PWS_(updated).pdf

Performance Work Statement

Carl R. Darnall Army Medical Center

1. GENERAL

Carl R. Darnall Army Medical Center (CRDAMC) Secure Enterprise Dictation & Transcription Solution. The contractor shall provide equipment, installation, training, and remote maintenance in accordance with the terms and conditions of this contract/Performance Work Statement (PWS) and professional standards of the Joint Commission. The contractor shall furnish all labor, management, supervision, teaching, consultations and reports, except as provided in Section 3. The contractor shall cover the range of services provided in a civilian Medical Treatment Facility (MTF).

1.1. DESCRIPTION OF WORK. The contractor shall provide and maintain a specialized dictation and transcription software solution for the Carl R. Darnall Army Medical Center. See Technical Exhibit I for detailed list.

1.2. SPECIFIC TASKS: The contractor shall provide transcription services for the CRDAMC in accordance with terms and conditions herein, consistent with operating capacity of Government and contractor equipment as set forth within this contract. The contractor shall provide timely, accurate, and complete medical transcription software solution, offer medical dictation and transcription for a wide range of medical specialties and is capable of providing document uploads for review, edit, digital signature, and automated upload to Essentris in support of the CRDAMC.

The contractor shall provide medical specialized dictation and transcription software solution for surgical specialties

(surgery, orthopedics, Ear Nose and Throat (ENT), etc.), medical specialties (gastrointestinal (GI), neurology, etc.), primary care providers and emergency services.

PERFORMANCE MEASUREMENT

OBJECTIVE

STANDARD ACCEPTABLE QUALITY LEVEL METHOD OF ASSESSMENT

1. Installation, termination, and testing of all 3M solutions systems standards and in compliance with facility guidelines as well as state and local codes

System will meet 3M standards and in compliance with facility guidelines, state and local codes

System will work as expected and formally acknowledged with certified document.

Weekly status report will be provided by the contractor.

2. Complete installation, configuration, and certification of all system devices

System will be functional and accessible to all authorized users.

System will work as expected and formally acknowledged with certified document.

Weekly status report will be provided by the contractor.

3. The system will be certified by 3M and EACH at the completion of the implementation services.

A formal certification document will be provided

System will work as expected and formally acknowledged with certified document.

Signed acceptance 3M work order acknowledging completion.

4. CHCS/Essentris/SEDTS interface capabilities to be operational and functional per standards

To be included in formal certification

Systems will work as expected and formally acknowledged with certified document.

Signed acceptance 3M work order acknowledging completion.

5. System to be operational and functional for 24/7 operations

To be included in formal certification

Uptime expected at 99.9% Assessments to be performed continually throughout contract

1.3. The below table provides a summary of software and services that will be provided by the contractor.

Additional details provided in the Software Licensing Agreement, Attachment 2.

Description Description

3M Site Software License - See Attachment 2 Commercial Software Maintenance

3M Hosted Transcription CHCS ADT Interface Maintenance

3M Implementation and Training Essentris Interface Maintenance

3M Hardware - See Attachment 2 Hosted Data Center Transcription Service

3M Interface Development Interface between CHCS/Essentris/SEDTS

3M DIACAP Cybersecurity Certification

1.4. The contractor shall provide software solution that facilitates medical transcription services for surgical specialties (surgery, orthopedics, (ENT), etc.), medical specialties (GI, neurology, etc.), primary care providers and emergency services. The contractor's system shall deliver completed transcribed documents electronically in the correct format required by the CRDAMC electronic medical records. The dictation is performed by the providers and or clinical staff within CRDAMC. The actual transcription will be processed in an electronic format by 3M

Secure Enterprise Dictation & Transcription Solution (SEDTS) with no human interaction, and then accessed by the transcriptionist within CRDAMC. The transcriptionist will access the SEDTS system to validate transcription and sign it.

1.5. The system shall accurately transcribe common medical terminology. Reports shall be back-end edited and returned with no errors in spelling, grammar, or punctuation and with no missing words.

