A.09.03_W81K00-18-R-0004-0001_Amendment.pdf

W40M USA HLTH CONTRACTING ACT

REGIONAL HEALTH CONTRACT OFF CENTRAL

POC: CALVIN L. BLUE

3551 ROGER BROOK DR BLDG 3600

FORT SAM HOUSTON TX 78234-6200

0011003409-0001

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to:

A. Provide the answ ers to the questions submitted in response to the solicitation and to effect changes stated therein.

See summary of changes for details.

No other changes have been made to this solicitation.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 80

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 02-Jan-2018

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X W81K00-18-R-0004

X 9B. DATED (SEE ITEM 11)

15-Dec-2017

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

02-Jan-2018

CODE

W40M USA HLTH CONTRACTING ACT

REGIONAL HEALTH CONTRACT OFF CENTRAL

2539 GARDEN AVENUE

JBSA FT SAM HOUSTON TX 78234-0000

W81K00 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE W81K00

FACILITY CODECODE

EMAIL:TEL:

W81K00-18-R-0004

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 30 - BLOCK 14 CONTINUATION PAGE

The following have been added by full text:

QUESTIONS AND ANSWERS

W81K00-18-R-0004 - Chemistry

1. What is the etiquette and protocol while onsite?

ANSWER: Once all vendors are onsite, a sign-in sheet will be provided and the site visit walkthrough will begin in the CORE lab. No photographs of equipment or site will be allowed. Measurements may be taken. All questions must be submitted in writing to the Contract Specialist which will then be formally answered via amendment to the solicitation. There will be government representatives from the Laboratory, Contracting, Facilities and IT for vendors to pose questions and concerns to.

2. What information will you need in advance from our 2 Roche representatives?

ANSWER: Please see page 105 of the solicitation.

3. Submission date: Having a post mark of January 18th or physically in your possession?

ANSWER: The Proposal must be received by this office by the due date.

4. Can we obtain a file similar to this for the daily workflow for the SAMMC laboratory?

ANSWER: An example format of EXCEL LIS Report has been provided under amendment 0001. See attachment # 4.

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

STATEMENT OF OBJECTIVES

Statement of Objectives - Chemistry and Immunoassay Testing

1. Scope of Work: Chemistry and Immunoassay Testing under a Cost Per Reportable Result (CPRR) Agreement. Included in this CPRR Agreement is all Instrumentation, Ancillary Equipment, Water Systems, Middleware (Hardware and Software including Consulting and Services required in developing, validating, and implementing features), Training, Maintenance, Service, Repairs, Parts, Labor, and Materials, Inventory Management System for all required supplies and installation and removal of equipment at all locations listed in the SOW in support of the Brooke Army Medical Center Laboratories, Fort Sam Houston, TX.

1.1 Description of Work: The Contractor shall provide Chemistry /Immunoassay Testing under a Cost Per Reportable Result (CPRR) agreement to include equipment, reagents, tools, materials, training, water purification system, peripherals (e.g. instrument specific computer terminals and CPUs, printers, etc.), Uninterruptable Power Supply (UPS), Robotic Automation Systems, Automated Pre-analytical Processing Systems, Bidirectional Track, and Automated Post-analytical system and services necessary to meet the Chemistry and Immunochemistry testing and analysis requirements for Brooke Army Medical Center, JBSA, Fort Sam Houston, TX and its outlying clinics.

The analyzers shall be located in four separate locations in the Main Laboratory of Brooke Army Medical Center (BAMC), BAMC Reference Laboratory, BAMC Emergency Department STAT Lab, and the CPT Jennifer M.

Moreno Primary Care Clinic Lab in Fort Sam Houston. Contractor shall include delivery, installation, all calibrators/standards, reagents/reagent packs, and quality control materials necessary to perform the specified assays. The offerors product solution shall provide redundancy (to ensure continuous operations), training, supplies, , unscheduled maintenance, and preventive maintenance for the equipment. Initial Method Validations per Clinical Laboratory Improvement Amendments (CLIA)/National Committee for Clinical Laboratory Standards (NCCLS)/Department of Pathology and Area Laboratory Services Quality Management (DPALS QM )guidelines, to include method correlation, linearity verification to maximum dilution, precision, carry-over, normal reference range validation, serum/plasma and blood collection tube validation, initially and with each new assay and/or conversion and for trouble-shooting purposes. Validation Study criteria to be established by Director Chief, LTC Jude M.

Abadie. Contractor shall provide review to Director Chief, LTC Jude M. Abadie for acceptability and approval of all assays prior to proceeding with Clinical Testing. To include analyzer decontamination when necessary and removal of all instruments at the termination of the contract. The analyzer systems shall provide users with rapid, reliable test results that are critical for patient care. The Contractor shall be responsible for maintenance service, on-site repair and parts as required in order to maintain a minimum 98% uptime for all instrumentation. All testing materials to include reagents, equipment, consumables and products associated with testing., must be FDA approved platforms. All costs will be calculated on a cost per reportable result based on estimated patient volume and test type listed in Appendix A.

