PWS_-_RFI.pdf

PERFORMANCE WORK STATEMENT (PWS) - DRAFT

Title: Nutrition Management Information System (NMIS) Sustainment/maintenance and training support for the

Computrition Hospitality Suite commercial-off-the-shelf (COTS) software

Requiring Activity Name: Defense Health Agency, Solution Delivery Division (SDD), Clinical Support Branch

(CSB)

1.0 SCOPE

This Performance Work Statement (PWS) provides for software, software sustainment/maintenance and training services, software and training materials, and contract management deliverables to maintain an Automated

Information System (AIS) that provides Nutrition Management Information System (NMIS) functionality described herein. The contractor shall accomplish bi-annual database quality reviews of each military treatment facility

(MTF)/site production database and perform technical support of the software and interface with the MHS

Electronic Health Record (EHR) as necessary.

1.0.1 Background

The legacy NMIS application, a Government Off-the-Shelf (GOTS) solution, was originally deployed in 1995.

Technologically did not keep pace with United States Department of Agriculture (USDA) food related standards and patient safety requirements. After conducting extensive market research, Defense Medical Logistics Standard

Support (DMLSS) management came to the conclusion that the purchase of a Commercial Off-the-Shelf (COTS)

AIS would provide all of the required functionality at a fraction of the cost of developing/updating the same functionality on the legacy application. As a result, the NMIS Project Office (PO) acquired and deployed the

Computrition Hospitality Suite software to all NMIS sites in 2009. The PO has a requirement to maintain the software and provide sustainment/maintenance and training support to the user community.

1.0.2 Objectives

The objective of this PWS is to award a contract that provides for sustainment/maintenance and training support of the Computrition Hospitality Suite AIS, which provides the functionality to support medical nutrition management and foodservice operations management. The AIS must include a fully integrated Foodservice Operations

Management (FOM) module which functions as a “back of house” automated foodservice management system and a fully integrated Nutrition Care Management (NCM) module that supports select and non-select tray ticket and room service meal delivery systems at all MTFs providing inpatient care. The COTS system must also include a Pending

Diet Orders module, Enterprise Time Zone module and maintenance/sustainment of the interface with the

CliniComp® Clinical Information System (CIS) Electronic Health Record (EHR), MHS Genesis (Cerner) EHR, and/or other source EHR as selected by the government. The contractor shall provide:

Software licenses

Software maintenance services

Training services

Database quality review services

1.1 Non-Personal Services

This award identifies services that are strictly non-personal in nature.

1.2 Severable / Non-Severable Services

This award identifies services that are severable in nature.

1.3 Inherently Governmental Functions

This requirement has been reviewed and contains no services that are inherently governmental functions.

1.4 Acquisition Functions Closely Associated with Inherently Governmental Functions

Not applicable for this task.

1.5 Organizational Conflict of Interest (OCI) Category

The Defense Health Agency (DHA) has categorized all its non-purchased care requirements into three broad categories, as defined below, for purposes of identifying, avoiding or mitigating against OCIs in accordance with

FAR Subpart 9.5. These categories are defined as follows:

Category 1: DHA Internal Support: Services which, by their very nature, give the Contractor access to potential requirements and extensive data about Category 2 and Category 3 contractors.

Category 2: Program Management Support: Services which assist DHA in planning and managing its activities and programs. This includes, for example: requirements analysis, acquisition support, budget planning and management, business process reengineering, program planning and execution support, and independent technical management support.

Category 3: Product Support. Services or end items required to meet the mission requirements of DHA’s non-purchased care activities and programs. This includes, for example: concept exploration and development; system design; system development and integration; Commercial Off-The-Shelf (COTS) procurement and integration; internal development testing; deployment; installation; operations; and maintenance.

Contractor participation in more than one of these areas may give rise to an unfair competitive advantage resulting from access to advance acquisition planning, source selection sensitive or proprietary information. Furthermore, Contractor participation in more than one area may give rise to a real or apparent loss of Contractor impartiality and objectivity where its advisory or planning assistance in one area potentially affects its present or future participation in another area.

