Amendment No. 0001.pdf

RFQ No. W81K0024Q0001 Amendment No. 0001

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

The following have been added by full text:

CONTINUATION PAGE

Industry Generated Questions and Answers

1. Q: "Please confirm which Attachment 1 document we should use when quoting annual testing volumes: Attachment 1 (within the RFQ pdf document) or Attachment 1 (excel pricing file).

Additionally, the excel pricing file includes Immunoassay tests on the ‘Chem Core’ tab, and on the ‘IA Core” tab, TSH is listed in the base year, but T4 is listed in Option year 1-4."

A: " Reference Attachment 1 ESTIMATED WORKLOAD DATA, the last 3 pages of the SOW. Pricing Worksheet has been revised. T4 is a typo. Should be TSH for all base and option years. See revised Statement of Work. See revised pricing worksheet.”

2. Q: " Please provide clarification on the “triple redundancy” requirement listed under 1.2 in the Statement of Work."

A: “Triple redundancy” is when components of a system are triplicated, providing redundancy in case one should fail. However, dual redundancy is acceptable.”

3. Q: "Please provide clarification on the “bidirectional track” requirement listed under 1.3 in the Statement of Work. Should this state “bidirectional interface”?”

A: “The analyzer should have the capability to prioritize the STAT tests and have the flexibility to transport the samples to different directions if both chemistry and immuno tests are required for the same sample. It is understandable that different manufactures may use different transport technologies or terminologies. The analyzer that has the technology to promote the efficiency of testing is what we are looking for.”

4. Q: “Respectfully requesting a due date extension of 7 business days post questions being answered."

A: “An extension has been approved. The RFQ submission date is NLT 09 November 2023 at 3:00PM

CST.”

5. Q: “Respectfully requesting an extension for submissions to 4:00 PM CST Friday, December 1st to allow time for a response to answers for industry’s questions.”

A: “December is 1st is not approved, the SF30 states the extension.”

6: Q: “Section 1.2 “Triple redundancy is mentioned, what does this mean? Other sections request/reference two analyzers.”

A: ““Triple redundancy” is when components of a system are triplicated, providing redundancy in case one should fail. However, dual redundancy is acceptable.”

7: Q: “Section 1.2 Can the government procure its own ink and computer paper for the printer?”

A: “Yes, the government can.”

8: Q: “Section 1.4 “analyzers shall not require floor drains”, current systems require water and water system is also requested in section 1.1. This requirement is source limiting to only one vendor as currently written.”

A: “Section 1.1 was corrected to clear the confusion. See revised Statement of Work.”

9: Q: “Section 1.5 states a “single-day site evaluation period”. Can this be described in more detail and when will it occur?”

A: “On-site evaluation provides vendor an opportunity to check the current layout, size, space, and infrastructure of the lab in person. After the on-site evaluation, vendor should obtain a better idea whether their analyzer can fit into the lab.”

10. Q: “Section 2.6.3, Table 4, Listing of assays- We request this requirement be amended to “analyzers must have the capability to perform CSF and Body Fluid samples.”

A: “Unable to amend this requirement due to regulatory guidelines. All testes must be approved by the

FDA.”

11. Q: “Section 2.3 asks for a hemoglobin A1C for whole blood. Table 2 states must be approved for plasma and serum samples. We request hemoglobin A1C be removed from Table 2 as it is a whole blood assay.”

A: “Removed. Hemoglobin A1C be removed from Table 2 as it is a whole blood assay.”

12. Q: “Section 10.1 asks the contractor shall provide moving services for two analyzers in the event of lab renovation or lab relocation. The moving services shall include disassembling, moving, and setting up analyzers at both old and new locations at no extra cost to the Government nor to the lab. Can more be shared about this potential move to help us forecast the cost? Will it be in the same building, same floor, etc?”

A: “The tentative plan is a temporary lab will be set up outside of the hospital in the parking lot area by entrance A. Our current lab is on the second floor of the hospital.”

13. Q: “Section 2.4 “The contractor shall sequester the required calibrator, quality control material, and reagents to ensure no more than (2) lot changes per contract year.” We request this be removed or changed from “shall” to “prefer”.”

A: “The less lot changes the better, cannot change the wording but have changed it to “no more than (4) lot changes per contract year” in section 2.5.”

14. Q: “Section 5.1 “The contractor shall identify the contractor specific equipment or third-party vendor’s equipment including hematology and coagulation that is able to connect via driver to IT (Middleware) interface; vendor to include two (2) third party licenses for additional connectivity.” Can you clarify what you are looking for with this statement? Is the request for a middleware solution as well to connect hematology and coagulation? Do you want the analyzer to connect directly to Genesis?”

A: “The vendor must have an established business relationship with Oracle Cerner with the product of MHS Genesis. Term was updated to clear the confusion. See revised Statement of Work.”