1.2 Chemistry and Immunochemistry Analyzer Equipment – The contractor shall provide a Chemistry and Immunochemistry System that is fully automated, inclusive of linear integration, discrete random access capabilities for chemistry, immunometric, potentiometric, and colorimetric assays within the same instrument. The system shall be capable of performing all of the required tests and assays listed in Appendix A, pre-analytical processing, sorting, and post-analytical storage. All equipment displays and supporting literature must be in the English language.

1.3 The total number of analyzers shall be determined by the minimum throughput, available menu requirements, patient acuity, ability to continually operate for 12-hrs without having to stop to load reagents or consumables, and must fit within available space for each facility 2,143(ft2)-Main Core Lab, 2,846(ft2)-Reference Lab, 554 (ft2)-Emergency Department STAT Lab, and 1,793(ft2)-CPT Jennifer M. Moreno Primary Care Clinic Lab (see exhibits 1 through 4 for details) without any architectural changes to existing floor plans. This is inclusive of secondary/external equipment that is not a component of primary testing, processing, or storage, such as compressors or ventilation systems to drive pre-analytical processes. In the event that secondary or external equipment is not included in the primary system layout due to laboratory space and/or contributory distractors to patient testing/care such as heat and/or noise, the vendor shall provide this information and any associated specifications.

1.4 BAMC Core Chemistry Laboratory minimum actual through-put shall be: 600 tests per hour for immunometric assays, 1600 tests per hour for enzymatic/rate and colorimetric/photometric assays and 2000 tests per hour for ISE assays.

1.5 All analyzer shall be a random access, discrete analyzer system with STAT interrupt capability and a primary tube sampling system capable of handling 100mm x 16mm, 100mm x 13mm, 75mm x 13mm, 64mm x

10.25 and 46mm x 10mm (microtainer) test tubes with standard or Hemogard caps and screw caps. The analyzer shall be capable of accommodating both Becton-Dickinson and Greiner tubes.

1.6 These analyzer systems shall be capable of performing in low, medium, and high volume work periods to produce results that are accurate and precise.

1.7 Analyzer throughput shall be measured as a function of number of STAT panels (see Table 1) fully completed in 30-minutes.

1.8 The test types and annual estimated volumes for each area are illustrated in the Tables 1 through 5 of Appendix A.

1.9 An explanation and illustration for Acceptable Performance Standards for the chemistry/immunoassay analytes are located in Table 6 of Appendix A.

1.10 The 30-min STAT panel includes the assays listed in Table 1. These assays shall be analyzed from the same specimen with a maximum turn-around-time (automated pre-analytical processing to certification) of 30 minutes.

Table 1 – Assays that must be completed from the same specimen within 30 minutes as a STAT panel

Acetaminophen Alanine Amino Transferase (ALT) Albumin

Creatinine Kinase, Total (CK) Creatinine Kinase, MB Fraction (CK-MB) Glucose

Ammonia (NH3) Amylase Aspartate Amino Transferase (AST)

Chorionic Gonadotropin (hCG) Methotrexate Myoglobin

Bilirubin (Direct/Conjugated) Bilirubin (Total) NTproBNP or BNP

Potassium Protein, Total Salicylate

Calcium (Total) Sodium

Carbon Dioxide (CO2) Theophylline

Chloride Troponin-T or high sensitive Troponin

Creatinine, enzymatic Digoxin

Parathyroid Hormone, Intra-operative – 10 min or less analytic time required Phenytoin Phenobarbital Phosphorous Procalcitonin – 20 min or less analytic time required

Urea Nitrogen Magnesium Lactate Lipase Thyroid Stimulating Hormone – 30 min or less analytic time required Vancomycin Vitamin D – 30 min or less analytic time required Folate and Vitamin B12 – 30 min or less analytic time required

2. Performance Requirements – Automation

2.1 Preanalytic System

2.1.2 The Contractor shall provide a fully automated pre-analytical system that has the ability to centrifuge, decap (screw cap, rubber stopper, and Hemogard cap), aliquot, label aliquot tubes, recap, sort to user definable locations, and workflow management for connected analyzers. The pre-analytical system shall have independently programmable self-balancing centrifuges (rpm and times) and shall be able to provide platelet-poor plasma for coagulation tests and the capability, based on user defined requirements, to centrifuge aliquots a second time for special coagulation tests.

2.1.3 The pre-analytical system shall provide single point of specimen entry for the routine analysis of all required tests, to include but not limited to chemistry, immunochemistry, hematology, coagulation, and urinalysis.

