W81K00-16-T-0059-0001_Amendment.pdf

0010682262

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

A. Add the Questions and Answ ers regarding this solicitation and to effect changes stated therein.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 18

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 09-Sep-2016

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X W81K00-16-T-0059

X 9B. DATED (SEE ITEM 11)

30-Aug-2016

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

09-Sep-2016

CODE

W40M USA HLTH CONTRACTING ACT

SOUTHERN REG CONTR OFC

3551 ROGER BROOK DR BLDG 3600

FORT SAM HOUSTON TX 78234-6200

W81K00 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

W81K00-16-T-0059

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 30 - BLOCK 14 CONTINUATION PAGE

The following have been added by full text:

QUESTIONS AND ANSWERS

Questions and Answers - W81K00-16-T-0059 – Hematology

1. On pg. 75 under Delivery & Installation a fourth site is mentioned, Taylor Burk Health Clinic (Camp Bullis), but no testing volumes or additional information are given for this site on pg. 74. Will this site be running CBC's and need an instrument? If so, please provide volumes and #of days/week it will be run.

ANSWER: Camp Bullis will not be included in this contract. It has been removed from the solicitation.

2. Will all the outlying clinics and Emergency department need to be connected to the Central Data Management system referred to under

CLIN0001AJ?

ANSWER: Only Core lab will be connected to Data management system.

3. In reference to 0001AF, 0001AG & 0001AH, the Coag processing lane, how many coagulation tubes will be processed daily and how many coag analyzers do you want connections for on the automation line?

ANSWER: Approximately 300 tubes are processed daily. Only 1 Coag analyzer will be connected to the line.

4. Will each vendor be given a time to present their solution to the lab or will this just be a written response to the RFP?

ANSWER: Only a written response to solicitation will be accepted.

5. How many people from one vendor can attend the site visit on Monday?

ANSWER: Given the space constraints within the laboratory and access control considerations within the hospital, Only 2 people per vendor can attend.

6. Is each site responsible for their own supply of reagents, QC and calibrators, or will the core lab maintain the reagent, QC, calibrators and supplies and send to each site as needed?

ANSWER: Apheresis and ED lab will be part of Core Lab supply contract, but other sites are separate.

7. Would it be possible to get an extension?

ANSWER: No extensions will be provided at this time.

8. Pg. 71,REFER TO CLIN 001, 000IAA:

a. “System redundancy is required, with at least 3 primary CBC analyzers minimum.” – ADXH 1601, as first referenced in CLIN 0001AA, consists of (2) CBC analyzers and (1) slide maker-stainer. If a third CBC analyzer is required, then the DXH 2401 would meet this need. The 2401 includes (3) CBC analyzers and (1) slide maker-stainer. Our question: Can you please confirm that the DxH 1601 is the desired configuration for this Brand Name of Equal solicitation.

ANSWER: Yes, the DXH 1601 is the desired configuration.

9. Pg. 71,REFER TO CLIN 0001AL, 001AF:

a. “Automated slide stainers must use a Wright-Giemsa stain.” – It was our understanding that Wright stain was preferred over Wright-Giemsa. Please confirm which stain is preferred.

ANSWER: Wright-Giemsa is preferred.

10. Attachment II,CLIN Series 0001AF through 4001AF – Core Lab/Slide Maker Consumables:

a. Please note Attachment II of the solicitation package does not include part numbers for Wright (7457177 – quantity 35) or Wright-Giemsa (7547178 – quantity 35) stain, whichever is preferred. I am thinking this item should be listed on Attachment II with the other slide maker stainer items since they all work together.

ANSWER: Wright-Giemsa (7547178 – quantity 35) has now been included in Attachment II.

11. Regarding the site visit scheduled for 9/12/2016, I plan to attend, along with the Beckman Coulter service manager and cellular product specialist. Can you please provide us with front gate clearance, or help us understand how base access will be granted for the site visit day?

ANSWER: An attachment will accompany this amendment that contains the forms and instructions as to how gate access can be achieved.