15. Q: “Section 5.6 “TELECOMMUNICATION - Systems that provide the ability to control instrument software from remote locations are required. All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS)

Virtual Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software must be able to pass MITC testing and review and be awarded a Certificate of Net worthiness (CoN) shall be submitted to the contracting officer six (6) months of contract award.”- Can you expand on what is being requested? Does the analyzer have to be able to be controlled from a remote location?”

A: “We prefer the vendor to have the ability to communicate remotely. However, the vendor may have the ability to communicate remotely, but they may not be approved by the DHA Informatics to perform that task. A Certificate of Net worthiness (CoN) should be obtained prior to the contract is awarded. Term was updated to clear the confusion. See revised Statement of Work.”

16. Q: “Section 4.2 - Contractor shall provide Information Technology type training (e.g. Rules Writing) for two (2) operators per year starting with Base Year and annually thereafter with each option year. Can you clarify if middleware is needed from the vendor or if there is a separate instance being used? If middleware hasn’t been requested, how will the vendor perform IT training for rules writing?”

A: “Vendor can provide training device such as Chromebook for the training.”

17. Q: “Section 5.4 - The software shall provide a single operator interface for workload management, data management, and instrument operational status monitoring. The software controls the operations of the analyzer, monitors the lot number expiration date of on-board reagents and control materials. This shall be accomplished via communication connections between the automation, analyzers, and hospital Laboratory Information System (LIS). Is automation needed or can it be removed?”

A: “There is only one factor with two subfactors that the offeror has to respond to, the pages allocated to respond is 30.”

18. Q: “Page 18 of the Solicitation document – Technical Capability has a 30-page restriction. Can this be expanded to 50 pages?”

A: “The page allocation is 30 as stated in the Instructions to Offeror.”

19. Q: “Can the quality control list numbers and quantities that are currently being purchased for the laboratory be provided in order to provide an accurate estimate of usage in the new contract?”

A: “The government has included attachment 2-Quality Control Numbers.”

ATTACHMENT 2

QUALITY CONTROL NUMBERS

Jan Feb Mar Apr May Jun Jul Aug Sept Oct Nov Dec Total boxes used

Multichem urine Technopath 2 1 1 1 2 1 0 1 2 1 1 1 14

IA Plus Technopath 2 2 1 3 2 3 2 2 1 3 2 3 26

Troponin Abbott 1 2 3 3 3 2 3 1 2 3 3 2 28

CORE Abbott 1 1 1 1 1 2 2 1 1 1 1 2 15

HepBsag Abbott 1 1 1 2 2 2 2 2 1 1 2 2 19 anti-HCV Abbott 1 1 2 2 1 2 1 1 2 2 1 2 18

Havab Abbott 1 1 1 1 1 1 0 1 1 1 1 1 11

CSF BioRad 1 1 1 1 2 1 0 2 1 1 1 1 13

Diabetes control BioRad 1 1 2 0 2 1 0 2 1 1 2 1 14

Ammonia Sekisui 1 2 3 3 3 4 4 1 2 3 3 3 32

CRP Abbott 3 2 2 3 2 3 3 2 2 3 2 3 30

S Plus Technopath 2 2 4 1 2 2 1 1 2 2 1 2 22

Folate Abbott 0 0 0 0 1 0 0 0 0 0 0 0 1 microalbumin Abott 1 0 0 0 2 0 0 0 0 0 0 0 3

CK-MB Abott 0 0 2 0 0 0 0 0 0 0 0 0 2

REVISED STATEMENT OF WORK

Statement of Work - Chemistry and Immunoassay Testing Revised Date: 02 November 2023

1. General Requirements:

1.1 Description of Work: The contractor shall provide two (2) Leased Automated

Chemistry and Immunoassay Integrated Analyzer Systems, and all required chemical and immunological reagents for testing of various diseases. The Contractor shall provide Chemistry /Immunoassay Testing under a Cost Per Reportable Result (CPRR) agreement to include equipment, reagents, tools, materials, training, Uninterruptable Power Supply (UPS) and services necessary to meet the Chemistry and Immunochemistry testing and analysis requirements for Bayne Jones Army Community Hospital (BJACH), at Fort Johnson, Louisiana. Contractor shall include delivery, installation, all calibrators/standards, reagents/reagent packs, and quality control materials necessary to perform the specified assays as well as any application or software licenses necessary to run the testing/analyzer. Initial Method Validations per CLIA/NCCLS/DPALS QM guidelines, to include method correlation, linearity verification to maximum dilution, precision, carry-over, normal reference range validation, serum/plasma and blood collection tube validation, initially and with each new assay and/or conversion and for trouble-shooting purposes. Validation Study criteria to be established by Director.