1.6. The contractor shall perform change management activities during implementation, to help with change and expectation management, and work collaboratively with the MTF subject matter experts to determine the best solution.

1.7. The contractor shall provide face-to-face training on the use of SEDTS to administrators, transcriptionists, physicians, super users, and others as needed. The training will occur during the one to two weeks leading up to full operational capability for the system is achieved.

1.8. Between 1-2 weeks prior to full operational capability, the contractor will return to your site to begin training based on the agreed upon clinical documentation workflow for CRDAMC within their respective locations.

1.9. Provide Provider training will be efficient and conducted in the clinics where they work for CRDAMC within their respective locations.

1.10. Provide transcriptionist training on-site and remotely over a single 2-3 hour training session for CRDAMC within their respective locations.

1.11. Provide over-the-shoulder administrative training for one-week teaching account, and document management and reporting capabilities for CRDAMC within their respective locations.

1.12. The contractor’s record shall contain as a minimum of the following: date in, date out, title of the work, patient name and register number/social security account number (SSAN)/Department of Defense Identification

(DoDID), originator’s name, priority designator (routine, priority, or stat).

1.13. The contractor shall work with the Government to establish a secure ADT Inbound from Composite Health

Care System (CHCS) to SEDTS and establish the secure ADT message traffic to Chartscript.com. The contractor shall work with the Government to build and maintain a permanent Essentris document upload interface. The contractor shall work with CRDAMC personnel to facilitate System Change Request with Defense Health Agency

(DHA) program office to get approval to build and maintain these two interfaces Austin Hosting Center

Transcription Service.

1.14. The contractor shall procure the hosted data center hardware and have it shipped to its Austin, TX, facility where necessary installation activities will occur. The contractor shall install the SEDTS software at the hosted data center on servers with redundant secure storage hardware. The Government will provide a Government-owned server to reside on-site at CRDAMC that will house the 3M interface and print software. The interface software is needed for the dictation and transcription solution to interface with CHCS and Essentris. The print software will allow for batch printing. 3M will procure hardware, servers and storage, that will be Government-owned (by

CRDAMC), but physically reside in a secure, hosted data center in Austin, TX. The hardware list can be found in

Exhibit 3 of this contract.

1.15. The contractor shall provide the B2B server. The contractor shall work with the Defense Information System

Agency (DISA) and CRDAMC to prepare the requirement paperwork to connect CRDAMC through its B2B server and perform all required testing activities needed to use the proposed CHCS ADT interface.

1.16 CRDAMC healthcare providers will dictate into the system and the medical transcriptionists will edit the document and prepare for the provider to sign. The file format is Rich Text Format (RTF). To view the file, the transcriptionist will be required to use 3M's transcription client software. This is done for Health Insurance

Portability and Accountability Act (HIPAA) security. Documents can only be accessed using the role based security.

1.17 Access to electronic support information and services. As part of this service, 3M Health Information System

(HIS) provides access to certain commercially available electronic and web-based tools. The customer has access to:

1.17.1 Certain capabilities made available to registered users such as downloading select 3M HIS software and firmware patches; subscribing to hardware related proactive service notifications; and participating in support forums for solving problems and sharing best practices with other registered users.

1.17.2 Expanded web-based searches of technical support documents, to facilitate faster problem-solving.

1.17.3 The 3M HIS Technical Support team includes Technical Support Engineers, Customer Service Specialists, and Services Coordinators to meet each customer’s unique support requirements.

1.17.4 Searches of 3M HIS or third-party hosted knowledge databases for certain third-party products in order to retrieve product information, find answers to support questions, participate in support forums, and download software patches.

1.17.5 Electronic remote monitoring and support, standard configuration: Electronic remote monitoring and support, standard configuration with real-time remote hardware event management provides diagnostic software for eligible products. This software monitors hardware status and generates notification events, when certain predetermined conditions are detected. Notification events are received and forwarded to 3M HIS for review and possible support action.