12. The Classification Code on the above-subject solicitation is 65; however, Beckman Coulter, Inc. is registered for Classification 66 – Instruments & Laboratory Equipment.

Does that cause any issues for Beckman Coulter, Inc. in responding to the new solicitation?

ANSWER: The Government uses PSC Codes during acquisitions and procurements to indicate the prevalent product and service to be purchased. Therefore, the use of PSC 66 does not preclude a vendor from offering their products or services and being considered for award based on a PSC different than the one listed under this solicitation.

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

STATEMENT OF OBJECTIVES

Statement of Objectives Hematology Reagents

Scope The Contractor shall provide hematology reagents used in support of the hematology mission at San Antonio Military Medical Center (SAMMC) and its surrounding clinics/healthcare network, located at or near Joint Base San Antonio, TX 78234. 24/7

All costs integrated into this contract must be calculated based on annual test volume and type.

All supplies and equipment outlined in this Statement of Work (SOW) must be supplied and serviced through a single Contractor (to whom the contract is awarded, to include any parts, equipment, or supplies not manufactured, provided or serviced by the Contractor.

All supplies and equipment, to include connections between equipment must be approved by the US Food and Drug Administration (FDA) by award of the contract.

Equipment/Reagent Requirements – Core Laboratory

REFER TO CLIN 0001,001AA

The Contractor must provide the following at a minimum for Core Laboratory operations at the main hospital located at SAMMC:

The Contractor must provide all reagents/reagents packs, calibrators/standards, quality control materials, user-replaceable maintenance items, and analyzer specific tools/supplies to support the ongoing delivery of laboratory services using the equipment outlined in this section.

o Reagents/consumables must meet the requirements of the 24/7 SAMMC mission, workload, and test menu (outlined in Tables 1 and 2).

o The Contractor must provide quality control materials acceptable to the section Medical

Director. This includes third-party controls when requested/required by the laboratory.

o In determining reagent requirements, the Contractor must consider requirements for routine quality control runs (as defined by the Laboratory Director), routine calibration, periodic calibration/calibration verification in accordance with departmental policy, and troubleshooting of out-of-control assays when calculating the yearly requirements.

o Reagents used for troubleshooting analytical systems must be reimbursed (or replaced) by the Contractor at no additional cost.

o The Contractor shall sequester lots of required quality control materials and test reagents where possible.

o The Contractor will provide, upon shipment, an electronic tracking mechanism whereby the Government is able to identify the shipping status of any equipment, reagents, or materials.

Deliveries of required items must be in monthly drop shipments or as called in by the COR or ACOR. Large items (e.g., 20L and above), must be shipped in a split order to arrive 2 weeks apart. Orders must arrive no later than one week from the requested date of delivery. Any supplies that are placed on back order shall be communicated electronically to the Government, clearly identified on the shipping documents and delivered in a timely manner, not to exceed ten (10) working days. In the instance a back-order exceeds 10 working days, the Contractor must provide testing services through local sub-contract at their cost.

o Emergency orders will be delivered within 24 hours after the order is placed.

Table 1. Mandatory Tests

1. COMPLETE BLOOD COUNT (CBC)

TO INCLUDE:

a. White Blood Cells (WBC) m. Monocytes Number (MONO #)

b. Red Blood Cells (RBC) n. Monocytes Percentage (MONO %)

c. Platelets (PLT) o. Neutrophils Number (NEUT #)

d. Hemoglobin (HGB) p. Neutrophils Percentage (NEUT %)

e. Hematocrit (HCT) q. Eosinophils Number (EOS #)

f. Mean Corpuscular Hemoglobin

(MCH)

r. Eosinophils Percentage (EOS %)

g. Mean Corpuscular Volume (MCV) s. Basophil Number (BASO #)

h. Mean Corpuscular Hemoglobin

Concentration (MCHC)

t. Basophil Percentage (BASO %)

i. Mean Platelet Volume (MPV)

u. Nucleated Red Blood Cells (NRBC)

j. Red Cell Distribution Width (RDW)