Vendor to provide review to Director for acceptability and approval of all assays prior to proceeding with Clinical Testing. To include analyzer decontamination when necessary and removal of all instruments at the termination of the contract. The analyzer systems shall provide users with rapid, reliable test results that are critical for patient care. The Contractor shall be responsible for maintenance service, on-site repair and parts as required in order to maintain a minimum 98% uptime for all instrumentation. All testing materials to include reagents, equipment, etc., must be FDA approved platforms. All costs will be calculated on a cost per reportable result based on estimated patient volume and test type listed in Attachment 1.

Period of Performance duration will be from 01 April 2024 to 31 March 2029 plus four option years.

Base Year: 01 April 2024 thru 31 March 2025 Option Year 1: 01 April 2025 thru 31 March 2026 Option Year 2: 01 April 2026 thru 31 March 2027 Option Year 3: 01 April 2027 thru 31 March 2028 Option Year 4: 01 April 2028 thru 31 March 2029

1.2 Chemistry and Immunochemistry Analyzer Equipment – The contractor shall provide a Chemistry and Immunochemistry System that is fully automated capable of linear integration and have discrete random-access capabilities for chemistry, immunometric, potentiometric, and colorimetric assays within the same instrument. The system shall be capable of performing all the required tests and assays listed in Attachment 1. The system shall provide triple redundancy (to ensure continuous operations), training, supplies, reagents, unscheduled maintenance, and preventive maintenance for the equipment. Contractor will provide all printers and printer toner or ink for all printers associated with the chemistry analyzer. All equipment displays and supporting literature shall be in the English language. Contractor shall include delivery, installation, all calibrators/standards, reagents/reagent packs, and quality control materials necessary to perform the specified assays, initial Method Validations per CLIA/NCCLS/DPALS QM guidelines and analyzer removal at the termination of the contract.

1.3 For the purposes of these performance requirements, the Chemistry analyzer system includes at a minimum:

- Peripherals (e.g., instrument specific computer terminals and CPUs, printers, toner etc.)

- Uninterruptable Power Sources (UPS)

- Bidirectional Track

1.4 The two analyzers shall not require external water/plumbing, drains, stirring mechanisms, mixing assemblies, or floor vents.

1.5 The two analyzers shall be determined by the minimum throughput, available menu requirements, patient acuity, ability to continually operate for 12-hrs without having to stop to load reagents or consumables and must fit within existing space of 600(ft2)-Main Core Lab allowing for existing benches, half-wall(s), offices, and minimal to no renovations. Single-day Site evaluation to be provided.

1.6 Minimum actual through-put shall be: 600 tests per hour for immunometric assays, 1600 tests per hour for enzymatic/rate and colorimetric/photometric assays and 2000 tests per hour for ISE assays.

1.7 Each analyzer shall be a random access, discrete analyzer system with STAT interrupt capability and a primary tube sampling system capable of handling 100mm x 16mm, 100mm x 13mm, 75mm x 13mm, 64mm x 10.25 and 46mm x 10mm (microtainer) test tubes with standard or Hemogard caps and screw caps. The analyzer will be capable of accommodating both Becton-Dickinson and Greiner tubes.

1.8 These analyzer systems shall be capable of performing in low, medium, and high-volume work periods to produce results that are accurate and precise.

1.9 Analyzer throughput shall be measured as a function of number of STAT panels (see Table 1) fully completed in 30-minutes.

1.10 The test types and annual estimated volumes for each area are illustrated in the Tables 1 through 4 and Attachment 1

1.11 An explanation and illustration for Contractor Performance Requirements Summary is in table 5; Performance/Quality Standards for the chemistry/immunoassay analytes is in table 6.

1.12 The 30-min STAT panel includes the assays listed in Table 1. These assays shall be analyzed from the same specimen with a maximum turn-around-time (automated pre-analytical processing to certification) of 30 minutes.

Table 1 – Assays that must be completed from the same specimen within 30 minutes as a STAT panel

Acetaminophen Alanine Amino Transferase (ALT) Albumin

Creatinine Kinase, Total (CK) Glucose Alkaline Phosphatase

Ammonia (NH3) Amylase Aspartate Amino Transferase (AST) Bilirubin (Direct/Conjugated) Bilirubin (Total) NTproBNP or BNP

Chorionic Gonadotropin (hCG) Methotrexate Myoglobin Potassium Protein, Total Salicylate

Calcium (Total) Sodium Carbon Dioxide (CO2) Theophylline Chloride Troponin-T or high sensitive Troponin Creatinine, enzymatic Digoxin

Parathyroid Hormone Phenytoin Phenobarbital Phosphorous Procalcitonin

Urea Nitrogen Magnesium Lactate Lipase Thyroid Stimulating Hormone Vancomycin C-reactive Protein Ethanol

2. Reagents and Inventory Management

2.1 The analyzer shall have the on-board ability to maintain reagents at the proper storage temperatures for the assays listed in Performance Requirements. On-board stability for chemistry and immunochemistry assays should provide for minimal reagent changes. On-board stability to be evaluated per assay. All assays shall be FDA approved.