1.18. The contractor shall provide required parts and labor to maintain the equipment in a serviceable condition in accordance with the manufacturer’s specifications, phone support, and continuous product information updates and bulletins.

1.19. The contractor shall provide technical assistance, replacement parts, and install hardware and software updates required by the manufacturer.

1.20. The contractor service shall ensure designated 3M HIS equipment is 100% operational. Equipment shall be restored to a serviceable condition within the timeframes specified in the contract and the manufacturer.

1.21. The contractor shall provide all documentation required to meet all regulatory compliance testing procedures.

1.22. If the system is inoperable, the repair shall be initiated in no less than 4 hours and worked to completion.

The contractor is required to check-in at room 0400A (Service Level) at the Supply Chain Management Branch, building 7500. The contractor shall check-in and check-out at the Vendor Credentialing Kiosk. Once checked in, the contractor shall report to the Information Management Division, Office Manager’s Office, Room 0410, Service

Level, to check in with the Point of Contact (POC), Chief Information Officer (CIO), Deputy Chief Information

Officer (DCIO), Chief Technology Officer (CTO) or Office Manager before proceeding to complete the service repair work.

2. QUALIFICATIONS AND REQUIREMENTS.

2.1. Qualifications.

2.1.1. A system with an existing Authority to Operate within existing DoD Network.

2.1.2. Existing interfaces between DoD Electronic Documentation Systems and the transcription system

2.2. Requirements.

2.2.1. A system with an existing Authority to Operate within existing DoD Network.

2.2.2. Existing interfaces between DoD Electronic Documentation Systems and the transcription system

3. ADMINISTRATIVE.

3.1. Billing: The Government will only pay for work performed. The CLIN structure is such that multiple invoices may be made against each CLIN as the work is finished. However, submitting a payment request for more than the amount due based word actually worked/provided may constitute fraud or a false claim and may result in administrative or criminal action or both.

4. HOURS OF PERFORMANCE:

4.1. 3M SEDTS System shall be operational 24 hours a day, 7 days a week.

4.2. Scheduled down time will be coordinated with CRDAMC Information Management Division and Healthcare

Informatics Division. The down time should be performed after normal duty hours or during weekends with at least a 45 day advance notice.

4.3. Notification of any unscheduled downtime and or degradation of performance within the system will be notified by the contractor to CRDAMC Information Management Division and Healthcare Informatics Division within 30 minutes.

4.4. Hours worked do not include travel time to reach the MTF or other place of performance.

4.5. Closures. During anticipated closure of the facility, that occurs only during the implementation timeline, due to

Command declared training holidays or during unplanned closure of the facility due to natural disasters, military emergencies, severe weather, or otherwise, the contractor shall not invoice the Government for services not performed and the Government will not be liable to the contractors for any such closures.

4.6. Holidays.

4.6.1. The following is a list of legal federal holidays as referred to elsewhere in the contract.

New Year’s Day January 1st

Martin Luther King's Birthday 3rd Monday in January

President’s Day 3rd Monday in February

Memorial Day Last Monday in May

Independence Day July 4th

Labor Day 1st Monday in September

Columbus Day 2nd Monday in October

Veteran's Day November 11th

Thanksgiving Day 4th Thursday in November

Christmas Day December 25th

NOTE: Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive

Order shall be observed in the same manner as the holidays listed above. If the area in which a contract employee is scheduled to work is closed due to the holiday declared by an Executive Order and the employee is not required to report in, payment will not be made for those hours. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

4.6.2. The military may designate a weekday as a Training Holiday if doing so would provide a three-day or four-day holiday weekend (e.g., Thanksgiving weekend, Friday is usually a military training holiday). For example: the following is a list of Training Holidays for Fiscal Year 2011 (1 Oct 10 – 30 Sep 11):

Friday before Columbus Day

Friday after Veterans Day

Friday after Thanksgiving Day

Monday after Christmas Day

Monday after New Year’s Day

Friday before Martin Luther King, Jr. Day

Friday before Presidents’ Day

Friday before Memorial Day

Friday before Independence Day

Friday before Labor Day

5. SERVICE TECHNICIANS & APPROVAL OF SERVICES

5.1. The contractor shall provide a sufficient number of qualified service technicians to perform necessary service on the 3M HIS equipment listed in Technical Exhibit I.

