STATEMENT OF WORK

BD ALARIS MANAGEMENT SERVER IMPLEMENTATION & MANAGEMENT BLANCHFIELD ARMY COMMUNITY HOSPITAL (BACH)

1. Introduction This Statement of Work (SOW) outlines the requirements for the Contractor to implement the BD Alaris Management Server and integrate it with existing BD Alaris infusion pumps at Blanchfield Army Community Hospital (BACH). The successful implementation of this system is crucial for improving operational efficiency, enhancing patient safety, and ensuring compliance with regulatory requirements.

2. Background BACH currently utilizes BD Alaris infusion pumps to deliver medications and fluids to patients. Operating these pumps in a standalone configuration presents significant challenges, including manual drug library updates, inconsistent device configurations, and a lack of centralized monitoring capabilities. The BD Alaris Management Server offers a solution to these challenges by providing centralized management, configuration, monitoring, and maintenance of the infusion pumps.

3. Scope The Contractor shall provide all necessary personnel, equipment, materials, and services to successfully implement the BD Alaris Management Server and integrate it with BACH's existing BD Alaris infusion pumps.

The Contractor shall perform all tasks in accordance with industry best practices, manufacturer’s recommendations, and all applicable regulations and standards.

The Contractor shall work closely with BACH personnel to ensure that the implementation is completed smoothly and efficiently, with minimal disruption to clinical operations.

4. Detailed Requirements

a. Project Management

(1) The Contractor shall designate an experienced project manager to serve as the primary point of contact for this project.

(2) The Contractor’s project manager shall be responsible for developing and maintaining a detailed project plan, including timelines, milestones, and resource allocation.

(3) The Contractor’s project manager shall conduct regular status meetings with BACH personnel to provide updates on project progress and address any issues or concerns.

CUI//SP-PROCURE// FED ONLY

b. System Configuration

(1) The Contractor shall remotely install the virtual machine in BACH’s virtualized server environment.

(2) The Contractor shall install and test the Software functions in accordance with the applicable DFUs.

(3) The Contractor shall assist BACH with installing their anti-virus and backup software on BACH’s server.

(4) The Contractor shall create a customized network configuration file for the Alaris System.

(5) The Contractor shall test network connectivity between the Alaris System and Alaris Systems Manager.

(6) The Contractor shall comply with the software for “the Alaris System and BD Alaris™ Systems Manager software and (b) the immediately-preceding version of the Guardrails™ Suite MX Software (unless more than two (2) versions of the Guardrails™ Suite MX Software are released within the last twelve (12)-month period, in which case CareFusion will provide support for all Software versions of the Guardrails™ Suite MX software released within such period).”

c. Integration with Existing Infusion Pumps

(1) The Contractor shall integrate the BD Alaris Management Server with BACH's existing BD Alaris infusion pumps, ensuring seamless communication and data exchange.

(2) The Contractor shall ensure that all infusion pumps are properly configured and updated with the latest drug libraries and safety protocols.

d. Security Configuration

(1) The Contractor shall implement all necessary security measures to protect the BD Alaris Management Server and the infusion pumps from unauthorized access and cyber threats.

(2) The Contractor shall ensure that the system complies with all applicable DHA cybersecurity requirements and BACH security policies, including eMASS ID: 3982.

(3) The Contractor shall maintain 802.11 compliant wireless network (2.4 GHz and/or 5GHz) at the customer's site that meets the wireless network requirements;

(4) The Contractor shall comply with the following:

(a) no Group Policies will be applied to the servers unless approved in writing by CareFusion

(b) no Group Policies with the “No Override” setting enabled at any level above the servers will exist

(c) for installation in Customer’s Active Directory, a separate Organizational Unit (OU) called “Alaris” must be created

(d) user account called “AlarisAdmin” must be created within Customer’s domain.

e. Data Migration

(1) The Contractor shall migrate all existing data from the standalone infusion pumps to the BD Alaris Management Server, ensuring data integrity and accuracy.

(2) The Contractor shall validate that all data has been successfully migrated and is accessible through the BD Alaris Management Server interface.

f. Training

(1) The Contractor shall provide comprehensive training to BACH personnel on the use of the BD Alaris Management Server, including system administration, pump configuration, data analysis, and troubleshooting.

(2) The Contractor shall provide training materials, including user manuals and quick reference guides, to all trained personnel.

g. Testing

(1) The Contractor shall conduct thorough testing of the BD Alaris Management Server and integrated infusion pumps to ensure that all systems are functioning properly and meeting performance requirements.

(2) The Contractor shall perform functional testing, integration testing, and user acceptance testing.

(3) The Contractor shall document all test results and provide them to BACH for review and approval.

h. Documentation

(1) The Contractor shall provide complete and accurate documentation of the BD Alaris Management Server implementation, including system configuration, integration details, testing results, and training materials.

(2) The Contractor shall provide a detailed "As-Built" document that outlines the exact configuration of the system.

5. Key Performance Indicators (KPIs) The success of this project will be measured based on the following KPIs:

Reduction in Time Required for Drug Library Updates: Achieve a 90% reduction in the time required for drug library updates within six months of implementation.

Compliance with DHA Cybersecurity Requirements: Achieve 100% compliance with DHA cybersecurity requirements for all Alaris infusion pumps within one year of implementation. Decrease in Device Failures: Decrease the number of device failures by 25% within one year of implementation.

Reduction in Medication Errors: Reduce medication errors related to infusion pumps by 15% within one year of implementation.

System Uptime: Maintain a system uptime of 99.9%, excluding scheduled maintenance windows (to be coordinated with BACH).