2.2 The analyzer shall be capable of maintaining calibration curves for all the assays listed in Performance Requirements simultaneously. Assays must have a minimum calibration stability of greater than 10 days for Chemistry and Immuno-chemistries. Calibration stability to be evaluated per assay.

2.3 The assays listed in Table 2 below shall be approved by the FDA for plasma as well as serum samples. In addition, the Contractor shall clearly demonstrate an acceptable correlation between plasma and serum values during the initial set up and validation studies. Whole blood

HbA1c without pretreatment must be available for random access testing. Serum indices required for all testing.

2.4 The contractor shall provide minimum specimen volume requirements. Minimum specimen volume requirements to be evaluated per assay and panel, with and without dead-space requirements.

2.5 The contractor shall sequester the required calibrator, quality control material, and reagents to ensure no more than (4) lot changes per contract year.

2.6 The analyzers provided shall have the capability to add/change out reagents/reagent packs with only a minimal operational interruption/minimal calibration requirements/minimal quality control requirements (i.e., shall allow the user to calibrate any assay, remove the assay reagents/reagent packs for a period of undetermined time, and then reload the reagents/reagent packs during operation to run the assay without the need for recalibration. The analyzer must allow for loading of reagent packs during operation, intermittently and unscheduled.

2.6.1 The analyzer systems shall provide open channels to accommodate third party assays, e.g., Glucose-6-phosphate Dehydrogenase (G6PD). The Contractor shall provide consumables, reagent containers, etc. in sufficient quantities and quality to perform these assays. Volume listed in Table 3 Reference Lab.

2.6.2 The contractor shall deliver reagents no later than one (1) week following request for products/supplies. Standing Order schedules for routine delivery of supplies to be defined by Laboratory with no additional charges for revisions.

2.6.3 The contractor shall provide Inventory Program or System for continuous monitoring and management of all reagents, consumables and necessary supplies and their utilization.

Table 2 - Assays That Must be Approved for Use with Plasma and Serum Samples Acetaminophen Alanine Amino Transferase (SGPT) Albumin Alcohol (Ethanol) Alkaline Phosphatase Ammonia Amylase Anti HCV Aspartate Amino Transferase (SGOT) Bilirubin (Direct) Bilirubin (Total) B12 Calcium (Total) Carbamazepine Carbon Dioxide (CO2) Chloride Cholesterol Cortisol, Total

C-Reactive Protein (CRP) C-Reactive Protein, High Sensitivity (HS-CRP) Creatinine Creatinine Kinase (CK) Total Creatinine Kinase MB Fraction (CK-MB) Digoxin

DLDL

Estradiol Ferritin Folate

FSH

fT4 Gentamicin Glucose Glutamyl transferase, Gamma (GGT) Gonadotropin, Chorionic (hCG) BhCG and Intact

HAVAB-M

HBsAg HBcAb High Density Lipoprotein (HDL) Homocysteine Iron Lactate (Lactic Acid) Lactate (Dehydrogenase) (LDH)

LH

Lipase Lithium Magnesium Methotrexate Myoglobin NT proBNP or BNP Phosphorus Inorganic (Phosphate) Potassium Procalcitonin Progesterone Prolactin Protein, Total PTH (must be validated for Intra-operative use) Salicylate Sodium Theophylline Thyroid Specific Hormone (TSH) Transferrin Triglycerides

Troponin I or T; High Sensitivity Troponin I or T Urea Nitrogen Uric Acid Vancomycin Vit D 25OH

The assays listed in Table 3 shall be approved by the FDA for urine samples.

Table 3 – Listing of Assays That Must be Approved for Use with Urine Samples Amylase Calcium (Total)

Potassium Protein, Total

Chloride Creatinine

Phosphorus Inorganic (Phosphate)

Glucose Magnesium Microalbumin (Quantitative)

Sodium Urea Nitrogen Uric acid

The assays listed in Table 4 shall be approved by the FDA for CSF and Body Fluid samples.

Table 4 – Listing of Assays That Must be Approved for Use with CSF and Body Fluid Samples Glucose Protein Lactate

2.7 Mid-Low Patient Testing Volume Analytical Systems

2.7.1 Chemistry System should have ability to perform >= 300 tests per hour depending on method mix. Provide STAT testing capabilities. Allow for multiple tube sizes on same rack without use of adaptors. Provide clot, liquid level detection. Low specimen carryover with minimal requirements for reagents, calibrations and quality control.

2.7.2 Immunoassay System shall perform 60-100 tests per hour, allow loading of 20-40 patient samples with STAT capabilities.

2.7.3 Immunoassay System shall allow liquid ready to use reagents – that do not require pretreatment. Provide large menu for Immunoassay reagents to be tested.