2. RETICULOCYTE # and

RETICULOCYE %

k. Lymphocytes Number (LYMPH #) 3. BODY FLUID COUNTS

l. Lymphocyte Percentage (LYMPH

REFER TO CLIN 001, 000IAA:

CBC analyzers to perform the requested testing. System redundancy is required, with at least 3 primary CBC analyzers minimum.

o Individual analyzers must have fully automated, discrete random access capabilities. There must be a single point of specimen entry for the routine analysis of all required tests. There must be an optional procedure for priority analysis of STAT specimens.

o Each analyzer must be equipped to perform continuous, random statistical analysis using common statistical control rules as well as patient-derived quality control procedures (e.g.,, X-bar B analysis).

o The analyzers will have an interface that is compatible to the government system (CHCS) and will be able to recognize CHCS generated bar-code labels (both code 39 and 128) on primary sample tubes.

o Each analyzer must be able to provide user configurable autovalidation of results using internal rulesets.

REFER TO CLIN 0001AL, 001AF:

Automated slidemakers and slidestainers as required for manual differential/slide review requirements at SAMMC. System redundancy is required.

o Automated slide stainers must use a Wright-Giemsa stain. If the stains provided by the

Contractor are deemed insufficient by the Medical Director, the Contractor must provide at no additional cost, an alternative stain from a 3rd party source that is acceptable to the Medical Director.

REFER TO CLIN 0001AG, 001AH, 001AJ:

Automated/semi-automated systems to support pre- and/or post-analytical processing of specimens (as appropriate). These systems must be in the form of workcell-style platform(s). Full, walk-away, automation (i.e., an automation/robotic line) is not being requested but may be considered dependent on laboratory space constraints.

o The workcell system must interconnect the majority of major pre-analytical, analytical, and post-analytical components included in this SOW.

o The workcell system must provide the vast majority of pre-analytical sample handling, transporting specimens from a start point to an appropriate instrument without intervention by a technician.

o Workcell systems that provide post-analytical computer controlled sample archiving/storage/racking are preferred.

o More than one Workcell system may be considered where such a configuration provides space and workflow advantages.

REFER TO CLIN 0001AB:

An automated digital cell morphology analyzer (e.g., Cellavision), sufficient to automate the performance of manual differentials.

o The system must provide automated slide evaluation using photomicroscopy with computerized image analysis of photomicrographs.

o The contractor must provide a minimum of 3 remote review software packages for the system, providing remote review of cell morphology results by clinical staff not collocated within the main laboratory.

Peripherals, to include Uninterruptable Power Sources (UPSs), electrical line conditioners as required, instrument-specific computer terminals/CPUs, printers to include toner for each as needed, and other equipment where required.

REFER TO CLIN 0001AK:

A data management system, to include middleware, not contained within the CBC analyzers (e.g., Data Innovations).

o The system must provide a central data management hub, to which all major systems included in this SOW connect. This must include a connection to the digital cell morphology analyzer.

o The system must not require remote communication to outside sources to be functional.

o The system must be capable of interfacing with the CHCS.

o The system must include at least 2 remote review stations (e.g., Thin Clients) to allow access to the system middleware from decentralized locations.

o Systems that provide the ability to control instrument software from remote locations are preferred.

Pedestal(s) capable of supporting each workcell system as appropriate, to include computer terminals or other automated instruments/peripherals as appropriate, providing a neat work area (e.g., reagent, cable and tubing control/maintenance).

Expected volumes are as follows for the Core Laboratory:

Table 2. Annual Volume – Core Laboratory

Test Base Option 1 Option 2 Option 3 Option 4

1. CBC Counts 144,000 151,200 158,760 166,698 175,033

2. Reticulocyte

Counts 1,633 1,714 1,800 1,890 1,985

3. Body Fluid

Counts 2,400 2,520 2,646 2,778 2,917

Equipment/Reagent Requirements – Other Locations

REFER TO CLIN 0001AC, 0001AD, 0001AE:

The Contractor must provide the following at a minimum for all remaining SAMMC operations as outlined in Table 3:

The Contractor must provide all reagents/reagents packs, calibrators/standards, quality control materials, user-replaceable maintenance items, and analyzer specific tools/supplies to support the ongoing delivery of laboratory services using the equipment outlined in this section.

o Reagents/consumables must meet the requirements of the SAMMC mission, workload, and test menu (outlined in Tables 1 and 2).

o The Contractor must provide quality control materials acceptable to the section Medical

Director. This includes third-party controls when requested/required by the laboratory.

o In determining reagent requirements, the Contractor must consider requirements for routine quality control runs (as defined by the Laboratory Director), routine calibration, periodic calibration/calibration verification in accordance with departmental policy, and troubleshooting of out-of-control assays when calculating the yearly requirements.

o Reagents used for troubleshooting analytical systems must be reimbursed (or replaced) by the Contractor at no additional cost.

o The Contractor shall sequester lots of required quality control materials and test reagents where possible.

o The Contractor will provide, upon shipment, an electronic tracking mechanism whereby the Government is able to identify the shipping status of any equipment, reagents, or materials.

Deliveries of required items must be in monthly drop shipments or as called in by the COR or ACOR. Large items (e.g., 20L and above), must be shipped in a split order to arrive 2 weeks apart. Orders must arrive no later than one week from the requested date of delivery. Any supplies that are placed on back order shall be communicated electronically to the Government, clearly identified on the shipping documents and delivered in a timely manner, not to exceed ten (10) working days. In the instance a back-order exceeds 10 working days, the Contractor must provide testing services through local sub-contract at their cost.

o Emergency orders will be delivered within 24 hours after the order is placed.

o Mandatory tests are outlined in Table 1, with the exception of reticulocyte and body fluid counts. Reticulocyte and body fluid counts are not required at any other location outside the Core Laboratory.

CBC analyzers to perform the requested testing. Only one analyzer is required at each location outlined in Table 3.

o Individual analyzers must have fully automated, discrete random access capabilities. There must be a single point of specimen entry for the routine analysis of all required tests. There must be an optional procedure for priority analysis of STAT specimens.

o Each analyzer must be equipped to perform continuous, random statistical analysis using common statistical control rules as well as patient-derived quality control procedures (e.g.,, X-bar B analysis).

o The analyzers will have an interface that is compatible to the government system (CHCS) and will be able to recognize CHCS generated bar-code labels (both code 39 and 128) on primary sample tubes.

o Each analyzer must be able to provide user configurable autovalidation of results using internal rulesets.

Peripherals, to include Uninterruptable Power Sources (UPSs), electrical line conditioners as required, instrument-specific computer terminals/CPUs, printers to include toner for each as needed, and other equipment where required.

Pedestal(s) capable of supporting each analyzer, to include computer terminals or other peripherals as appropriate, providing a neat work area (e.g., reagent, cable and tubing control/maintenance).

Expected volumes are as follows for each location outside the Core Laboratory (Table 3):

REFER TO CLIN 0001AC, 0001AD, 0001AE:

Table 3. Annual Volume – CBC Only, Other Locations

Location Base Option 1 Option 2 Option 3 Option 4

Emergency Department

(SAMMC)

29,232 30,694 32,228 33,840 35,532

Fort Sam Houston

Clinic (JBSA) 8,412 8,833 9,272 9,738 10,225

Apheresis Clinic

(SAMMC)

780 819 860 903 948

Service and Maintenance

The Contractor must meet the following service, and maintenance requirements for all testing locations at SAMMC (except where specifically noted otherwise):

The Contractor shall provide direct customer service and support, 24 hours/7 days a week, to include hotline telephone service (provided in English) and on-call emergency repair, to assist operators in correcting equipment problems.

The Contractor will maintain all equipment installed under this contract except for repairs necessitated by willful damage or negligence on the part of the Government. This includes emergency repairs as well as routine Preventive Maintenance Services (PMS), safety tests, calibrations/calibration verifications, and unscheduled repair services in accordance with procedures and practices prescribed by the manufacturer of the equipment.