There shall be an optional separate specimen point of entry for STAT specimens with STAT Prioritization throughput the workflow from automation through Chemistry/Immunoassay systems. The system shall have ability to perform sample integrity check in pre-analytic process to detect potential problems early on.

2.1.4 The pre-analytical system shall be capable of handling, at minimum, specimen tubes in 100mm x 16mm, 100mm x 13mm, 75mm x 13mm and 64mm x 10.25mm. The system must have ability to decap (hemogard/rubber/twist off caps) without standardizing to single cap type. Must have ability to recap each tube size stated.

2.1.5 The pre-analytical system shall be capable of aliquotting into user defined tubes (both push cap and screw cap and of varying sizes), labeling based on user defined requirements and sorting to user defined output locations to facility reference or send out testing. The system must have the ability to aliquot to preserve primary sample integrity.

2.1.6 The pre-analytical system shall have a minimum throughput of 1,000 samples per hour.

2.2 Post Analytical System

2.2.1 Post-analytical storage – The contractor shall provide a post-analytical bi-directional storage refrigeration unit connected to the automation line that can store at least 20,000 specimens at 2-8 degrees C and automatically discard specimens at a user specified time depending on sample type or test. The unit shall shallhave the capability of capping tubes of the following dimensions: 100mm x 16mm, 100mm x 13mm, 75mm x 13mm and 64mm x 10.25mm. 2.2.2 The post-analytical storage unit shall have the capability to batch specific analytes (e.g. Vitamin D, Hepatitis) and automatically recall all pending specimens upon request and send samples via the automation line to specified analyzer(s).

2.2.3 The post-analytical storage unit shall provide a specimen recall function able to indicate whether the specimen goes to an output location or will be sent via the automation line to the testing analyzer(s) for additional testing. Retrieval times must be short for Stat retrieval of samples.

2.2.4 The post-analytical storage unit shall be accessible at all times, to include time of power outage.

3. Reagents and Inventory Management

3.1 The analyzer shall have the on-board ability to maintain reagents at the proper storage temperatures for the assays listed in Statement of Objectives. On-board stability for chemistry and immunochemistry assays shall provide for minimal reagent changes. On-board stability to be evaluated per assay. All assays must be FDA approved.

3.2 The analyzer shall be capable of maintaining calibration curves for all of the assays listed in Statement of Objectives simultaneously. Assays must have a minimum calibration stability of 30-40 days for Chemistry and Immunochemistries. Calibration stability to be evaluated per assay.

3.3 The assays listed in Table 2 below shall be approved by the FDA for plasma as well as serum samples. In addition, the Contractor shall clearly demonstrate an acceptable correlation between plasma and serum values during the initial set up and validation studies. Whole blood HbA1c without pretreatment must be available for random access testing. Serum indices required for all testing.

3.4 The contractor shall provide minimum specimen volume requirements. Volume requirements to be evaluated per assay and panel, with and without dead-space requirements.

3.5 The contractor shall sequester the required calibrator, quality control material, and reagents to ensure no more than (2) lot changes per contract year.

3.6 The analyzers provided shall have the capability to add/change out reagents/reagent packs with no operational downtime /minimal quality control requirements (i.e., shall allow the user to calibrate any assay, remove the assay reagents/reagent packs for a period of undetermined time, and then reload the reagents/reagent packs during operation to run the assay without the need for recalibration. The analyzer must allow for loading of reagent packs during operation, intermittently and unscheduled.

3.6.1 The analyzer systems shall provide open channels to accommodate third party assays, e.g., Glucose-6-phosphate Dehydrogenase (G6PD). The Contractor shall provide consumables, reagent containers, etc. in sufficient quantities and quality to perform these assays. Volume listed in Table 3 Reference Lab.

3.6.2 The contractor shall deliver reagents no later than seven calendar days following request for products/supplies. Standing Order schedules for routine delivery of supplies to be defined by Laboratory Ordering Officer with no additional charges for revisions. Contractor shall assign a Point of Contact for the Laboratory Ordering Officer to order through.

3.6.3 The contractor shall provide Inventory Program or System for continuous monitoring and management of all reagents, consumables and necessary supplies and their utilization.