5.2 . The contractor shall only accept calls for service from the POC, CIO, DCIO, CTO, or a Core Technology

Branch, Systems Team representative.

5.3. If these types of services are performed without the prior approval of the POC, CIO, DCIO or CTO, the U.S.

Government shall not pay for services rendered.

6. SERVICES REPORT

6.1. Upon completion of any service, a written service report shall be provided to the Information Management

Division, Core Technology Branch, room 0410, with detailed information regarding the equipment malfunction and corrective action taken.

6.2. The report shall be faxed or emailed to IMD within five (5) working days. This report shall include part numbers, price per part, and the serial number and model number of the equipment. However, these items are covered under the maintenance agreement.

7. APPLICABLE TECHNICAL ORDERS, SPECIFICATIONS, REGULATIONS, AND MANUALS.

7.1. The following is a list of basic publications applicable to this contract. Current issues of many Department of the Army (DA) publications can be accessed at http://www.usapa.army.mil. Current issues of many forms can be accessed at http://www.usapa.army.mil. Publications and forms not on the internet can be obtained from the MTF.

7.2. The publications have been coded as mandatory or advisory. The contractor is obligated to follow those coded as mandatory only to the extent that they apply to this contract. Supplements, amendments, or changes to these mandatory publications may be issued during the life of the contract. Advisory publications may be used for information and guidance but are not binding for compliance.

7.3. Publications.

7.3.1. Mandatory.

10 USC 1089 - Defense of Certain Suits Arising Out of Medical Malpractice

10 USC 1091 - Personal Services Contracts

PL 91-596 - Occupational Safety and Health Act 0f 1970

PL 101-647, Section 231 - Crime Control Act of 1990

PL 102-190, Section 1094 - National Defense Authorization Act

PL 104-191k - Health Insurance Portability and Accountability Act of 1996

DoD Directive 5200.28 - Security Requirements for Automated Information Systems (AISs)

DoD 5200.2-R - Personnel Security Program

DoD 6025.18-R - Department of Defense Health Information Privacy Regulation

DoD 8580.02-R - DoD Health Information Security Regulation

DoDI 1402.5 - Criminal History Background Checks on Individuals In Child Care Services

Applicable MTF Standard Operating Procedures (SOPs) and Policies:

AR 25-2 - Information Assurance

AR 40-1 - Composition, Mission, and Functions of the Army Medical Department

AR 40-3 - Medical Services: Medical, Dental, and Veterinary Care

AR 40-4 - Army Medical Department Facilities/Activities

AR 40-5 - Preventive Medicine

AR 40-48 - Non-Physician HCPs

AR 40-66 - Medical Records Administration and Health Care Documentation

AR 40-68 - Clinical Quality Management

AR 40-501 - Standards of Medical Fitness

AR 40-562 - Immunizations and Chemoprophylaxis

AR 340-21 - The Army Privacy Program (05 Jul 85)

AR 351-3 - Professional Education and Training Programs of the Army Medical Department

AR 380-19 - Information Systems Security

AR 380-67 - The Department of the Army Personnel Security Program

AR 385-40 - Army Accident Investigations and Reporting

AR 600-85 - Army Substance Abuse Program Civilian Services

MEDCOM Reg 715-3 - Contractor/Contractor's Employees and MEDCOM Personnel Relationships

7.3.2. Advisory.

AR 310-25 - Dictionary of United States Army Terms

MEDCOM Pam 25-31 - Index of Command Administrative Publications (16 Sep 02)

7.3.3. The following is a listing of forms that may be required, and may customarily be used by a Health Care

Provider (HCP) performing services. A complete list of forms can be accessed at http://www.apd.army.mil/AdminPubs/ProductMap.asp.