The purpose of this categorization is to accomplish the following three objectives: (1) to inform prospective

Offerors that DHA presumes that award of a contract or order in the subject category will give rise to real or apparent OCIs with respect to requirements in the other two categories; (2) to assist current Contractors and prospective Offerors in developing their own business strategies regarding participation in DHA requirements and in identifying and, where possible, avoiding or mitigating against OCIs; and (3) to ensure that all current Contractors and prospective Offerors are afforded the maximum practicable opportunity to compete for all DHA requirements consistent with the restrictions required under FAR Subpart 9.5 and sound business practices.

For purposes of identifying, avoiding and /or mitigating against OCIs, DHA will examine all its non-purchased care requirements and acquisitions regardless of the cognizant contracting activity or the type of contract vehicle used.

Each DHA non-purchased care solicitation will therefore be designated as falling within one of the three above defined categories. The work called for under this contract /order has been determined by DHA to fall within the following non-purchased care OCI category:

Category 3: Product Support

2.0 STATEMENT OF WORK (SOW)

2.1 Task Management

The Contractor shall provide sufficient management to ensure that this task is performed efficiently, accurately, on time, and in compliance with the requirements of this document. Specifically, the Contractor shall designate a single manager to oversee this task and supervise staff assigned to this task. The Contractor shall ensure that a

Monthly Progress Report (MPR) is submitted outlining the expenditures, billings, progress, status, and any problems/ issues encountered in the performance of this task.

2.1.1 Monthly Progress Report (MPR) – Deliverable 2

The Contractor shall ensure that a MPR (Deliverable 2) is submitted with a summary of the services provided for the month, a forecast of the next month’s activities, accounting of Other Direct Costs (ODCs), a list of risks/issues identified by the Contractor during training and/or database quality reviews, Service Desk Report with a summary of tickets received/resolved/unresolved, and metrics to measure the Contractors ability to meet the requirements specified in the Performance Requirements Summary Matrix (section 6.8.2.) in a format approved by the

Contracting Officer’s Representative (COR).

2.1.2 Subcontractor Expenditures Report – Deliverable 3

2.1.3 Contract Work Breakdown Structure (CWBS) – Deliverable 4/Deliverable 5

2.1.4 Integrated Master Schedule – Deliverable 6

2.1.5 Earned Value Management (EVM) – Deliverable 7/Deliverable 8

2.1.6 Transition Support

a. Incoming Transition Plan– Deliverable 9

b. Option Item: Outgoing Transition Plan – Deliverable 10

2.1.7 Program Management

Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal

Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

2.1.8 Quality Control Plan (QCP) – Deliverable 12

The Contractor shall prepare and adhere to a QCP (Deliverable 12). The QCP will initially be submitted with the vendor’s quote and shall be updated following award. The QCP shall document how the Contractor will meet and comply with the quality standards established in this statement of work. At a minimum, the QCP must include a self-inspection plan, an internal staffing plan, and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, customer satisfaction, and any other requirements set forth in the

Performance Requirements Summary Matrix (section 6.8.2). The Contractor shall provide the metrics required to measure performance in the MPR.

2.1.9 Contingency Operations Plan – Deliverable 13

The Contractor shall develop and submit a Contingency Operations Plan (Deliverable 13) to the Government.

The Contingency Operations Plan shall be due ten (10) calendar days after the award of the order, and will be updated on an annual basis. The Contingency Operations Plan shall document Contractor plans and procedures to maintain DHA support during an emergency. The Contingency Operations Plan shall include the following:

A description of the Contractor’s emergency management procedures and policy

A description of how the Contractor will account for their employees during an emergency

Planned temporary work locations or alternate facilities

How the Contractor will communicate with DHA during emergencies

A list of primary and alternate Contractor points of contact, each with primary and alternate:

Telephone numbers

E-mail addresses

Procedures for protecting GFE (if any)

Procedures for safeguarding sensitive and/or classified Government information (if applicable)

2.1.10 Operations During Emergency Situations

Individual contingency operation plans shall be activated immediately after determining that an emergency has occurred, shall be operational within twelve (12) hours of activation, and shall be sustainable until the emergency situation is resolved and normal conditions are restored or the contract is terminated, whichever comes first. In case of a life threatening emergency, the COR shall immediately make contact with the Contractor Task Manager to ascertain the status of any Contractor personnel who were located in Government controlled space affected by the emergency. When any disruption of normal, daily operations occur, the Contractor Task Manager shall promptly open an effective means of communication and verify:

Key points of contact (Government and Contractor)

Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.)