Table 2 - Assays That Must be Approved for Use with Plasma Samples

Acetaminophen

Alanine Amino Transferase (SGPT)

Albumin

Alcohol (Ethanol)

Alkaline Phosphatase

Amylase

Aspartate Amino Transferase (SGOT)

Bilirubin (Direct)

Bilirubin (Total)

Calcium (Total)

Carbamazepine

Carbon Dioxide (CO2)

Chloride

Cholesterol

Cortisol, Total

C-Reactive Protein (CRP)

C-Reactive Protein, High Sensitive (HS-CRP)

Creatinine

Creatinine Kinase (CK) Total

Creatinine Kinase MB Fraction (CK-MB)

Digoxin

Estradiol fT4

Gentamicin

Glucose

Glutamyl transferase, Gamma (GGT)

Gonadotropin, Chorionic (hCG)BhCG and Intact

High Density Lipoprotein (HDL)

Homocysteine

Iron

Lactate (Lactic Acid)

Lactate (Dehydrogenase) (LDH)

Lipase Magnesium Methotrexate

Myoglobin

NT proBNP or BNP

Phosphorus Inorganic (Phosphate)

Potassium

Procalcitonin

Progesterone

Prolactin

Protein, Total

PTH (must be validated for Intra-operative use)

Salicylate

Sodium

Theophylline

Thyroid Specific Hormone (TSH)

Transferrin

Troponin I or T; high sensitive Troponin I or T

Urea Nitrogen

Uric Acid

Vancomycin

The assays listed in Table 3 shall be approved by the FDA for urine samples.

Table 3 – Listing of Assays That Must be Approved for Use With Urine Samples Amylase Calcium (Total)

Potassium Protein, Total

Chloride Creatinine

Phosphorus Inorganic (Phosphate)

Glucose Magnesium Microalbumin (Quantitative)

Sodium Urea Nitrogen Uric acid

The assays listed in Table 4 shall be approved by the FDA for CSF and Body Fluid samples.

Table 4 – Listing of Assays That Must be Approved for Use With CSF and Body Fluid Samples Glucose Protein Lactate

3.7 Emergency Department STAT Lab, CPT Jennifer M. Moreno Primary Care Clinic Lab (Mid-Low Patient Testing Volume Analytical Systems)

3.7.1 Chemistry System shall have ability to perform >= 300 tests per hour depending on method mix. Provide STAT testing capabilities. Allow for multiple tube sizes on same rack without use of adaptors. Provide clot, liquid level detection. Low specimen carryover with minimal requirements for reagents, calibrations and quality control.

3.7.2 Chemistry Instrument Reagents shall allow for transference of Reference Ranges from main core lab to all satellite labs, same specimen types for testing in Main Core lab and all satellite Labs. Provide ability to program open channels. >=3 ISEs available on board instrument.

3.7.3 BAMC Emergency Department STAT Lab - Immunoassay System shall perform 60-100 tests per hour, allow loading of 20-40 patient samples with STAT capabilities.

3.7.4 Immunoassay System Reagents shall allow for transference of Reference Ranges and same specimen types for testing for Main core lab to all satellite labs. Provide Liquid ready to use reagents – that do not require pretreatment. Provide testing menu consistent with >95% of those performed in the BAMC Core Chemistry Laboratory listed in Appendix A.

4. Maintenance and Service

4.1 ANCILLARY MAINTENANCE. The Contractor shall be responsible for furnishing maintenance, services, repairs, and parts as required in order to maintain the systems at all locations at a 98% uptime guaranteed. The Contractor shall provide all reagents, calibrators, controls and any other materials necessary to troubleshoot and remedy the reasons for the analyzer failure or malfunction at no additional cost.

4.2 The Contractor shall provide direct customer service and support, 24 hours/7 days a week, to include hotline telephone service (provided in English) and on-call emergency repair service support, to assist operators in correcting equipment operation and IT issues.

4.3 The Contractor shall provide repair service response within 1 hour and technician arrives within 12 hours after notification for routine/ and 4 hours after emergency failures. The Contractor’s qualified service technician shall be on site to provide routine services; safety checks, service requiring immediate repair; scheduled services for preventive maintenance, and calibration as specified in the Contractor’s instrument maintenance manual and as determined by Director Chief, LTC Jude M. Abadie. The equipment shall be repaired and operational within 24 hours after initial documented request by the Laboratory. 4.4 Contractor shall provide two (2) paper and two (2) electronic (CD) copies of the Operator’s and Maintenance manuals and a statement of the warranty terms in the English language for each location. The level of detail required of appropriate instrument maintenance manuals extends only to routine maintenance procedures performed by the user. All instrumentation specified is non- Government owned equipment that is provided, serviced, and maintained by the Contractor.

4.5 Contractor shall provide adequate service support for the following areas; decontamination, relocation, installation management, Lab Process consultants for pre and post workflow analysis, IT Project management for IT implementations and on-going initiatives.

5. Training

5.1 The Contractor shall provide training for two (2) primary operators per analyzer at the Contractor’s training site, prior to delivery and installation of the analyzer and annually thereafter with each option year at no additional cost to the Government. The Contractor shall provide initial on-site operator training to all technicians assigned to the Government site (i.e., BAMC Department of Pathology Laboratory Staff) prior to initiation of use of the analyzer for patient testing. On-site analyzer training shall be provided for up to 8 technicians annually at no additional cost to the Government. Periodic Advanced Operator Training/Education must be offered for all levels of staffing (i.e. Manager/Supervisor, Operations-Technical, and Information Systems). The contractor shall provide PACE accredited continuing education to all personnel on relevant Laboratory related topics at minimum bi-annually on-site or via online courses.