6. Deliverables The Contractor shall provide the following deliverables:

Project Plan System Configuration Documentation Data Migration Plan Training Materials Test Results As-Built Document Weekly Status Reports Security Configuration Documentation

7. Acceptance Criteria The BD Alaris Management Server implementation will be considered complete and accepted by BACH when the following criteria have been met:

All systems are functioning properly and meeting performance requirements and cyber security compliant.

All data has been successfully migrated and validated.

All BACH personnel have been trained on the use of the system. All documentation has been delivered and approved by BACH.

The customer provides and executes a Confirmation Form verifying satisfaction and completion. (Source: DHA Blanchfield Army Hospital_10064981_Server_MMS-28609.pdf)

8. Period of Performance The period of performance for this contract is [TBD]

9. Place of Performance The primary place of performance for this contract is Blanchfield Army Community Hospital (BACH), Fort Campbell, KY. Remote configuration may be performed off-site.

10. Government Furnished Information (GFI) The Government will provide the following:

A System Administrator who will assist vendor with software installation on BACH's virtualized server environment and network infrastructure.

A designated point of contact for coordination and communication. Physical access to the facility for on-site personnel.

11. Contractor-Furnished Items and Services The Contractor shall furnish all necessary personnel, equipment, materials, software licenses, and services to perform the work required under this SOW.

The Contractor shall be responsible for providing all necessary tools, test equipment, and safety equipment.

12. AT/OPSEC & Security Requirements:

The Contractor shall comply with all applicable federal, DoD, and DHA security regulations and policies.

The Contractor shall implement appropriate security measures to protect government data and systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

AT/OPSEC requirements:

Antiterrorism/Operations Security (AT/OPSEC) Requirements In accordance with applicable Department of Defense (DoD), Department of the Army (DA), and Defense Health Agency (DHA) regulations and policies, the Contractor shall adhere to the following Antiterrorism (AT) and Operations Security (OPSEC) requirements: Access and General Protection/Security Policy and Procedures: The Contractor and all associated sub- contractor employees shall provide all information required for background checks to meet installation access requirements as directed by the BACH Provost Marshal Office, Director of Emergency Services, or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, HQDA and/or local policy. The Contractor acknowledges that should the Force Protection Condition (FPCON) at BACH change, the

Government may require changes in contractor security matters or processes. Since access to a DoD facility is required, but a CAC is not required, contractor and sub-contractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative).

AT Level I Training: All Contractor employees, including sub-contractor employees, requiring access to Blanchfield Army Community Hospital (BACH) shall complete AT Level I awareness training within 30 calendar days after the contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the Government Point of Contact (as defined in Section 17 of this SOW) within 7 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: http://jko.jten.mil .

iWATCH Training: The Contractor and all associated sub-contractors shall brief all employees on the local iWATCH program. This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the Government Point of Contact (as defined in Section 17 of this SOW). This training shall be completed within 30 calendar days of contract award and within 7 calendar days of new employees commencing performance with the results reported to the Government Point of Contact (as defined in Section 17 of this SOW) NLT 7 calendar days after contract award.

Joint Knowledge Online (JKO) Training: All Contractor employees with access to a government information system (as potentially required for remote configuration or system maintenance) must be registered in JKO at commencement of services and must successfully complete the Cyber Awareness challenge and HIPAA training prior to access to the IS and then annually thereafter training is available at the following website: http://jko.jten.mil.

OPSEC Awareness Training: Per AR 530-1 Operations Security, the Contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

IA/IT training. All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working in IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of appointment to IA/IT functions.

IA/IT certification. Per DoD 8570.01‐M , DFARS 252.239.7001 and AR 25‐2, the contractor employees supporting IA/IT functions shall be appropriate.

certified upon contract award. The baseline certification as stipulated in DoD 8570.01‐M must be completed upon contract award.

Data Security: The contractor must not store or transmit any BD Alaris or BACH data on Personally Owned Equipment (POE). All applicable data must be stored and transmitted on government owned equipment and encrypted if necessary.

Handling of Sensitive Information: Due to the nature of this project involving integration with medical devices and access to patient-related information, the Contractor acknowledges the need for heightened OPSEC measures. The Contractor shall protect sensitive information, including, but not limited to:

System configurations and network diagrams User credentials and access control lists Security protocols and encryption keys Data migration procedures Patient data (if accessed during testing or troubleshooting) OPSEC Plan Requirement: The contractor will develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1.

The contractor acknowledges that failure to comply with these AT/OPSEC requirements may result in termination of the contract for default.

13. Travel Travel may be required for on-site implementation, training, and troubleshooting. All travel expenses shall be in accordance with the Federal Travel Regulation (FTR).

14. Payment Payment will be made upon successful completion of milestones and deliverables, as outlined in the contract pricing schedule.

The Government reserves the right to withhold payment for any work that does not meet the requirements of this SOW.

15. Applicable Documents and Standards The Contractor shall comply with the following documents and standards: HIPAA Privacy and Security Rules DHA Cybersecurity Policies and Procedures Federal Acquisition Regulation (FAR) Federal Travel Regulation (FTR) Alaris Federal Terms and Conditions Terms of the Implementation

Industry best practices for system implementation and security

16. Reporting Requirements The Contractor shall provide the following reports:

Weekly status reports summarizing work completed, milestones achieved, and any issues encountered.

Monthly progress reports detailing system performance, usage, and any identified issues. Incident reports detailing any security incidents or system failures, including root cause analysis and corrective actions taken.

A final project report summarizing the entire implementation process and its outcomes.

[End of Statement of Work]