Essential work products expected to continue production by priority

The Contractor Task Manager, in coordination with the COR, must make use of the resources and tools available to continue DHA contracted functions to the maximum extent possible under emergency circumstances. The

Contractor must obtain approval from the COR and CO prior to incurring costs over and above those allowed for under the terms of this contract. Regardless of contract type, and of work location, Contractors performing work in support of authorized tasks within the scope of their contract shall charge those hours accurately in accordance with the terms of this contract.

2.1.11 Contractor Personnel Performance/Replacement

2.2 Specific Tasks

2.2.1 AIS Software and Service Level Agreement – Deliverable 16

The contractor shall deliver licensing for AIS software and a maintenance service level agreement (Deliverable 16) for a Nutrition Management AIS that possesses the following capabilities and functionality:

A fully integrated Medical Food Management (MFM) module which shall function as a “back of house” automated foodservice management system and be comprised of at least the following sub-modules:

Ingredients

Recipes

Food Items

Meals

Inventory Management

Forecasting

Production Planning

Accounting

Hazard Analysis and Critical Control Points (HACCP)

Bar Coding

A fully integrated Medical Nutrition Therapy (MNT) module that supports select and non-select tray ticket and room service inpatient meal delivery systems at all MTFs. The fully integrated MNT module shall be comprised of at least the following sub-modules:

Room Service

Patient Cardex

Allergy Screening

Nutrient Analysis

No hold/Late trays

Pending Diet Orders - The Contractor shall provide a method to cue, or hold multiple sequential diet order prescriptions that are received from the EHR and automatically change the diet order within the NCM according to when, chronologically this diet order is to be enforced. An example would be for the doctor to order an “NPO after midnight” to enable fasting type test to be conducted the next day.

Enterprise Time Zone - The Contractor shall provide the ability for a single database (DB) server that has multiple schemas over multiple time zones to set the time zone according to each schema’s specific geographical time zone. An example would be for a Regional DB server located in San Antonio, Texas

(CDT) to be used in Tacoma, Washington (PDT) with the PDT schema synced to the correct local time enabling patient feeding times to be correct even though the DB server is located in a different time zone.

In addition, maintenance/sustainment of the interface with CliniComp® Clinical Information System (CIS)

Electronic Health Record (EHR) and/ or the MHS Genesis (Cerner) EHR will be required. The CIS HL7 unidirectional interface to the Nutrition AIS software is required at 43 sites. The Nutrition AIS software

HL7 interface engine must provide continuous data transmission from CIS for at least the following data elements:

Name

Rank

Title

Family Member Preference (FMP) Social Security Number (SSN)

Department of Defense (DoD) Electronic Data Interchange Person Number (EDIPN)

Religion

Allergies

Date of Birth

Diagnosis

Height

Weight

Diet Orders

Ward/Room/Bed Assignments

2.2.2 Static and Dynamic Code Baseline Analysis Reports – (Deliverable 18)

The Government requires that the provider conduct a dynamic and static analysis for all applications and their respective code baselines through the use of such tools as Fortify 360® and WebInspect. The baseline findings, contractor analysis, and recommended plan for remediation will be submitted to the government for each new product release and in accordance with the DoD Risk Management Framework process (Deliverable 19).

2.2.3 MHS GENESIS Data Build – (OPTIONAL TASK 1 – Deliverable 19)

The contractor shall provide data entry support for each MTF NMIS schema to prepare for the MHS GENESIS implementation. Data entry shall include the diet orders and restrictions table, room locations table and allergy table.