5.2 Contractor shall provide Information Technology type training (e.g. Rules Writing) for two (2) operators per year starting with Base Year and annually thereafter with each option year.

5.3 Periodic Advanced Operator Training/Education must be offered for all levels of staffing (i.e.

Manager/Supervisor, Operations-Technical, and Information Systems).

6. Information Technology Management Requirements

6.1 The analyzer system shall be capable of interfacing with the military hospital computer system, i.e., the Composite Health Care System (CHCS). The Contractor shall have a driver compatible for interfacing the analyzer with CHCS. The interface between CHCS and the analyzer shall be bi-directional. Vendor shall include two (2) third party licenses.

6.1.1 The contractor shall identify the contractor specific equipment or third party vendor’s equipment such as hematology,coagulation, and immunoassay that is able to connect via driver to IT (Middleware) interface. .

6.2 The analyzer system shall include a data management system for control of the operation of the analyzer system, management of the quality control program, management of the on-instrument useful life of the reagents/reagent packs, and management of patient results; and a printer for the production of hard copy patient reports and other reports generated via the analyzer system’s data management system. The Data Management system shall have a comprehensive, fully-integrated Quality Control (QC) software module that stores and evaluates quality control results. Results can be viewed in a variety of formats including Levy-Jennings charts, moving patient averages, CAP connectivity, EP Evaluator, and statistical summaries. The application shall validate QC results by checking them against user selected rules and automatically alert the operator when a rule violation has occurred.

The software program shall have the capability to incorporate Bio-Rad’s online/onboard Quality Control analysis package, Unity Interlaboratory Program and Unity QC Data Management Solutions.

6.3 Data Management system shall have a user friendly "Windows Based" interface that shall include a data management system for operational control of the analyzer system, management of the QC program, on-instrument useful life of the reagents/reagent packs, and management of patient results.

6.4 The software shall provide a single operator interface for workload management, data management, and instrument operational status monitoring. The software controls the operations of the analyzer, monitors the lot number expiration date of on-board reagents and control materials. This shall be accomplished via communication connections between the automation, analyzers, and hospital Laboratory Information System (LIS).

6.5 Remote diagnostics and troubleshooting shall be available using a maintenance application program that allows technical and service specialists at the Contractors technical support center or a field representative to remotely access the instruments to diagnose a problem. When remote diagnostics not available, vendor shall provide quarterly onsite support and as needed. Quarterly onsite support to consist of 2 days/6 shift minimum or until current IT issue resolved.

6.6 The Contractor shall provide a middleware solution and full IT support throughout the life of the contract to include supporting required developing, validating, and implementing features listed below. Middleware capabilities shall include, at a minimum, the following features:

6.6.1 The capability to write user defined auto-verification/auto-result validation rules that can hold transmission of results for review by the user.

6.6.2 The capability to validate user defined auto-verification/result validation rules.

6.6.3 Support patient delta checks as part of the auto-verification process.

6.6.4 Establish Moving Averages (Average of Normals) protocols to identify trends that may affect patient results.

6.6.5 Store patient results for a minimum of 12-months to facilitate auto-verification/auto-result.

6.6.6 Ability to utilize CAP Proficiency Driver for direct connection to College of American Pathology.

6.6.7 Provide patient result management system for statistical analysis to include metrics such as Time to Result;

percent Auto-verification; percent of samples affected by Hemolysis, Lipemia, and Icterus with ability to drill down to level of blood collector.

6.7 TELECOMMUNICATION - Systems that provide the ability to control instrument software from remote locations are required. All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software must be able to pass MITC testing and review and be awarded a Certificate of Networthiness (CoN) from NETCOM. Submission of the CoN must be completed within six (6) months of contract award.

6.7.1 The Contractor shall follow Army Regulation 25-1, “Army Knowledge Management and Information Technology, AR 25-2, “Information Assurance (IA, Appendix B)”, and DoD 6025.18-R, DoD Health Information Privacy Regulation (Appendix C).

6.7.2 In accordance with contract requirements, Contractors shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device. All costs for VPN hardware and software shall be incurred by the Contractor.

6.7.3 BUSINESS TO BUSINESS (B2B) PARTNERS AND 3rd PARTY VENDORS - The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

Vendors must insure ability to conform to all standards set forth by Department of Defense Risk Management Framework.