2.7.4 Reagent assays must have valid biotin tolerance threshold of 30 nanograms per ml or higher.

3. Maintenance and Service

3.1 ANCILLARY MAINTENANCE. The Contractor shall be responsible for furnishing maintenance, services, repairs, and parts as required in order to maintain the systems at all locations at a 98% uptime guaranteed. The Contractor shall provide all reagents, calibrators, controls and any other materials necessary to troubleshoot and remedy the reasons for the analyzer failure or malfunction at no additional cost.

3.2 The Contractor shall provide direct customer service and support, 24 hours/7 days a week, to include hotline telephone service (provided in English) and on-call emergency repair service support, to assist operators in correcting equipment operation and IT issues.

3.3 The Contractor shall provide repair service response within 1 hour and technician arrives within 12 hours after notification for routine/ and 4 hours after emergency failures. The Contractor’s qualified service technician shall be on site to provide routine services; service requiring immediate repair; and scheduled services for preventive maintenance, as specified in the Contractor’s instrument maintenance manual and as determined by Laboratory Director.

Performance of Safety checks and calibration included as required by this statement of work.

The equipment shall be repaired and operational within 24 hours after initial response by the Contractor.

3.4 Contractor shall provide two (2) paper and two (2) electronic (CD) copies of the Operator’s and Maintenance manuals and a statement of the warranty terms in the English language per location. The level of detail required of appropriate instrument maintenance manuals extends only to routine maintenance procedures performed by the user. All instrumentation specified is non-Government owned equipment that is provided, serviced, and maintained by the Contractor.

3.5 Contractor shall provide adequate service support for the following areas:

decontamination, relocation, installation management, Lab Process consultants for pre and post workflow analysis, IT Project management for IT implementations and on-going initiatives.

3.6 Periodic Advanced Operator Training/Education must be offered for all levels of staffing (i.e., Manager/Supervisor, Operations-Technical, and Information Systems). The contractor shall provide PACE accredited continuing education to all personnel on relevant Laboratory related topics at minimum bi-annually on-site or via online courses.

3.7 Contractor must provide access to dedicated Sales Specialist for support with establishing standing order schedules for routine delivery of supplies and for managing stat orders.

4. Training

4.1 The Contractor shall provide training for two (2) primary operators per analyzer at the Contractor’s training site, prior to delivery and installation of the analyzer and annually thereafter with each option year. The Contractor shall provide initial on-site operator training to all technicians assigned to the Government site (i.e., BJACH Department of Pathology Laboratory Staff) prior to initiation of use of the analyzer for patient testing. On-site analyzer training shall be provided for up to 8 technicians annually at no additional cost to the Government or individual trainee.

4.2 Contractor shall provide Information Technology type training (e.g. Rules Writing) for two (2) operators per year starting with Base Year and annually thereafter with each option year.

4.3 Periodic Advanced Operator Training/Education must be offered for all levels of staffing (i.e. Manager/Supervisor, Operations-Technical, and Information Systems).

5. Information Technology Management Requirements

5.1 The analyzer system shall be capable of interfacing with the military hospital computer system, i.e., the Military Health System Genesis. The Contractor shall have a driver compatible for interfacing the analyzer with MHS Genesis. The interface between MHS Genesis and the analyzer shall be bi-directional. The contractor shall identify the contractor specific equipment or third-party vendor’s equipment that is able to connect via driver to IT (Middleware) interface;

vendor to include two (2) third party licenses for additional connectivity.

5.2 The analyzer system shall include a data management system for control of the operation of the analyzer system, management of the quality control program, management of the on-instrument useful life of the reagents/reagent packs, and management of patient results; and a printer for the production of hard copy patient reports and other reports generated via the analyzer system’s data management system. The Data Management system shall have a comprehensive, fully integrated Quality Control (QC) software module that stores and evaluates quality control results. Results can be viewed in a variety of formats including Levy-Jennings charts, moving patient averages, CAP connectivity, EP Evaluator, and statistical summaries. The application shall validate QC results by checking them against user selected rules and automatically alert the operator when a rule violation has occurred.

5.3 Data Management system shall have a user friendly " 64bit Microsoft Windows interface or a web browser-based interface. The interface shall include a data management system for operational control of the analyzer system, management of the QC program, on-instrument useful life of the reagents/reagent packs, and management of patient results.

5.4 The software shall provide a single operator interface for workload management, data management, and instrument operational status monitoring. The software controls the operations of the analyzer, monitors the lot number expiration date of on-board reagents and control materials. This shall be accomplished via communication connections between the automation, analyzers, and hospital Laboratory Information System (LIS).

5.5 Remote diagnostics and troubleshooting shall be available using a maintenance application program that allows technical and service specialists at the Contractors technical support center or a field representative to remotely access the instruments to diagnose a problem.