Ideally, this data entry work will coincide with an on-site visit for the database quality review to ensure the site is prepared for the transition to the MHS GENESIS Electronic Health Record (EHR). The contractor shall submit an after action report for each completed DB schema (Deliverable 20)

2.2.4 OPTIONAL TASK 2 - Bedside Connect Module Capability - AIS Software (Deliverable 20)

The contractor shall provide a DoD cybersecurity compliant software module with the capability for the MTF user to connect to the Nutrition Management Information System (NMIS) using a tablet device. The software shall provide the capability for the MTF user to:

Order patient meals at bedside using a tablet

Enter patient likes, dislikes an d allergies using a tablet

View meal nutrient content as choices are made on a tablet

Save patient lists to tablet

Edit patient information in database using tablet

View patient lists on tablet to determine missing meal orders

Order guest meals using a tablet

The contractor shall provide implementation support and an annual software license maintenance agreement for the

MTF sites equipped with tablets to use with the software.

2.2.5 OPTIONAL TASK 3 - Tray Tracking Module Capability - AIS Software (Deliverable 21)

The contractor shall provide a DoD cybersecurity compliant software module with the capability for the MTF user to track meal counts, patient and guest tray delivery and retrieval, and nutrition management production workflow.

The contractor shall provide implementation support and an annual software license maintenance agreement.

2.2.6 OPTIONAL TASK 4 - Television (TV)/Monitor Meal Ordering Module Capability - AIS Software

(Deliverable 22)

The contractor shall provide a DoD cybersecurity compliant software module with the capability for the MTF inpatient to order meals from the in-room television (TV) or monitor. The software shall display clinically specified menus to the patient on the in-room TV/Monitor. The software shall allow the patient to select from the menu options using the TV/Monitor remote control.

The contractor shall provide implementation support and an annual software license maintenance agreement for

MTFs equipped with the Infotainment System required for the software.

2.2.7 OPTIONAL TASK 5 - Inventory Management Capability - AIS Software (Deliverable 23)

The contractor shall provide a DoD cybersecurity compliant software module with the capability for users to track inventory using a mobile device. The software will include functionality for users to track floor stocks, bulk nourishment, and items sent to the provider’s lounge. Users shall have the capability to perform requisition out management, create delivery requirement pull sheets, pre-fill requisitions, develop templates with par level information, and electronically sign delivery confirmation.

The contractor shall provide implementation support and an annual software license maintenance agreement.

2.2.8 OPTIONAL TASK 6 - Web interface Menu Display on Mobile Device Module Capability - AIS

Software (Deliverable 24)

The contractor shall provide a DoD cybersecurity compliant software module with the capability for users to view dining facility/cafeteria menu selections on mobile devices such as a laptop, tablet or smartphone. The software capability shall display menu selections that include complete nutritional facts and possible allergens associated with each selection.

The contractor shall provide implementation support and an annual software license maintenance agreement.

2.2.9 AIS Software Support Services

In addition to providing the Nutrition AIS software, the Contractor shall:

enforce software development standards and best practices to meet DoD cybersecurity controls assist the NMIS PO with configuration of the Nutrition AIS to allow it to operate over existing DoD networks provide technical assistance to the NMIS PO during any deployment of the Nutrition AIS SW to the test site and production sites assist the NMIS PO in properly documenting the specifications, standard operating procedures, and security requirements associated with the configuration, deployment, and training of the AIS

The Contractor shall provide on-site training, webinar training and site-specific web training for Nutrition Care and all system support personnel on the use of the AIS at the 45production sites. Additionally, the Contractor shall assist the NMIS PO to maintain a Nutrition AIS software database for each site that customizes the standardized initial delivered database. The Contractor shall also provide technical support via telephone and email to all sites as needed as part of software licensing/maintenance agreements. If remote access is required, the Contractor will be provided access to the Juniper virtual private network (VPN) for remote access and server administration.

Telephonic technical support and all in-version maintenance releases and upgrades shall be included in sustainment maintenance subscription fee.

2.2.9.1 AIS Software Training – Deliverable 14A, 14B, 14C

The Contractor shall provide webinar training by virtual meeting room (such as DCS or DCS and teleconference.

The Contractor shall also provide on-site training to sites as selected by the NMIS functional leads and as approved by the Government. The Contractor shall provide the training products and services called for hereunder:

2.2.9.1.1 Training Program

The Contractor shall develop a Training Program (Deliverable 14A) to specify training approaches, methods, schedules, tools, and curricula The contractor shall coordinate the training schedule with the MHS GENESIS

Electronic Health Record (EHR) deployment schedule to provide on-site training at least 45 days prior to go-live to prepare for the transition to the new EHR.

