliance.

10.6. If the equipment cannot be repaired, a replacement instrument shall be provided within seven (7) days. If the equipment cannot be replaced, the Government may seek remedies for non-compliance with terms and conditions of this contract.

10.7. Within one (1) business day after completion of a repair, the contractor’s representative shall furnish the

Point of Contact (POC) one (1) copy of a service report for all services performed. The service report shall contain, at a minimum, the following information:

a. Nomenclature, date, description of services performed (i.e., preventative maintenance service, or unscheduled repair service)

b. Location of services performed, duration of services performed, list of parts replaced, and other actions taken to restore operability of the instrument/equipment, name of technician.

**Full report shall be submitted to designated government point of contact**

10.8. Contractor shall notify government of any hazard information before beginning equipment repair and shall comply with the Occupational Safety and Health Administration while performing maintenance on electrical equipment.

10.9. When appropriate, the contractor’s representative shall attach and complete a DD Form 2163 (sticker), entitled “Medical Equipment Verification/Certification” to the equipment upon completion of calibration services. The Point of Contact will provide the DD Form 2163 to the contractors’ representative. If the DD Form 2163 is already attached to the equipment, the contractors' representative shall update the existing DD Form 2163. Procedures for updating the 2163 will be provided by the Point of Contact.

11. Customer service

11.1. The Contractor shall provide direct customer service and support, during normal business hours and on-call emergency repair service support, to assist operators in correcting equipment operation problems.

11.2. For Emergency Services and unscheduled services, the Contractor’s qualified service technician shall be on-site to provide emergency service (service requiring immediate repair) within 24 hours. The equipment shall be repaired and operational at the minimum of 72 hours after arrival of contractor on site.

11.3. The Contractor shall perform preventive maintenance services (PMS), safety tests, calibrations, and unscheduled repair services in accordance with procedures and practices prescribed by the manufacturer of the equipment. Scheduled routine services shall be performed between 0730-1630 LOCAL Monday- Friday, excluding U.S. Holidays.

11.4. The Contractor shall provide a full unscheduled and preventive maintenance service for the instrument/ equipment owned by contractor. All maintenance and repairs shall be inclusive of all costs for the performance of scheduled periodic maintenance (as required by the Contractor’s instrument maintenance manuals), unscheduled maintenance and repair of the analyzers and any associated equipment provided by the Contractor as part of the analyzer system, including replacement parts, replacement part shipment costs, and service technician travel costs for performance of maintenance services.

11.5. The contractor’s qualified service technician shall be on site to provide routine services; service requiring immediate repair; and scheduled services for preventive maintenance (as specified in the Contractor’s instrument maintenance manual), safety and calibration as required by this statement of work. The equipment shall be repaired and operational within 72 hours after arrival of contractor on site.

11.6. Upon analyzer failure, the Contractor’s qualified service technician shall be on-site to provide unlimited emergency service (service requiring immediate repair; an unscheduled maintenance/service requirement) within 24 hours. The equipment shall be repaired and operational within 72 hours after arrival of contractor on site.

11.7. Shall the analyzer at BAMC become inoperable, the Contractor’s technical repair specialist shall be on-site within 24 hours of initial notification and make the repair within 72 hours after arrival of contractor on site. If the analyzer cannot be repaired within 72 hours after arrival of contractor on site, a replacement analyzer, at no additional cost to the U. S. Government, will be provided within seven (7) days of the initial notification to be utilized by the U.S. Government until the original instrument is fully repaired and accepted for service.

11.8. During the period when the analyzer is inoperable, the Contractor will arrange the pickup and delivery of critical specimens to a College of American Pathologists accredited clinical laboratory of their choice.

The selected laboratory will provide patient reports. Each patient report shall include the testing laboratory’s reference range for the test being performed. The Contractor will be responsible for all costs associated with the provision of this service, including those for delivery of hardcopy patient results, for as long as the analyzer remain inoperable.

11.9. The Contractor shall provide all necessary user-replaceable maintenance items that will be required to support the analyzer, and any analyzer specific tools/supplies necessary to perform operator-level periodic maintenance tasks, at no additional cost to the U.S. Government.

11.10. Minimal Hands-on System Maintenance required, including limited reagent preparation time/steps prior to use. List reagent /calibrator prep for assays.