When remote diagnostics not available, vendor shall provide quarterly onsite support and as needed. Quarterly onsite support to consist of 2 days/6 shift minimum or until current IT issue resolved.

5.6 TELECOMMUNICATION - Systems that provide the ability to control instrument software from remote locations are preferred. All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual Private Network (VPN) Business to Business (B2B) gateway.

For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software must be able to pass MITC testing and review and be awarded a Certificate of Net worthiness (CoN) before contract is awarded.

5.6.1 The Contractor shall follow Army Regulation 25-1, “Army Knowledge Management and Information Technology, AR 25-2, “Information Assurance (IA)”, and DoD 6025.18-R, DoD Health Information Privacy Regulation.

5.6.2 In accordance with contract requirements, Contractors shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway.

This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

5.6.3 All costs for VPN hardware and software shall be incurred by the Contractor.

5.6.4 The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chief Information Officer.

5.6.5 The Contractor shall validate that systems authenticate users through the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the vendor's technical users will maintain secure logon.

5.7 DEPARTMENT OF DEFENSE INFORMATION ASSURANCE CERTIFICATION

AND ACCREDITATION PROCESS (DIACAP) IMPLEMENTATION PLAN

5.7 1 The Contractor shall provide all required information to support and initiate the DIACAP Implementation Plan. This shall include the required information for the System Identification profile.

5.7 2 The Contractor shall provide information for the Risk Assessment Analysis to the Government for all networking IT applicability.

5.8 SECURITY CLEARANCES

5.8.1 Personnel to be assigned to an Automated Data Processing (ADP)/IT position shall undergo a successful security screening before being provided access to DoD information technology resources. Prior to an employee being granted interim access to DoD sensitive information, BJACH shall receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement shall be met by Contractors, subcontractors and other who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under HIPPA.

Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees shall have at a minimum an ADP Sensitivity Designation of Level II to access the DoD Network.

5.8.2 All Contractors that use the DoD gateways to access Government systems shall submit a DISA Form 41 or equivalent in accordance with COR guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface. Contractors shall complete and submit to TMA one Form 41 for their organization, attached to which shall be a listing of those individuals for whom background checks have been completed, submitted to the OPM, and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request shall clearly delineate the ports and protocols used for each Internet Protocol (IP) address. The Contractor shall complete the form and submit to the Government for final processing.

5.8.3 All costs for the Contractors employee background investigations are the responsibility of the Contractor, unless the investigation is completed by the Government, which would be at no cost to the Contractor.

5.8.4 The terms and conditions of this clause shall be completed no later than three (3) months post award.

6. BUSINESS TO BUSINESS (B2B) PARTNERS AND 3rd PARTY VENDORS

6.1 General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow. Vendors must ensure ability to conform to all standards set forth by Department of Defense Risk Management Framework.

6.1.2 PERSONNEL SECURITY.

6.1.2.1 The Contractor shall comply with the following:

• DoD Directive 8500.1, “Information Assurance (IA)”

• DoD Instruction 8500.2, “Information Assurance (IA) Implementation”

• DoD Directive 5400.11, “DoD Privacy Program”

• DoD 6025.18-R, “DoD Health Information Privacy Regulation”

• DoD 5200.2-R, “Personnel Security Program Requirements”

• Local regulations as deemed appropriate by the Information Assurance Officer

• AR 25-1, “Army Knowledge Management and Information Technology”

• AR 25-2 “Information Assurance”

• AR 525-13 Antiterrorism

• AR 530-1 Operations Security (OPSEC)

6.1.2.2 Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

6.1.2.2.1 Follow the DoD guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT- III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

6.1.2.2.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility local area network (LAN).

6.1.2.2.3 Immediately report to the MTFs Security Office and deny access to any automated information system (AIS), network, or information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for any reason.

6.1.2.2.4 Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

6.1.2.3 AT Level 1 Training. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities, and controlled access areas shall complete AT Level 1 training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR, or to the Contracting Officer, if a COR is not assigned, within 10 days after completion of training by all employees and subcontractor personnel. AT Level 1 Awareness Training is available at the following website: https://atlevel1.dtic.mil/at.

6.1.2.4 Access and General Protection/Security Policy and Procedures. Contractor and all associated sub- contractor employees shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce shall comply with all personal identity verification requirements as direct by DOD, HQDA, and or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

6.1.2.5 OPSEC Training. Per AR 530-1, Operations Security, new contractor employees shall complete Level 1 OPSEC training within 30 calendar days of their reporting for duty. All contractor employees shall complete annual OPSEC awareness training.

6.2. ELECTRONIC SECURITY

6.2.1 Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of BJACH shall operate in accordance with controlling laws, regulations, DoD, and local policy.