The Contractor must provide all personnel, equipment, tools, materials, supervision, parts, transportation, and other items and services necessary to perform all required repairs and scheduled preventive maintenance/safety inspections and calibrations of equipment. The performance of scheduled periodic preventive maintenance, safety checks, and calibrations that are not normally performed at the operator level must be performed by Contractor service personnel in accordance with requirements as specified in the Contractor’s instrument maintenance manual.

Completion of analyzer installation will establish time-zero for determining the time frame for performance of periodic services.

Any service technician provided by the Contractor must adhere to all required reporting procedures for SAMMC prior to reporting to the laboratory for work. Current procedures will be available through the COR or ACOR.

For equipment supporting the Core Laboratory, the service technician must be on-site to provide unlimited service within twenty-four (24) hours of establishing telephonic contact. The equipment shall be repaired and operational within 48 hours after initial on-site response by the Contractor.

Should all CBC analyzers become inoperable, the Contractor’s service technician must be on-site within four (4) hours of initial notification. The repair of at least one (1) analyzer must be completed within eight (8) hours of initial notification. If deemed necessary, after consultation with the COR, if at least one analyzer cannot be repaired within eight (8) hours of the initial notification, the Contractor shall, where requested, arrange the pickup and delivery of critical specimens to a College of American Pathologists accredited clinical laboratory, with priority testing service provided for STAT/ASAP specimens. The Contractor shall pay all costs associated with the provision of this alternative testing, including those for delivery of hardcopy patient results by express courier, directly to the laboratory, for as long as all analyzers remain inoperable.

For equipment supporting other locations, the service technician must be on-site to provide unlimited service (service requiring repair) the next business day of establishing telephonic contact.

The equipment shall be repaired and operational within 48 hours after initial on-site response by the Contractor.

In all cases, the Contractor shall provide all reagents, calibrators, controls, and any other materials necessary to troubleshoot instrument failure. Replacement parts used, as necessary, claimed from local operator-level maintenance kits as well as any reagents that may have been used must be replaced at no cost by the Contractor.

The Contractor shall notify the COR or ACOR of the exact date and time for performance of a preventive maintenance service no later than ten (10) days prior to the scheduled preventive maintenance services.

Within one (1) working day after completion of a repair, the Contractor’s representative shall furnish the COR one (1) copy of a service report for all services performed with a copy to the Equipment Management Branch and the Laboratory Representative for the MTF. The report shall be in English and shall contain, as a minimum, the following information:

o Nomenclature and serial number o Date of service o Description of services performed (i.e., preventive maintenance service, or unscheduled repair service) o Location of services performed o Duration of performance (hours) o List of parts replaced or other actions taken to restore operability of the instrument o Name of technician

The Contractor must relocate/revalidate any instrument if requested by the Government at no additional cost. This includes any location within the SAMMC healthcare network.

Training

The Contractor must provide the following for all testing locations at SAMMC:

The Contractor must provide initial on-site operator training to all technicians assigned to the Government site normally assigned to perform the associated testing prior to implementation of the analyzer for patient testing. In addition, the Contractor must provide training for two (2) primary (key) operators, per major analyzer and automated system at the Contractor’s training site at no additional cost to the Government (including transportation airfare, rental car, per diem, etc.) prior to implementation of the analyzer.

All on-site training must include basic analyzer operation, troubleshooting procedures, performance of operator-level periodic preventive maintenance procedures, and use any data management/quality control software.

The Contractor must provide one primary (key) operator training slot per major analyzer and automated system per contract year, at the Contractor’s training site, at no additional cost to the Government (including transportation airfare, rental car, per diem, etc.). The Contractor may charge the Government only for training services that exceed the requirements for a given contract year.

Delivery and Installation

All systems must be delivered to the appropriate location indicated below within 90 calendar days after contract award.