7.3.4. Standard Forms.

SF 85-P - Questionnaire for Public Trust Positions

SF 88 - Medical Record – Report of Medical Examination

SF 93 - Report of Medical History

SF 504 - Medical Record - History

SF 505 - Medical Record – History – Parts 2 and 3

SF 506 - Medical Record – Physical Examination

SF 507 - Medical Record

SF 509 - Medical Record – Progress Report

SF 513 - Medical Record – Consultation Sheet http://www.apd.army.mil/AdminPubs/ProductMap.asp

SF 515 - Medical Record - Tissue Examination

SF 519-B - Radiologic Consultation Request/Report (Radiology/Nuclear Medicine/Ultrasound/

Computed Tomography Examinations

SF 523 - Medical Record –Authorization for Autopsy

SF 523A - Disposition of Body

SF 541 - Medical Record – Gynecologic Cytology

SF 550 - Medical Record –Urinalysis

SF 551 - Medical Record –Serology

SF 557 - Medical Record – Miscellaneous

SF 558 - Medical Record – Emergency Care and Treatment

SF 600 - Medical Record – Chronological Record of Medical Care

7.3.5. Department of Army.

DA 3894 - Hospital Report of Death

DA 4106 - Incident Report

DA 4700 - Medical Record – Supplemental Medical Data

DA 5008 - Telephone Medical Advice/Consultation Record

7.3.6. Department of Defense.

DD 577 - Appointment/Termination Record – Authorized Signature

DD 689 - Sick Slip, Individual

DD 1289 - Prescription Form

DD 2161 - Medical Care, Referral for Civilian

DD 2795 - Pre-Deployment Health Assessment Questionnaire

DD 2796 - Post-Deployment Health Assessment

7.3.7. Other Forms.

FD Form 258 - FBI US Department of Justice Fingerprint Card

8. ADDITIONAL INSTRUCTIONS.

8.1. General Security Requirements. The contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security, and physical security as listed in the sections that follow:

8.2. Health Insurance Portability and Accountability Act. The contractor shall comply with the Health Insurance

Portability and Accountability Act of 1996 (P.L. 104-191) requirements, specifically the administrative simplification provisions of the law and the associated rules and regulations published by the Secretary, Health and

Human Services (HHS) and the published TRICARE Management Activity (TMA) implementation directions. This includes the Standards for Electronic Transactions, the Standards for Privacy of Individually Identifiable Health

Information and the Security Standards. It is expected that the contractor shall comply with all HIPAA-related rules and regulations as they are published and as TMA requirements are defined (including identifiers for providers, employers, health plans, and individuals, and standards for claims attachment transactions).

8.3. Personnel Security.

8.3.1. The contractor shall comply with DoD Directive 8500.1, "Information Assurance (IA)," DoD Instruction

8500.2, "Information Assurance (IA) Implementation," DoD Directive 5400.11, "DoD Privacy Program," DoD

6025.18-R, "DoD Health Information Privacy Regulation," and DoD 5200.2-R, "Personnel Security Program

Requirements."

8.3.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

8.3.2.1. Follow the TMA Privacy Office guidelines for submittal of Automated Data Processor/Information

Technology (ADP/IT) security clearances and ensure all contractor personnel are designated as ADP/IT-I, ADP/IT-

II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations. Contact the TMA

Privacy Office for guidance on the appropriate ADP/IT levels for personnel on the contract. The TMA Privacy

Office procedures for personnel security are listed on the following website:

http://www.tricare.osd.mil/tmaprivacy/personnel-security.cfm

8.3.2.2. Initiate, maintain, and document personnel security investigations appropriate to the individual's responsibilities and required access to Military Health System (MHS) Sensitive Information (SI).