2.2.9.1.2 Training Materials

Following Government approval of the Training Plan, the Contractor shall develop Training Materials

(Deliverable 14B), to include course objectives, teacher guides, student guides, course materials, training manuals, distance learning tools and computer-based tools. The Contractor shall deliver training materials in reproducible format, suitable for professional reprinting by the Government Printing Office (GPO) to generate bulk printing.

2.2.9.1.3 Training Presentation

The Contractor shall plan, schedule, and conduct Government approved Training Programs (Deliverable 14C).

Training may include train-the-trainer or training students. Following completion of the training, the Contractor shall document lessons learned in the next monthly progress report and modify the training plan and resources as appropriate. The Contractor shall provide a completed training report for all on-site training and webinar training to be delivered through the approved contract deliverable system (currently Serena Business Manager).

2.2.10AIS Software Documentation – Deliverable 17

The Contractor shall assist the Government in properly documenting the specifications, standard operating procedures, and security requirements associated with the configuration, deployment, and training of the AIS. In particular, the Contractor shall assist by providing all information, including Contractor documentation (i.e. Release

Notes, Frequently Asked Questions (FAQs), database schema, data dictionary, etc…) (Deliverable 17) needed by the Government to create documentation to support the cybersecurity Risk Management Framework system authorization and risk assessment process.

2.2.11 AIS Software Database Quality Review – Deliverable 15A, 15B

In preparation for initial deployment, the Government populated each Nutrition AIS software server with a standard starter initial database at deployment containing an estimated 60% of the necessary database items. Each site’s AIS database, at a minimum, shall consist of the following:

2,000 Inventory Items – including Contractor, unit of issue, storage location

1,500 Recipes – including 1,000 multi-ingredient, 500 single-items

150 Menu Days – 30 Recipes per day

2,500 Diet Orders

200 Likes/Dislikes/Allergies

75 Meal Patterns

30 Special Services

300 Restrictions

Recipe linking exchanges

The local site and the Contractor created and populated the remaining site unique data items. The Contractor trained each site’s Nutrition Care staff to create the missing data elements and how to enter all database items needed for full functionality.

In an effort to maintain the integrity of site databases, the Contractor shall conduct database data quality reviews on an MTF/site production DB schemas for both the Food Operations Management (FOM) and Nutrition Care

Management modules(NCM).

The Contractor shall access all applicable database virtual machines by Juniper VPN and export a current copy of site’s database. This database shall be scrubbed of all protected health information/personally identifiable information (PHI/PII) (de-identified) using Contractor supplied application tools prior to removal from the MTF production site. This MTF database export will be imported/loaded on the Contractor’s systems and used for the database data quality review.

The Contractor shall schedule and conduct an email Pre and Post Database Data Quality Review Survey

(Deliverable 15A) with the site to determine modules currently used, modules that the site wishes to implement, and any areas of concern the MTF may have in regards to the user’s perception of usability and quality of the DB in use at the site.

The contractor shall schedule 1/3 of the total number of MTFs (not to exceed 15) each year for a data quality review.

The contractor shall perform a thorough review of all Patient Menus, Cafeteria Menus, Patient Tables, Recipes, SmartSubstitutions, Contractors, Inventory Items, Interface, and DB table links, The purpose of these data quality reviews is to ensure from a functional and technical perspective that the DB items are built correctly and linked to all other DB items and tables as appropriate.

The Contractor shall, as the result of a detailed analysis of the data contained within each MTFs DB, provide a detailed Database Quality Review Report (Deliverable 15B) to the COR and each MTF that will include areas of the DB that need to be built or cleaned to get the site to a level of use commensurate with the sites ability and desire to utilize the various modules of the software. The report shall also contain the results of the pre and post site DB review survey. The report shall include recommended miscellaneous tasks that need to be performed by the MTF to fully utilize all modules of the Computrition Application that the Government has purchased and deployed. The report shall also contain any other recommendations to the COR on how the MTF could better utilize the SW to increase productivity and enable automation.