11.11. Computer Patient Data Handling: No hardware, containing any patient information is to be removed from any location, without the approval and removal of data by the facility information technology department.

11.12. Preventative and Predictive Maintenance: Contractor shall provide regular, scheduled maintenance to assure the continued reliable operation of the equipment. These preventive maintenance visits shall be of a frequency that conforms to the manufacturer's operation and maintenance instructions for the supported equipment. Minimum of 1 per year per instrument unless documentation for volume performed denotes not required for optimum quality of operation.

11.13. Emergency Repair: Emergency repairs shall be performed after notification that the equipment is inoperative. The contractor shall provide the government with a designated point of contact and shall make arrangements to enable its maintenance representative to receive such notification. The contractor shall perform emergency repair service within 24 hours of time of notification of the malfunction.

11.14. Maintenance Support: Service repair person locally based within San Antonio geographical area,

11.15. Operator Procedure Manuals: Operator and Service manuals along with Clinical and Laboratory Standards Institute (CLSI) compliant procedures shall be furnished for each instrument model supplied, unless provided electronically on board the instrument. Vendor to write Standard Operating Procedures for each assay in the laboratory template, to ensure that procedures are totally available prior to implementation.

12. Training

12.1. The Contractor will provide initial operator training to all technicians assigned to the U.S. Government site (BAMC Department of Pathology Microbiology staff), as well as annual refresher training, as needed, to ensure adequate user competency during times of personnel turnover.

12.2. All training manuals/guides, instructional literature, and any other related written/electronic material shall be provided. Training shall include basic operation of the equipment, troubleshooting procedures, performance of operator-level periodic preventive maintenance procedures, and use of the data management/quality control software.

12.3. In addition, the contractor shall provide supplemental operating training to above government personnel, without additional charge to the government, upon installation of the upgrade in equipment hardware or operating system software connected with the operation of an instrument already furnished.

12.4. In the case of any significant software or assay procedural updates, the Contractor shall provide one (1) primary (key) operator training slot per major instrument/equipment, one (1) key operator Training per new instrument install, one (1) key operator training for the existing instrumentation, two (2) On-site in lab training slots for the instrumentation to be used over the agreement as the lab needs for staff changes. This training can be on or off-site at the Contractor’s full expense.

13. Information security

13.1 The Contractor shall comply with the most recent published versions of the following references, as well as all regulations or guidance referenced within those publications:

13.1.1. United States Law

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) The Federal Information Security Management Act (FISMA) The E-Government Act of 2002

13.1.2. Office of Management and Budget (OMB)

Circular A-130 Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-

Policy for a Common Identification Standard for Federal Employees and Vendors

13.1.3. National Institute of Standards and Technology (NIST)

NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems

NIST SP 800-39—Managing Information Security Risk: Organization, NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and

Organizations NIST SP 800-60—Volume 1 Revision 1: Guide for Mapping Types of Information and

Information Systems to Security Categories

13.1.4. Federal Information Processing Standards (FIPS)

FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules FIPS PUB 199 – Standards for Security Categorization of Federal Information and

Information Systems FIPS PUB 200: Minimum Security Requirements for Federal Information and Information

Systems FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

13.1.5. Department of Defense (DoD)

DoD Instruction 5200.2, DoD Personnel Security Program (PSP) DoD Instruction 8500.1, Cybersecurity DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling DoD Instruction 8510.01, Risk Management Framework Process (RMF) DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM) DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD

Health Care Programs DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD

Health Care Programs DoD Directive 5400.11, DoD Privacy Program

13.2. TELECOMMUNICATION

13.2.1. Systems that provide the ability to control instrument software from remote locations are preferred.

All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual Private Network

(VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software shall be able to pass MITC testing and review and be awarded a Certificate of Networthiness (CoN) from NETCOM. Submission of the CoN shall be completed within six (6) months of contract award.

13.2.2. In accordance with contract requirements, Contractors shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

13.2.3. The Contractor shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies and will provide, maintain and configure VPN concentrator that complies with DoD security standards.

13.2.4. All costs for VPN hardware and software shall be incurred by the Contractor.

13.2.5. The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chief Information Officer.

13.2.6. The Contractor shall validate that systems authenticate users through the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the vendor's technical users will maintain secure logon.