6.8 ARMY CYBERSECURITY/RISK MANAGEMENT FRAMEWORK (RMF)

REQUIREMENTS -

A. GENERAL OVERVIEW OF ARMY CYBERSECURITY REQUIREMENTS

1. New Equipment/Product (systems, equipment and software under RMF): The Vendor shall agree to the Army Cybersecurity/RMF requirements, receive an Authority to Operate (ATO), and maintain the ATO for 6 years or as long as the vendor commercially supports the equipment/product, whichever is longer.

The vendor shall maintain an ATO on all equipment/product versions owned by the Army and originally purchased through the vendors contract. If a vendor cannot support the ATO for all Army owned versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the ATO for 6 years from date to ATO, either at no cost to the Government or at a fixed price that is included and evaluated as part of the vendor’s new equipment/product offer. Vendors who cannot support all versions of the equipment/product and cannot offer upgrades required to maintain the ATO for 6 years shall not be considered.

During the period of time the vendor must maintain the ATO; 6 years or as long as the vendor commercially supports the equipment/product, whichever is longer; the vendor shall provide all required cybersecurity patches/updates. If the patches are separate from updates as required by the vendor’s contract, the vendor shall offer the cybersecurity patches under a maintenance offering on their contract that provides for all required cybersecurity patches/updates needed to maintain the ATO. Maintaining the RMF ATO shall be included as part of the vendors warranty period.

2. Maintenance: Vendors must agree to the Army Cybersecurity requirements for all systems purchased after June 6, 2017, systems under a DIACAP ATO or systems in process for RMF ATO approval. Vendors may otherwise request an exception to cybersecurity policy . Exceptions to cybersecurity policy must be requested from the MTF purchasing the maintenance and any exception are contingent on approval by local and MEDCOM CIO and Approving Official (AO).

3. Upgrades: Vendors must agree to the Army Cybersecurity requirements for all upgrades.

Although there is an exception to cybersecurity policy process for upgrades similar to maintenance, the Army does not envision granting exceptions to cybersecurity policy and would instead replace the system in lieu of approving upgrades that do not comply with cybersecurity policy.

B. Army Cybersecurity/Risk Management Framework (RMF) Requirements

1 System Security Requirements

1.1 The vendor shall submit to the Government, included in the proposal, the blue section of the Medical Device Cybersecurity Assessment Questionnaire (Attachment #3), which is provided by government, as well asNessus Scans. A Nessus scanner must be procured by the vendor, at their own cost, in order to comply with RMF requirements.

1.2 Vendor agrees to comply with security regulations and guidance listed in attached

Appendix A and all Risk Management Framework (RMF) requirements.

1.3 Failure to meet the requirements may result in termination of the delivery order for cause, in accordance with FAR 52.212-4(m).

1.4 The vendor device or system shall pass pre-validation screening (Vulnerability scans utilizing Nessus, and SCAP scans), administered within six (6) months of contract award that will be conducted by Government, and must meet criteria listed below:

1.4.1 No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

1.4.2 No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

1.4.3 No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

1.4.4 No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

1.5 The vendor shall mitigate all Very High, High, and Moderate Severity/CAT I and CAT

II vulnerabilities discovered during the Assessment and Authorization (A&A) process according to a schedule published by Government.

1.6 The vendor shall appoint a vendor point of contact responsible for the cybersecurity of the vendor device or system throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials, and meet required deliverable timelines.

1.7 The vendor shall obtain a recommendation of Authority to Operate (ATO) as determined by a Government appointed third party validator within twelve (12) months of contract award.

1.8 The vendor shall not make any delivery and shall not receive payment for the system until the ATO is granted. Receiving the ATO document from the U.S. Army shall constitute permission to perform on the order and to proceed with delivery. All delivery dates shall be reset in accordance to contract and in days after the date the ATO is communicated in writing to the vendor. Delivery may take place prior to ATO only if written permission is provided by the Contracting Officer.

1.9 Pursuant to subsequent warranty period and Service Maintenance Agreements (SMA), the vendor shall, after the issuance of an ATO, ensure that the vendor’s device or system maintains its ATO for 6 years or as long as the vendor commercially supports the equipment/product, whichever is longer.

The vendor shall maintain an ATO on all equipment/product versions owned by the Army and originally purchased through the vendors contract. If a vendor cannot support the ATO for all Army owned versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the ATO for 6 years from date to ATO, either at no cost to the Government or at a fixed price that is included and evaluated as part of the vendor’s new equipment/product offer. Vendors who cannot support all versions of the equipment/product and cannot offer upgrades required to maintain the ATO for 6 years shall not be considered.

During the period of time the vendor must maintain the ATO; 6 years or as long as the vendor commercially supports the equipment/product, whichever is longer; the vendor shall provide all required cybersecurity patches/updates. If the patches are separate from updates as required by the vendor’s contract, the vendor shall offer the cybersecurity patches under a maintenance offering on their contract that provides for all required cybersecurity patches/updates needed to maintain the ATO. Maintaining the RMF ATO shall be included as part of the vendors warranty period. For updates/patches, executable files should be distributed by the manufacturer accordingly, or implemented by the manufacturer technical staff dependent on Service Agreement processes.