San Antonio Military Medical Center Department of Pathology, Core Laboratory 3551 Roger Brooke Drive Fort Sam Houston, TX 78234

San Antonio Military Medical Center Emergency Department Laboratory 3551 Roger Brooke Drive Fort Sam Houston, TX 78234

San Antonio Military Medical Center Department of Pathology, Apheresis/Cellular Therapy 3551 Roger Brooke Drive Fort Sam Houston, TX 78234

Fort Sam Houston Clinic 3100 Schofield RD BLDG 1179 Fort Sam Houston, TX 78234

The Point of Contact (POC) for all deliveries:

NCOIC, Core Laboratory Department of Pathology San Antonio Military Medical Center Tel: (210) 916-9062/3386/3625

The Contractor must assign a Program Manager and IT Program Manager to oversee all operations

During the initial implementation, a primary, dedicated technical representative must be assigned and available on site throughout the entire implementation period. Substitutions must be coordinated with and approved by the COR or ACOR.

Within 10 working days after contract award, Contractor shall coordinate and conduct a post award site visit for the purpose of coordinating the schedule for equipment installation.

Method validation/verification will be conducted in accordance with procedures outlined in the Department of Pathology policies and standard operating procedures and as required by the CLIA and/or the College of American Pathologists (CAP)).

Method validation/verification will include, but not be limited to: normal range (reference interval) verification, verification of reportable range (AMR) (to include WBC, RBC, HGB, PLT and reticulocyte as required), correlation to current methods, verification of precision, carryover studies and establishment of initial ranges using control materials, to include third party controls where designated by the Laboratory Director.

The method validation/verification will be completed and approved by the Laboratory Director prior to reporting of patient results. Payment for services will not begin until the analyzer system has been approved for reporting of patient results.

The Contractor shall provide a qualified Technical Service Representative (TSR), who possesses a thorough knowledge of method validation/verification and is familiar with the use of clinical laboratory statistical evaluation software (e.g. EP Evaluator®), to provide technical assistance for the method validation/verification studies. The assigned TSR will be responsible for the entire method validation. Additional TSRs may be brought in to assist in method validations/verifications, but only the primary TSR will be responsible for the entire operation.

All instrument reagents, calibrators, linearity materials and other required reagents/materials used in the method validation/verification study will be provided by the Contractor at no additional cost to the Government. These materials will not be used in the analysis of specimens for patient care.

Other Considerations

The Contractor must provide paper and electronic copies of material safety data sheets (MSDSs) for each reagent item delivered under this contract (as appropriate).

The Contractor must comply with the HIPPA and Information Technology (IT)/Security requirements as outlined in appendices A and B as deemed appropriate by the Government.

Appendix A Department of Defense Health Information Privacy

Introduction

In accordance with DoD 6025.18-R “Department of Defense Health Information Privacy Regulation,” January 24, 2003, the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and in DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

(a) Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DoD 6025.18-R or DoD 8580.02-R.

Individual has the same meaning as the term “individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 160.103, limited to the information created or received by the Contractor from or on behalf of the Government pursuant to the Contract.

Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

Required by Law has the same meaning as the term “required by law” in 45 CFR 164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part 164, subpart C.

Terms used, but not otherwise defined, in this Clause shall have the same meaning as those terms in 45 CFR 160.103, 160.502, 164.103, 164.304, and 164.501.

(b) The Contractor shall not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

(c) The Contractor shall use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Contract.

(d) The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

(e) The Contractor shall, at their own expense, take action to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Clause. These mitigation actions will include as a minimum those listed in the TMA Breach Notification Standard Operating Procedure (SOP), which is available at: http://www.tricare.mil/tmaprivacy/breach.cfm http://www.tricare.mil/tmaprivacy/breach.cfm

(f) The Contractor shall report to the Government any security incident involving protected health information of which it becomes aware.

(g) The Contractor shall report to the Government any use or disclosure of the Protected Health Information not provided for by this Contract of which the Contractor becomes aware.

(h) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

(i) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

(j) The Contractor shall provide access, at the request of the Government, and in the time and manner reasonably designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

(k) The Contractor shall make any amendment(s) to Protected Health Information in a Designated Record Set that the Government directs or agrees to pursuant to 45 CFR

164.526 at the request of the Government, and in the time and manner reasonably designated by the Government.

(l) The Contractor shall make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner reasonably designated by the Government or the Secretary, for purposes of the Secretary determining the Government’s compliance with the Privacy Rule.