8.3.2.3. Immediately report to the TMA Privacy Office and deny access to any automated information system (AIS), network, or MHS Support Initiatives (SI) information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for security reasons.

8.3.2.4. For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the

National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database

(TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area Commander installation/facility access and local security policies and procedures (provided by Government representative), or, at

OCONUS locations, in accordance with status of forces agreements and other theater regulations.

8.3.3.1. AT Level I Training. All contractor employees, to include subcontractor employees, requiring access

Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 90 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the Contracting Officer Representative (COR) or to the Contracting

Officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: http://jko.jten.mil

8.3.3.2. Access and General Protection/Security Policy Procedures. Contractor and all associated sub-contractors employees shall comply with applicable installation, facility, and area Commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services of Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DoD, Headquarters Department of the

Army and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

8.3.3.3. For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the

National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database

(TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area Commander installation/facility access and local security policies and procedures (provided by Government representative), or, at

OCONUS locations, in accordance with status of forces agreements and other theater regulations.

8.3.3.4. iWATCH Training. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 90 days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR no later than 30 calendar days after contract award.

http://jko.jten.mil/

8.3.3.5. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to Government information systems. All contractor employees with access to a Government info system must be registered in the ATCTS at commencement of services, and must successfully complete the DoD

Information Assurance Awareness prior to access to the information system, and then annually thereafter.

8.3.3.6 For information assurance (IA)/information technology (IT) training. All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and

Army training requirements in DoD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to

IA/IT functions.

8.3.3.7. For information assurance (IA)/information technology (IT) certification. Per DoD 8570.01-M , DFARS

252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

8.4. Electronic Security

8.4.1. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of the

DoD Military Health System shall operate in accordance with controlling laws, regulations, and DoD policy.

8.4.2. Certification & Accreditation (C&A) requirements apply to all DoD and contractor's IS/networks that receive, process, display, store or transmit DoD information. The contractor shall comply with the C&A process for safeguarding SI. Certification is the determination of the appropriate level of protection required for IS/networks.

Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

8.4.3. Accreditation is the formal approval by the Government to operate the contractor's IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows

IS/networks to operate within the given operational environment with stated interconnections; and with appropriate level of protection for the specified period.

8.4.4. The contractor shall comply with C&A requirements, as specified by the Government that meet appropriate

DoD Information Assurance requirements. The C&A requirements shall be met before the contractor's system is authorized to access DoD data or interconnect with any DoD IS/network that receives, processes, stores, displays or transmits DoD data. The contractor shall initiate the C&A process by providing the Contracting Officer, within 60 days following contract award, the required documentation necessary to receive an Approval to Operate (ATO).

The contractor shall make their IS/networks available for testing, and initiate the C&A testing four months (120 days) in advance of accessing DoD data or interconnecting with DoD IS/networks. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

o Attending and supporting C&A meetings with the Government o Supporting/conducting the vulnerability mitigation process o Supporting the C&A Team during system security testing

8.4.5. Contractors must confirm that there IS/networks are locked down prior to initiating testing.

o Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA) o Locking down the system means that there shall be no changes made to the configuration of the system (within the

C&A boundary) during the C&A process

8.4.6. Any re-configuration or change in the system during the C&A testing process will require a re-baselining of the system and documentation of system changes.

8.4.7. Vulnerabilities that have been identified by the Government as "must-fix" issues during C&A process must be mitigated according to the timeline identified by the Government Representative. C&A Checklists are provided for complying DoD C&A requirements. Reference material and C&A tools may be obtained at:

http://www.tricare.osd.mil/tmis_new/ia.htm.

8.4.7.1. A request for a waiver to the C&A requirements may be submitted for temporary testing and other usual circumstances. A waiver request must be submitted, in writing, to the Designated Approving Authority (DAA).

The request must include mitigation strategies that ensure adequate protection measures and security controls are in place (for example: air gapping a testing network).