1.10 The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

1.11 The vendor shall notify the PMO and Contracting Officer POCs in writing with any inabilities to comply with DoD security requirements. Vendor will provide anticipated costs and timelines required to address vulnerabilities in question.

1.12 The vendor shall contact the IA/RMF Office Representative, no later than 5 business days after delivery order issuance or contract award, to start the process. Failure to do so would be considered a vendor caused delay.

2 RMF Timeframes

The following table provides an overview of the entire Process to obtain approval under Army Cybersecurity requirements. Vendor actions must start as cited in the number of days after date of order column noted below and be completed in the number of days listed below in the Duration column.

ID Step Name (Action or Deliverable

Duration (Days)

Number of Days After Date of Order

Responsible Party

1 1 Categorization 22 Total Days 2 1.1 Vendor RMF

Kickoff Meeting (Vendor must contact the RMF Office Rep)

1 5 GOVERNMENT

3 1.2 EDMS

Paperwork and Account Creation

10 5 GOVERNMENT

4 1.3 EDMS

Functionality Briefing

1 5 GOVERNMENT

5 1.4 Documentation Templates to Vendor

1 5 GOVERNMENT

6 1.5 Hardware/Software Document Production

5 5 VENDOR

7 1.6 STIG Review 2 10 GOVERNMENT 8 1.7 System

Categorization

2 12 GOVERNMENT

9 1.8 Categorization Memo Approval

5 17 GOVERNMENT

10 1.9 Security Assessment Plan Creation

3 12 GOVERNMENT

11 1.10 SAP Sent to Vendor

0 15 GOVERNMENT

12 1.11 Contact 3rd Party IV&V

0 15 GOVERNMENT

13 2.Control Selection 6 Total Days 14 2.1 System eMASS

Registration

1 12 GOVERNMENT

15 2.2 eMASS Control Selection

1 12 GOVERNMENT

16 2.3 Implementation Plan Completion

5 17 GOVERNMENT

17 3. Implementation 130 Total Days

18 3.1 Documentation Creation and Review

GOVERNMENT

19 3.1.1 Vendor Control and Artifact Documentation

90 5 VENDOR

20 3.1.2 PMO Control Documentation

55 40 GOVERNMENT

21 3.1.3 Documentation 100% Complete (Confirm IV&V)

0 95 GOVERNMENT

22 3.2 Scanning 120 16 VENDOR 23 3.2.1 Vendor Initial

Scan

10 16 VENDOR

24 3.2.2 ICS Review of scans and Vulnerability Report

2 26 GOVERNMENT

25 3.2.3 Vendor Technical Remediation

110 27 VENDOR

26 3.3 DHA

Registration

60 77 GOVERNMENT

27 3.3.1 DHA A&A

Request

1 77 GOVERNMENT

28 3.3.2 Submit Security Plan for Approval

10 77 GOVERNMENT

29 3.4 Submission to

IV&V

Team/Submit IV&V Request

0 137 GOVERNMENT

through Portal

30 4. Assess 65 Total

31 4.1 Packet Review by IV&V Team

29 138 GOVERNMENT

32 4.2 Coordination Meeting

0 165 GOVERNMENT

33 4.3 Onsite I&V 5 168 GOVERNMENT 34 4.4 SCA-V Packet

Review

30 173 GOVERNMENT

35 4.5 SCA-V SAR

Issuance

0 203 GOVERNMENT

36 5. Packet Authorization

60 Total

38 5.1 Vendor Remediation

30 173 VENDOR

5.1.1 SAR

Review/Concurrenc e

10 203 GOVERNMENT

39 5.2 Submit to

SCAR

10 213 GOVERNMENT

40 5.3 Submit to SCA 5 223 GOVERNMENT 41 5.4 Submit to AO 5 228 GOVERNMENT 42 5.5 AO signature 0 233 GOVERNMENT

Note: Not all above actions occur in a sequential manner as some actions may be worked concurrently.

3 Assessment and Authorization (A&A)

3.1 The vendor shall submit all RMF required documentation, as specified by Government Reps for review and approval, no later than four (4) months after request by the Government.

3.2 The vendor shall obtain approval from the Government, any vendor developed RMF policies, plans, and procedures prior to implementation.

3.3 The vendor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of request by the Government.

3.4 The vendor shall provide technical scans within one (1) month of the A&A kickoff meeting.

3.5 The vendor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted.

3.6 The vendor shall ensure that the vendor device or system is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and antimalware applications that are approved at the time of ATO issuance. The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g.