13.3. RISK MANAGEMENT. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security. "Vendors shall ensure ability to conform to all standards set forth by Department of Defense Risk Management Framework."

13.4. BUSINESS TO BUSINESS (B2B) PARTNERS AND 3rd PARTY VENDORS-General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow

13.5. PERSONNEL SECURITY.

13.5.1. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

13.5.2. Follow the DoD guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT- I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

13.5.3. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility local area network (LAN).

13.5.4. Immediately report to the MTFs Security Office and deny access to any automated information system (AIS), network, or information if a Contractor personnel filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for any reason.

13.5.5. Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

13.5.6. Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractors personnel shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce shall comply with all personal identity verification requirements as direct by DOD, HQDA, and or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, shall the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

13.6. . ELECTRONIC SECURITY.

13.6.1. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of SAMMC shall operate in accordance with controlling laws, regulations, DoD/DHA, and local policy.

13.6.2. Risk Management Framework(RMF) requirements apply to all DoD/DHA and Contractor’s

IS/networks that receive, process, display, store or transmit DoD information. The Contractor shall comply with the RMF process for safeguarding IS.

13.6.3. Authorization to Operate is the formal approval by the Government to operate the Contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, authorization allows IS/networks to operate within the given operational environment with stated interconnections; and with appropriate monitor level of protection for the specified period.

13.6.4. The Contractor shall comply with RMF requirements, as specified by the Government that meet appropriate DoD/DHA Information Assurance requirements. The RMF requirements shall be met before the Contractor’s system is authorized to access DoD/DHA data or interconnect with any DoD/DHA IS/network that receives, processes, stores, displays or transmits DoD/DHA data. The Contractor shall ensure the proper Contractor support staff is available to participate in all phases of the RMF process. They include, but are not limited to:

Attending and supporting RMF meetings with the Government Supporting/conducting the vulnerability mitigation process Supporting the RMF Team during system security testing

13.6.5. Contractors shall confirm that their networks are locked down prior to initiating testing.

13.6.5.1. Conformation of system lock down shall be agreed upon during the definition of the RMF boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

13.6.5.2. Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

13.6.6. Any re-configuration or change in the system during the C&A testing process shall require a re-base lining of the system and documentation of system changes. Some changes will necessitate a pause in work depending on the severity and impact of change and determined by the COR in conjunction with the IA representative.

13.6.7. Vulnerabilities that have been identified by the DHA as "must-fix" issues during C&A process shall be mitigated according to the timeline identified by the DHA Representative. C&A Checklists are provided for complying DHA C&A requirements.

13.6.8. A request for a waiver to the C&A requirements may be submitted for temporary testing and other usual circumstances. A waiver request shall be submitted, in writing, to the Designated Approving

Authority (DAA). The request shall include mitigation strategies that ensure adequate protection measures and security controls are in place (for example: air gapping a testing network).

13.6.9. Information Assurance Vulnerability Management (IAVM). The contractor shall implement an information assurance vulnerability management program. The DHA IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to DHA systems. As part of the program, the contractor shall provide a primary and secondary point of contact for IAVM compliance reporting. The contactor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance to the DHA IA Operations POC. Receipt and compliance messages to DHA shall occur within the stipulated time window, as stated in the vulnerability message.

13.6.10. Guidance regarding the requirement for IAVM is contained in the Army Regulation 25– 2, "Information Assurance” and Army Regulation 25–1, “Army Knowledge Management and Information Technology.” An asset is defined as any hardware device, such as a router, firewall, server, or an operating system image accessed by more than one user. The “MEDCOM IASO list server is the primary means to disseminate IAVAs, Information Assurance Vulnerability Bulletins (IAVBs), and Information Assurance Technical Advisories down to the System Administrator (SA) and applicable personnel throughout the chain of command. Requests to be added to the IASO list server shall be sent to medcom.ia@amedd.army.mil.

13.6.11. The contractor shall maintain any development environments in accordance with MEDCOM Information Assurance (IA) best practices and operational requirements. During product development for the Army, the contractor shall ensure that all IA mitigation strategies have been applied to the development environment prior to any Army data being loaded onto any assets or software for testing…