The DB data quality reviews shall be timed to complete before the scheduled on-site visit. This will allow sufficient time so that sites will have an opportunity to engage the trainer on specific areas of the DB. This will also provide the Program Office and the Contractor insight into the areas most critically in need of webinar training.

2.2.12 AIS Software Technical Support Help Desk Ticket Report– Deliverable 25)

The Contractor shall provide direct technical support regarding the continued use and operation of the NMIS AIS software. This support shall be provided via a toll-free telephone number and email, and be available to all NMIS

AIS users. In addition, the Contractor may be required to remotely access the EBS environment to troubleshoot any technical problems with the NMIS AIS software. The Government shall provide the Contractor an authorized user account on the Juniper VPN created for each technician requiring access to the Nutrition AIS software once remote access is identified as a requirement.

The contractor shall adhere to the SDD process of resolving trouble tickets, within specified time frames for objectives and thresholds.

The contractor shall utilize a trouble ticketing process with a centric view of what happens to a given trouble ticket.

The contractor shall adhere to the SDD process of resolving trouble tickets, within specified time frames for objectives and thresholds. At a minimum this process shall include:

Recording the problem

Reproducing the problem

Correcting Report

Identifying the Problem and Resolution

Verifying the Resolution

Communicating the results

Auditing and Recording

The Contractor shall work with the NMIS PO COTS Integrator to ensure that information reference trouble tickets are recorded accurately and provide a monthly summary of help desk tickets (Deliverable 23) The report shall include, at a minimum but not limited to, the following:

Identification number – Assigned by the Tier I and II MHS Service Desk staff (e.g. Remedy and tracker number from Government-controlled database).

Date and time of trouble ticket receipt.

Title and short description of the trouble ticket.

Status of the trouble ticket resolution (to include the responsible party, the number of days the action has been open, the estimated completion date and recommended resolution).

Repair timeline (to include projected build/patch version or target date).

Indication if trouble ticket is associated with a warranty period repair.

Plan of Action and Milestone (POA&M) for tickets over 40 calendar days open.

The contractor shall utilize the MHS Service Desk approved trouble ticket automated information system (AIS) – currently Remedy.

3.0 INSPECTION AND ACCEPTANCE

The COR for the Task Order is a Government official who has been delegated specific technical, functional, and oversight responsibilities for the task order. The COR is designated in the COR appointment letter, issued by the

CO, and is responsible for inspection and acceptance of all services, incoming shipments, documents, and services.

3.1 Acceptance Criteria

Certification by the Government of satisfactory services provided is contingent upon the Contractor performing in accordance with the performance standards contained in the Performance Requirements Summary Matrix (Section

6.8.2) and all terms and conditions of this order, including all modifications.

3.2 Contractor Payment Processing

The Contractor is responsible for properly preparing and forwarding to the appropriate Government official, the invoice and receiving report for payment. The Contractor shall invoice in accordance with Section B of the task order. The Contractor shall attach back up information to receiving reports for direct labor and Other Direct Costs

(ODCs). Direct labor backup information shall reflect the person’s name, job title and quantity of hours worked for each pay period at a minimum. Backup information for ODCs shall list all elements of costs, such as travel breakout backup, including itinerary, dates of travel, name of employees traveling plus per diem costs shall accompany the receiving report. All ODCs exceeding $3,000 requires that the Contractor conduct appropriate competition. When the Wide Area Workflow – Receipt and Acceptance (WAWF-RA) application is able to be used, it is the preferred method of submission. (See paragraph 3.3 or 3.4 below.)

3.3 Invoicing and Receiving Report Instructions - Cost Reimbursement, Time and Materials, and Labor

Hour Contracts

Not applicable for task.

3.4 Invoicing and Receiving Report Instructions – Fixed Price Contracts

The Contractor is responsible for submitting invoices and initiating receiving reports electronically through WAWF for goods and services rendered under this Contract. For fixed price contracts, the WAWF 2 IN 1 format (for services), and the COMBO format (only for supplies or equipment), are the preferred methods of processing electronic invoices and receiving reports within DHA. Back up documentation (such as timesheets, etc.) can be included and attached to WAWF documents as requested by the responsible COR. Attachments created in any

Microsoft Office product are attachable to the invoice in WAWF.