DLP, IPS, Antivirus, etc.) without performance degradation of the medical system/device. In cases where the operation of security applications are not technically achievable, the vendor shall provide detailed justification and a Plan of Actions and Milestones (POA&M) describing steps towards compliance with this requirement.

3.7 The vendor shall ensure that the vendor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis.

Scanning shall encompass the entire system (file system, operating system, real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

4 Privileged User Training and Certification Requirements

If a vendor requires a B2B, access, etc to government networks to maintain, analyze, etc, their equipement/product, they must adhere to the following requirements:

Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army network will meet Army requirements for a privileged-level account before being granted a network account. Requirements include:

•Cyber (Information assurance (IA)/information technology (IT)) certification. Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT – II) and be required to meet minimum Professional Baseline certifications at the time of contract award.

Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract are met.

•Background Investigation. NACI or above is required. Vendors should email:

usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain guidance on the process

•Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (GSCL, CISM, CISSP, etc.) will satisfy this requirement.

•Computer Environment (CE) Certification. Computer Environment (CE) certifications are determined by the role of the contractor and must be met within six months of delivery order issuance. Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a professional certification that coincides with the technology inherent in the system (i.e. MCSE, CCNA, RHCSE, etc.). The CompTIA A+ certification will also satisfy the CE certification requirement.

•IA Training Requirements. Contractors will meet minimum training requirements within six months of contract award. Contractors will be required to complete Cyber Security Fundamentals located at URL: https://ia.signal.army.mil/IAF/

•Two-Factor Authentication. Contractors will authenticate using two-factor authentication.

The only method for authenticating is the Common Access Card (CAC).

•Army Training Certification Tracking System (ATCTS). Contractors with a need for elevated privileged-level access will be defined to ATCTS.

https://atc.us.army.mil/iastar/regulations.php

•Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the ITC One-Stop Shop for contractors requiring on-site access or through the Information Assurance/Cyber Security Branch for contractors requiring remote access to an Army network. Remote access must be through a Defense Health Agency (DHA) Business-To-Business (B2B) solution. Vendors should email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain remote access through DHA, for Army requirements.

•IA Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/

•Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the Army Standard Acceptable Use Policy (AUP) prior to being granted a Army network account.

The Army Standard AUP is available at the following website:

https://atc.us.army.mil/iastar/docs/aup.pdf

5 Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity Requirements

1 Continuous Risk Management

1.1 The vendor shall maintain a duplicate of the fielded equipment/product falling under one authorization; for testing in a vendor supplied lab environment at vendor location for 6 years from initial ATO approval or as long as the vendor commercially supports the equipment/product, whichever is longer. The vendor shall maintain a duplicate of the equipment/product for each version owned by the Army and originally purchased through the vendors contract. The duplicate equipment/product does not have to be a physical duplication and can just be virtual duplication, as long as all components within the authorization boundary are represented

1.1.1 The vendor shall maintain the duplicate system or device in operational condition with the latest security patches installed.

1.2 The vendor shall update all ATO required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system.

1.3 The vendor shall maintain the authorized security configuration and notify the government within forty eight (48) hours of any major changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO.

Vendor shall support reauthorizations due to major upgrades.

1.4 The vendor shall ensure the vendor’s device or system is in compliance with the

Department of Defense (DoD) Information Assurance Vulnerability Management (IAVM) program upon each deployment.

1.5 The vendor shall ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a lab environment.

1.6 The vendor shall make the duplicate device or system available for periodic security reviews, within forty five (45) business days of notification by Government. The vendor shall perform monthly vulnerability scans using the most recent and updated version of approved DoD scan tools.

1.7 Vendor shall maintain system and update to comply with updated STIGS as made available by the Government within three (3) months of notification by the Government.

1.8 The vendor shall provide vulnerability scan and SCAP scan results to Government on a monthly basis. Vendor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month.

1.9 The vendor shall close all discovered vulnerabilities within three (3) months of discovery.

1.10 The vendor shall submit to Government detailed explanations for the inability to close discovered vulnerabilities.

1.11 The vendor shall submit to Government for approval of any mitigation that addresses any open vulnerabilities.

1.12 The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to Government for approval.

1.13 The vendor shall use the Government approved method for remote access administration (DISA B2B) of system or device.

6 Appendix A: Cybersecurity Regulations and Guidance

1. Cybersecurity Regulations and Guidance The vendor shall use and comply with the most recent published versions as of the date of contractual agreement of the following references as well as all regulations or guidance referenced within those publications:

a. United States Law

i. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

ii. The Federal Information Security Management Act (FISMA)

iii. The E-Government Act of 2002

b. Office of Management and Budget (OMB)

i. The following publications are located at https://www.whitehouse.gov/omb/agency/default

ii. Circular A-130

iii. Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-Policy for a Common Identification Standard for…