6.2.2 Certification & Accreditation (C&A) requirements apply to all DoD and Contractor’s IS/networks that receive, process, display, store or transmit DoD information. The Contractor shall comply with the C&A process for safeguarding IS. Certification is the determination of the appropriate level of protection required for IS/networks. Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

6.2.3 Accreditation is the formal approval by the Government to operate the Contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable https://atlevel1.dtic.mil/at level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections, and with appropriate level of protection for the specified period.

6.2.4 The contractor shall comply with C&A requirements, as specified by the Army that meet appropriate Army Information Assurance requirements. The C&A requirements shall be met before the contractor's system is authorized to access Army data or interconnect with any Army IS/network that receives, processes, stores, displays or transmits Army data. The contractor shall initiate the C&A process by providing the Contracting Officer Representative, within 60 days following contract award, the required documentation necessary to receive an Approval to Operate (ATO). The contractor shall make their IS/networks available for the testing, and initiate the C&A testing four months (120 days) in advance of accessing Army data or interconnecting with Army IS/networks. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

• Attending and supporting C&A meetings with the Government

• Supporting/conducting the vulnerability mitigation process

• Supporting the C&A Team during system security testing

6.2.5 Contractors shall confirm that their networks are locked down prior to initiating testing.

6.2.5.1 Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

6.2.5.2 Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

6.2.6 Any re-configuration or change in the system during the C&A testing process shall require a re-base lining of the system and documentation of system changes. Some changes will necessitate a pause in work depending on the severity and impact of change and determined by the COR in conjunction with the IA representative. Vulnerabilities that have been identified by the Army as “must fix” issues during C&A process must be mitigated according to the timeline identified by the Army Representative. C&A checklists are provided for complying Army C&A requirements. A request for a waiver to the C&A requirements may be submitted for temporary testing and other unusual circumstances. A waiver request must be submitted, in writing, to the Designated Approving Authority. The request must include mitigation strategies that ensure adequate protection measures and security controls are in place.

6.2.7 Disposing of Electronic Media. Contractor shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance Army Regulation 25-2, “Information Assurance” and Army Best Business Practices (BBP), “Reuse of Computer Hard Drives.”

6.2.8 Information Assurance Vulnerability Management (IAVM). The Contractor shall implement an information assurance vulnerability management program. The Army IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to MEDCOM systems. As part of the program, the contractor shall provide a primary and secondary point of contact for IAVM compliance reporting. The contractor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance to the MEDCOM IA Operations point of contact. Receipt and compliance messages to MEDCOM shall occur within the stipulated window, as stated in the vulnerability message. Guidance regarding the requirement for IAVM is contained in the Army Regulation 25-2, “Information Assurance” and Army Regulation 25-1, “Army Knowledge Management and Information Technology.” An asset is defined as any hardware devise, such as a router, firewall, server, or an operating system image accessed by more than one user. The MEDCOM IASO list servicer is the primary means to disseminate IAVAs, Information Assurance Vulnerability Bulletins (IAVBs), and Information Assurance Technical Advisories down to the System Administrator (SA) and applicable personnel throughout the chain of command. Requests to be added to the IASO list server should be sent to medcom.ia@amedd.army.mil.

6.2.8.1 The contractor shall maintain any development environments in accordance with MEDCOM Information Assurance (IA) best practices and operational requirements. During product development for the Army, the contractor shall ensure that all IA mitigation strategies have been applied to the development environment prior to any Army data being loaded onto any assets or software for testing or delivery. IA mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the Army shall be in compliance with all known applicable Army Computer Emergency Response Team (ACERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

6.2.8.2 Ports Protocols and Services. Contractors shall follow all current Army standards and requirements for acceptable Ports, Protocols, and Services. Any requests for exception to using the current Army Ports, Protocols, and Services standards requires a request for exception sent through the Program Manager at the DAA.

6.2.8.3 Public Key Infrastructure and Encryption. Contractors shall follow the Army standards, policies, and procedures related to the use of the Public Key Infrastructure (PKI) certificates and biometrics for positive authentication. Where interoperable PKI is required for mailto:medcom.ia@amedd.army.mil the exchange of unclassified information between the Army and its contractors and contractors, industry partners shall obtain all necessary certificates. Contractors must turn over to the Army all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support. The Contractor must provide a written report detailing all of the above, prior to task order expiration regardless of modifications or extensions.

6.3 INFORMATION SYSTEMS (IS)/NETWORKS PHYSICAL SECURITY.

6.3.1 The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor shall support a Physical Security Audit performed by the Government of the Contractor's internal information management infrastructure.

6.3.2 The MHS Physical Security Audit Matrix is available at:

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20ve rsion.xls.

6.3.3 The Contractor shall correct any deficiencies identified by the Government of the Contractor's physical security posture. New Army policies will be posted to the following website: http://www.apd.army.mil.

6.4 SPECIAL REQUIREMENTS FOR PROTECTED HEALTH INFORMATION.

6.4.1 The contractor shall ensure that data which contains PHI is continuously protected from unauthorized access, use, modification, or disclosure. The contractor shall comply with all previously stated requirements for HIPAA, Personnel Security, Electronic Security, and Physical Security.