Contractor personnel (WAWF Vendor role) shall self-register at the web site: https://wawf.eb.mil/, and be activated by the Contractor’s designated Electronic Business Point of Contact. WAWF training is available on the internet at http://wawftraining.com.

The Contractor shall submit invoices for payment and initiate receiving reports every month.

The Government shall process invoices for payment and associated receiving reports every month.

Prior to submitting the first WAWF-RA electronic form for a given task order, Contractors should first coordinate with the assigned DHA COR.

When initiating documents within WAWF, Contractors must use the appropriate two-part DHA location code to include BOTH the Government Acceptor DoDAAC / Extension (Ext) fields and the Local Processing Office (LPO)

DoDAAC / Extension fields as displayed within the WAWF application and illustrated below:

Service Acceptor / Ext. LPO DoDAAC / Ext.

HT0003 | FPRI HT0003 FPRI

3.5 Annual License Subscription Fee

The Contractor shall include, in the software license/maintenance subscription fees, technical support and upgrades to the purchased version of the NMIS AIS software, 1 st Version integer.

4.0 DELIVERABLES

4.1 Delivery Address

All deliverables shall be submitted to the COR designated in the COR appointment letter.

4.2 Method of Delivery

Electronic copies shall be delivered using Microsoft Office suite of tools (for example, MS WORD, MS EXCEL, MS POWERPOINT, MS PROJECT, or MS ACCESS format), unless otherwise specified by the COR. Electronic submission shall be made via email, unless otherwise agreed to by the COR.

4.3 Shipping

The Contractor shall use the U.S. Postal Service standard delivery for delivery of materials, equipment, or required hardcopy documents. The COR must approve all exceptions to this requirement.

4.4 Government Acceptance Period

The COR will have ten (10) workdays to review draft deliverables and make comments. The Contractor shall have five (5) workdays to make corrections. Upon receipt of the final deliverables, the COR will have two (2) workdays for final review prior to acceptance or providing documented reasons for non-acceptance. Should the Government fail to complete the review within the review period the deliverable will become acceptable by default, unless prior to the expiration of the ten (10) work days the Government notifies the Contractor in writing to the contrary. The final submission should be deemed approved if the Government has not rejected it in thirty (30) calendar days.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted quote. In the event of a rejected deliverable, the

Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor shall have five (5) workdays to correct the rejected deliverable and return it per delivery instructions.

4.5 Delivery Schedule Abbreviations

The following abbreviations are used in the delivery/deliverable schedule:

Abbreviation Definition

AM Acquisition Manager

COR Contracting Officer's Representative for the Task order

CS Contract Specialist

DA Days after

DACA Days after contract award (award of this order)

DAEOM Days after the end of the month

Days Calendar Days unless otherwise specified

DID Data Item Description

DMS Deliverable Management System

E Electronic Copy

H Hard Copy

NLT Not Later Than

PWS Ref Performance Work Statement Reference (paragraph number)

4.6 Deliverable / Delivery Schedule

A summary of deliverables follows. Copies are to be provided to the Government officials indicated in electronic file (E), and/or hard copy (H).

Item PWS Ref Title Dist E H Initial Subsequent

Deliverable 1 Attachment

Non-Disclosure

Agreement

DMS

AM

Signed statements are due, from each employee assigned, prior to performing ANY work on this task.

Deliverable 2 2.1.1 Monthly Progress Report DMS 1 0 NLT 30 DACA Monthly

Item PWS Ref Title Dist E H Initial Subsequent

Deliverable 12 2.1.8 Quality Control Plan DMS 1 0 Initial with proposal Updated annually as required by the COR