8.4.8. Information Assurance Vulnerability Management (IAVM). The contractor shall implement an information assurance vulnerability management program. The DoD IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to MHS systems. As part of the program, the contractor shall provide a primary and secondary point of contact in the Vulnerability Management System (VMS) and to the MHS Information Assurance Vulnerability Alert (IAVA) Monitor. The point of contact shall provide, upon receipt of a vulnerability message, an acknowledgment of receipt via the VMS. The contactor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance in the

VMS. Receipt and compliance messages to the Government shall occur within the stipulated time window, as stated in the vulnerability message or in the VMS.

8.4.8.1. The contractor shall ensure AIS assets that are under development are registered in the VMS and have all applicable electronic patches installed for the system (1) when the system is delivered to the Government, or (2) if the AIS assets are used to store or process Government data prior to delivery (such as when being used in testing and development).

8.4.8.2. Guidance regarding the requirement for IAVM is contained in the DoD Information Assurance

Vulnerability Alert (IAVA) December 30, 1999 memorandum and Chairman of the Joint Chiefs of Staff Manual

(CJCSM) 6510.01 (Appendix A to Enclosure B) provides additional reference information. Implementation is addressed in the Defense Information Systems Agency (DISA) IAVA Process Handbook, Version 2.1, June 11, 2002. An asset is defined as any hardware device, such as a router, firewall, server, or an operating system image accessed by more than one user. Primary servers and the workstations that they support are assets that must be registered in the VMS. The DISA VMS web enabled application is used to disseminate IAVAs, Information

Assurance Vulnerability Bulletins (IAVBs), and Information Assurance Technical Advisories down to the System

Administrator (SA) and applicable personnel throughout the chain of command.

8.4.8.3. The contractor shall maintain any development environments in accordance with TMA Information

Assurance IA best practices and operational requirements. During product development for the Government, the contractor shall ensure that all IA mitigation strategies have been applied to the development environment prior to any Government data being loaded onto any assets or software for testing or delivery.

8.4.8.4. IA mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms, and the application being delivered to the Government shall be in compliance with all known applicable Department of

Defense Computer Emergency Response Team (DoD-CERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

8.4.8.5. Disposing of Electronic Media. Vendors shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD

Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Vendors are required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information

Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M

"Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

8.4.9. Ports, Protocols, and Services. Vendors shall follow all current DoD and Defense Information Systems

Agency (DISA) standards and requirements for acceptable Ports, Protocols, and Services. Any requests for exception to using the current DISA Ports, Protocols, and Services standards requires a request for exception sent through the Program Manager to the DAA.

8.4.10. Public Key Infrastructure and Encryption. Vendors shall follow the DoD standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication. Where interoperable PKI is required for the exchange of unclassified information between DoD and its vendors and contractors, industry partners shall obtain all necessary certificates. Vendors must turn over to the Government all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support. The vendor must provide a written report detailing all of the above, prior to task order expiration, regardless of modifications or extensions.

8.5. Information Systems (IS)/Networks Physical Security. The contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the contractor will support a Physical Security Audit performed by the

Government of the contractor's internal information management infrastructure. The MHS Physical Security Audit

Matrix is available at: http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_/012304/0930/clean/version.xls.

The contractor shall correct any deficiencies identified by the Government of the contractor's physical security posture. The contractor shall be required to follow all requirements in the MHS Information Assurance Policy.

New MHS policies will be posted to the following website: http://www.tricare.osd.mil/tmis_new/IA.htm.