(m) The Contractor shall document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

(n) The Contractor shall provide to the Government or an Individual, in time and manner reasonably designated by the Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

General Use and Disclosure Provisions

Except as otherwise limited in this Clause, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the HIPAA Privacy Rule, the HIPAA Security Rule, DoD 6025.18-R or DoD 8580.02-R if done by the Government.

Specific Use and Disclosure Provisions

(a) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(b) Except as otherwise limited in this Clause, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(c) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

(d) Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1).

Obligations of the Government

Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

(a) The Government shall provide the Contractor with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520.

(b) The Government shall provide the Contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Contractor’s permitted or required uses and disclosures.

(c) The Government shall notify the Contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

Permissible Requests by the Government

The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Privacy Rule, the HIPAA Security Rule, or any applicable Government regulations (including without limitation, DoD 6025.18-R and DoD 8580.02-R) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

Termination

(a) Termination. A breach by the Contractor of this clause, may subject the Contractor to termination under any applicable default or termination provision of this Contract.

(b) Effect of Termination.

(1) If this contract has records management requirements, the records subject to the Clause should be handled in accordance with the records management requirements. If this contract does not have records management requirements, the records should be handled in accordance with paragraphs (2) and (3) below

(2) If this contract does not have records management requirements, except as provided in paragraph (3) of this section, upon termination of this Contract, for any reason, the Contractor shall return or destroy all Protected Health Information received from the Government, or created or received by the Contractor on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the Protected Health Information.

(3) If this contract does not have records management provisions and the Contractor determines that returning or destroying the Protected Health Information is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of Protected Health Information is infeasible, the Contractor shall extend the protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such Protected Health Information.

Miscellaneous

(a) Regulatory References. A reference in this Clause to a section in DoD 6025.18-R, DoD 8580.02- R, Privacy Rule or Security Rule means the section currently in effect or as amended, and for which compliance is required.

(b) Survival. The respective rights and obligations of Business Associate under the “Effect of Termination” provision of this Clause shall survive the termination of this Contract.

(c) Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with DoD 6025.18-R, DoD 8580.02-R, the HIPAA Privacy Rule or the HIPAA Security Rule.

Appendix B Information Assurance Standards

1. General Security Requirements.

a. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Army data, to ensure the confidentiality, integrity, and availability of Army data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow:

b. Health Insurance Portability and Accountability Act (HIPAA). Health Insurance Portability and Accountability Act of 1996 (HIPAA) Requirement. The HIPAA standard contract language is mandatory whenever a business associate, (i.e., outside person or agency) creates, receives, maintains, or transmits electronic protected health information (PHI) on behalf of a covered entity. This contract or agreement requires the business associate to:

c. Implement administrative, physical, and technical safeguards that will protect the confidentiality, integrity, and availability of the PHI

d. Ensure all agents or subcontractors to whom the business associate provides PHI will also implement reasonable and appropriate safeguards to protect the information.

e. Report all security incidents.

f. Additional guidance can be found in DoD 8580.02 –R, Health Information Security Regulation.

2. Personnel Security

a. The contractor shall comply with Army Regulation 25–2, "Information Assurance” (IA), Army Regulation 25–1, “Army Knowledge Management and Information Technology,” and " DoD Health Information Privacy Regulation."

b. Contractor shall comply with the following requirements:

(1) Follow the Army guidelines for submittal of Information Technology (IT) security background checks and ensure all contractor personnel are designated as IT-I, IT-II, or IT-III where their duties meet the criteria of the position sensitivity designations. Contact the <type in Activity’s name> for guidance on the appropriate IT levels for personnel on the contract.

(2) Initiate, maintain, and document personnel security investigations appropriate to the individual's responsibilities and required access to MEDCOM Sensitive Information (SI).

(3) Immediately report to the <type in Activity’s name> and deny access to any automated information system (AIS), network, or MEDCOM SI information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Army representative for security reasons.

(4) Ensure that all contractor personnel receive information assurance (IA) training before being granted access to Army AISs/networks, and/or MEDCOM SI information.