6.4.2 Notify the MTF HIPAA Security Manager.

6.4.3 Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

7. PROGRAM MANAGEMENT

7.1 GENERAL. The Contractor shall provide comprehensive Program/Project Management services.

7.2 Program Manager (PM). The Contractor shall provide a dedicated PM, who shall be responsible for the initial instrument implementation, instrument upgrades, implementation of new methods or procedures and optimization of workflow processes and procedures.

http://www.apd.army.mil/

7.2.1 The PM, and an alternate who shall act for the Contractor when the PM is absent, shall be designated in writing to the Contracting Officer and Contracting Officer Representative (COR) within 10 days of contract award.

7.2.2 The PM and alternate PM shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract.

7.2.3 The PM and/or alternate shall be actively engaged in all aspects of this SOW.

7.2.4 The Contractor shall provide an Information Technology Project Manager for implementation of the instrument interface and middleware.

7.2.4.1 The IT PM shall have demonstrated working knowledge of Information Security Requirements specific to DoD installations as detailed in Section 6 of this SOW.

7.2.4.2 The IT PM shall have a demonstrated working knowledge and competency in the installation, troubleshooting and development of the instrument interface requirements as they relate to MHS Genesis.

7.2.5 The PM or alternate PM shall be available during normal duty hours to meet on the installation with Government personnel (designated by the Contracting Officer) to discuss problem areas. After normal duty hours, the manager or alternate shall be available within 48 hours.

7.2.6 The PMs (both PM and IT PM) shall hold current certification as a Project Management Professional (PMP) through a nationally recognized accrediting agency (e.g. The Project Management Institute). Certificates shall be provided to the Government upon appointment to this contract.

7.2.7 The PMs shall have a working knowledge of the Government Extension to the PMBOK® (Project Management Body of Knowledge) Guide-Third Edition, as it applies to the Government sector.

7.2.8 The PM and IT PM shall not have other assigned Sales, Field Services or Technical Service responsibilities.

7.3 Specific instrument layout and selection of pre-analytic, post-analytic and track delivery systems will be determined by a detailed, comprehensive workflow analysis.

7.3.1 The workflow analysis shall be conducted IAW commonly accepted industry standards for maximizing efficiency as outlined in the PMBOK® Guide 3rd Ed, and Lean/Six Sigma principles.

7.3.2 The workflow analysis shall focus on maximizing efficiency, menu and throughput, and minimizing turn- around-times.

8. Administrative Requirements

8.1 Within 10 working days after contract award, Contractor shall coordinate and conduct a post award site visit for the purpose of coordinating schedule for equipment installation.

Additionally, the installation of equipment may need to be performed in a phase process at no additional cost to the government.

8.2 The Contractor shall provide safety data sheets (SDS) for each item delivered under this contract considered to be HAZARDOUS MATERIAL by the Government. The SDS shall contain information on the hazards associated with each specific chemical or material. The SDS shall be printed in the English language and shall contain at minimum the following information:

identification of specific hazard, the required practice for safe use of the product, first aid procedures, and what to do in the event of a spill or other mishap or accident. Provide an effluent waste report for all materials that are disposed in the sewage system by the instrument.

9. Delivery and Installation of Equipment:

9.1 The Analyzers shall (must) be delivered to the location(s) as indicated below and match renovation timeframes as indicated during post-award site-visit. Equipment setup, on-site training, review and set up of initial Method Validations per CLIA/NCCLS/DPALS QM guidelines, to include method correlation, linearity verification to maximum dilution, precision, carry-over, normal reference range validation, serum/plasma and blood collection tube validation, shall be started by Contractor personnel within 30 days of contract award to ensure that equipment is fully operational within determined timeline.

During the initial implementation, a dedicated technical representative must be available onsite throughout the entire implementation period and during go-live. Expected completion of installation and implementation is 90 days. Extensions to be considered and/or granted based on review of detailed implementation plan with Department of Pathology.

9.2 PRIMARY LOCATIONS OF COMPLETE SYSTEMS: System(s) shall be delivered and installed at the location listed below:

Bayne Jones Army Community Hospital Department of Pathology and Laboratory Services Core Chemistry Laboratory 1585 3rd St, Fort Johnson, LA 71459 The Point of Contact (POC) for all deliveries:

MSG Cortez, Hector: hector.e.cortez.mil@health.mil Ms. Harris-Williams (Angie): angela.m.harrell-williams.civ@health.mil

9.3 Exact installation locations at the primary locations shall be coordinated by the Contractor with the point of contacts listed below. A memorandum on Contractor’s letter head will also be provided to the individual below at the time of installation that includes all serial numbers, mailto:hector.e.cortez.mil@health.mil…