8.6. Special Requirements for Protected Health Information. Whenever a contract is awarded that requires the vendor to collect, use, copy, access, or store Protected Health Information (PHI) in commercial office space, the contractors must:

8.6.1. Notify the TMA Privacy Office.

8.6.2. Sign a Data Use Agreement (DUA). If access and/or extraction of PHI is required from a DoD AIS for any reason, the contractor must request and receive an approval of the DUA prior to accessing, extracting, copying, or storing information to or from any DoD AIS. The DUA must be approved by the TMA Privacy Officer, TRICARE

Management Activity, before PHI may be used by the contractor as stated above. The contractor shall only request access to the minimum amount of data required to achieve the objectives outlined and specified in the DUA. Once a

DUA is approved, the contractor must fully comply with all terms and conditions stated therein. The DUA is a separate contract with its own terms and conditions. The contractor shall only retain the data for the minimum amount of time required to achieve the objectives outlined and specified in the DUA. DUAs are active at a maximum, for one year, and at the expiration of which the contractor must renew it or submit a Certificate of Data

Destruction to the TMA Privacy Office.

8.6.3. Comply with all HIPAA requirements.

8.6.4. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI. The contractor shall ensure that data, which contains PHI is continuously protected from unauthorized access, use, modification, or disclosure. The contractor shall comply with all previously stated requirements for HIPAA, Personnel Security, Electronic Security, and Physical Security.

9. NOTICE OF CONFERENCE. The contractor, or authorized representative, may be required to attend a conference prior to commencement of any work performed under this contract. A representative of the Contracting

Office will notify the contractor after entering into the contract as to the specific time and location of the conference.

Such conferences will normally occur telephonically; however, the Government reserves the right to require the personal presence of the contractor.

(End of Performance Work Statement)

EXHIBITS & ATTACHMENTS

Exhibit 1: Quality Assurance Surveillance Program

Exhibit 2: Technical Exhibit A

Attachment 1: Individuals Authorized to Bind the Company

Attachment 2: 3M Software License Agreement http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_/012304/0930/clean/version.xls

Attachment 3: 3M Draft SEDTS Training Plan

Exhibit 1: Quality Assurance Surveillance Program

QUALITY ASSURANCE SURVEILLANCE PROGRAM

Performance Measurements Requirement Summary. The following performance objectives and measures will be used to evaluate contractor performance and compliance under the contract. This information will be used to prepare annual past performance evaluations.

PERFORMANCE MEASUREMENT

OBJECTIVE

STANDARD ACCEPTABLE QUALITY

LEVEL

METHOD OF ASSESSMENT

1. Installation, termination, and testing of all 3M solutions systems standards and in compliance with facility guidelines as well as state and local codes

System will meet 3M standards and in compliance with facility guidelines, state and local codes

System will work as expected and formally acknowledged with certified document.

Weekly status report will be provided by the contractor.

2. Complete installation, configuration, and certification of all system devices

System will be functional and accessible to all authorized users.

System will work as expected and formally acknowledged with certified document.

Weekly status report will be provided by the contractor.

3. The system will be certified by 3M and CRDAMC at the completion of the implementation services.

A formal certification document will be provided

System will work as expected and formally acknowledged with certified document.

Signed acceptance 3M work order acknowledging completion.

4. CHCS/Essentris/SEDTS interface capabilities to be operational and functional per standards

To be included in formal certification

Systems will work as expected and formally acknowledged with certified document.

Signed acceptance 3M work order acknowledging completion.

5. System to be operational and functional for 24/7 operations

To be included in formal certification

Uptime expected at 99.9% Assessments to be performed continually throughout contract

The inspection and acceptance point for all services rendered under this contract will be by Healthcare Informatics

Division and the Information Management Division. The performance by the contract personnel, the quality of services rendered, and any documentation, or written material in support of same, shall be subject to continuous inspection, surveillance and review for acceptance by the Contracting Officer Representative (COR) or designated representative.

Exhibit 2: Technical Exhibit A

Attachment 1: Individuals Authorized to Bind the Company

ATTACHMENT 1

Individuals Authorized to Bind the Company

Contractor: __________________ (CAGE Code: __________)

RFP Number:

The following individual(s) are authorized to Negotiate/Bind our

Company/Partnership/Corporation on Contract and to execute a Contract Modification:

NAME TITLE PHONE EMAIL

SIGNED:

Name/Title Date