3. Electronic Security

a. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of the Army’s Health System shall operate in accordance with controlling laws, regulations, and Army policy.

b. Certification & Accreditation (C&A) requirements apply to all Army and contractor's IS/networks that receive process, display, store or transmit Army information. The contractor shall comply with the C&A process for safeguarding SI. Certification is the determination of the appropriate level of protection required for IS/networks. Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

c. Accreditation is the formal approval by the Army to operate the contractor's IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections; and with appropriate level of protection for the specified period.

d. The contractor shall comply with C&A requirements, as specified by the Army that meet appropriate Army Information Assurance requirements. The C&A requirements shall be met before the contractor's system is authorized to access Army data or interconnect with any Army IS/network that receives, processes, stores, displays or transmits Army data. The contractor shall initiate the C&A process by providing the Contracting Officer Representative, within 60 days following contract award, the required documentation necessary to receive an Approval to Operate (ATO). The contractor shall make their IS/networks available for testing, and initiate the C&A testing four months (120 days) in advance of accessing Army data or interconnecting with Army IS/networks. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

(1) Attending and supporting C&A meetings with the Army

(2) Supporting/conducting the vulnerability mitigation process

(3) Supporting the C&A Team during system security testing

e. Contractors must confirm that their IS/networks are locked down prior to initiating testing.

f. Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the Department of Defense Information Assurance Certification and Accreditation Process (DIACAP).

g. Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process

h. Any re-configuration or change in the system during the C&A testing process will require a re-base-lining of the system and documentation of system changes. Some changes will necessitate a pause in work depending on the severity and impact of change and determined by the COR in conjunction with the IA representative.

i. Vulnerabilities that have been identified by the Army as "must-fix" issues during C&A process must be mitigated according to the timeline identified by the Army Representative. C&A Checklists are provided for complying Army C&A requirements.

j. A request for a waiver to the C&A requirements may be submitted for temporary testing and other usual circumstances. A waiver request must be submitted, in writing, to the Designated Approving Authority (DAA). The request must include mitigation strategies that ensure adequate protection measures and security controls are in place (for example: air gapping a testing network).

k. Information Assurance Vulnerability Management (IAVM). The contractor shall implement an information assurance vulnerability management program. The Army IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to MEDCOM systems. As part of the program, the contractor shall provide a primary and secondary point of contact for IAVM compliance reporting. The contactor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance to the MEDCOM IA Operations POC. Receipt and compliance messages to MEDCOM shall occur within the stipulated time window, as stated in the vulnerability message.

l. Guidance regarding the requirement for IAVM is contained in the Army Regulation 25–2, "Information Assurance” and Army Regulation 25–1, “Army Knowledge Management and Information Technology.” An asset is defined as any hardware device, such as a router, firewall, server, or an operating system image accessed by more than one user. The “MEDCOM IASO list server is the primary means to disseminate IAVAs, Information Assurance Vulnerability Bulletins (IAVBs), and Information Assurance Technical Advisories down to the System Administrator (SA) and applicable personnel throughout the chain of command. Requests to be added to the IASO list server should be sent to medcom.ia@amedd.army.mil

m. The contractor shall maintain any development environments in accordance with MEDCOM Information Assurance (IA) best practices and operational requirements. During product development for the Army, the contractor shall ensure that all IA mitigation strategies have been applied to the development environment prior to any Army data being loaded onto any assets or software for testing or delivery.

n. IA mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the Army shall be in compliance with all known applicable Army Computer Emergency Response Team (ACERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

o. Disposing of Electronic Media. Contractors shall follow the Army standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with Army Regulation 25–2, "Information Assurance” and Army Best Business Practices (BBP), “Reuse of Computer Hard Drives.”

p. Ports Protocols and Services. Contractors shall follow all current Army standards and requirements for acceptable Ports, Protocols, and Services. Any requests for exception to using the current Army Ports, Protocols, and Services standards requires an request for exception sent through the Program Manager to the DAA.

q. Public Key Infrastructure and Encryption. Contractors shall follow the Army standards, policies, and procedures related to the use of Public Key…