Deliverable 13 2.1.9 Contingency Operations

Plan

DMS 1 1 NLT 10 DACA Updated annually as required by the COR

Deliverable

14A

2.2.7.1.1 Training Program DMS

MTF

Completed before/after any webinar, onsite or site-specific web training

NA

Deliverable

14B

2.2.7.1.2 Training Materials DMS

MTF

Prepared for each webinar and on-site training

NA

Deliverable

14C

2.2.7.1.3 Training Presentations DMS

MTF

Presented as scheduled

NA

Deliverable

15A

2.2.9 Pre and Post database

data quality review survey

DMS

MTF

Completed after each database quality review

NA

Deliverable

15B

2.2.9 Database Quality Review

Report

DMS

MTF

Completed after each database quality review

NA

Deliverable 16 2.2.1 AIS Software Service

Level Agreement

COR 1 1 At Contract Award Updated annually as required by the COR

Deliverable 17 2.2.7 Release Notes and

Frequently Asked

Questions for each new release

DMS 1 0 10 Days prior to each new release

NA

Deliverable 18 2.2.2 Static and Dynamic Code

Review Report

COR 1 0 With each new product release;

10 days after Gov’t request for RMF process

NA

Deliverable 19 2.2.3 MHS Genesis Data Entry

Support – After Action report

COR 1 0 At Option Award Each completed DB schema

Deliverable 20

Optional Task

2.2.4 Bedside Connect Module COR 1 0 At Option Award Updated annually as required by the COR

Deliverable 21

Optional Task

2.2.5 Tray Tracking Module COR 1 0 At Option Award Updated annually as required by the COR

Deliverable 22

Optional Task

2.2.6 TV/Monitor Meal

Ordering Module

COR 1 0 At Option Award Updated annually as required by the COR

Deliverable 23

Optional Task

2.2.7 Inventory Management

Module

COR 1 0 At Option Award Updated annually as required by the COR

Deliverable 24

Optional Task

2.2.8 Web interface Menu

Display for Mobile

Devices

COR 1 0 At Option Award Updated annually as required by the COR

Item PWS Ref Title Dist E H Initial Subsequent

Deliverable 25 2.2.10 Help desk ticket report COR 1 0 NLT 30 DACA Monthly

5.0 CONTRACT ADMINISTRATION DATA

5.1 Place of Performance

The Contractor shall perform primary activity at the Contractor’s facility in West Hills, CA. Technical support may be provided remotely from the Contractor’s support facilities.

5.2 Other Direct Costs (ODCs)

The Government shall provide “plugged” number values for Other Direct Costs (ODCs) for Travel for each of the

Base Period, Option Period 1 and each Option Period 2 as outlined herein:

Base Period:

From To Round Trip

(Y/N)

# of

Trips

# of

People

# of

Days

Vendor US Location Falls Church, VA Y 1 1 3

Vendor US Location Naval Hospital Bremerton, WA Y 1 1 3

Vendor US Location FT Lewis, WA Y 1 1 3

Vendor US Location FT Belvoir, VA Y 1 1 3

Vendor US Location Naval Hospital Portsmouth, VA Y 1 1 3

Vendor US Location Wright-Patterson AFB, OH Y 1 1 3

Vendor US Location Landstuhl, Germany Y 1 1 3

Vendor US Location FT Shafter, HI Y 1 1 3

Vendor US Location RAF Lakenheath, England Y 1 1 3

Vendor US Location Aviano AFB, Italy Y 1 1 3

Vendor US Location FT Campbell, KY Y 1 1 3

Vendor US Location FT Bragg, NC Y 1 1 3

Vendor US Location Naval Hospital Camp Lejeune, NC Y 1 1 3

Vendor US Location Naval Hospital Jacksonville, FL Y 1 1 3

Option Period 1:

(Y/N)

# of

Trips

# of

People

# of

Days

Vendor US Location Falls Church, VA Y 1 1 3

Vendor US Location Mountain Home AFB, ID Y 1 1 3

Vendor US Location Travis AFB, CA Y 1 1 3

Vendor US Location FT Wainwright, AK Y 1 1 3

Vendor US Location Joint Base Elmendorf-Richardson, AK Y 1 1 3

Vendor US Location FT Irwin, CA Y 1 1 3

Vendor US Location Nellis AFB, NV Y 1 1 3

Vendor US Location Naval Hospital 29 Palms, CA Y 1 1 3

Vendor US Location Camp Pendleton, VA Y 1 1 3

Vendor US Location FT Bliss, TX Y 1 1 3

Vendor US Location TBD – CONUS Y 1 1 3

Vendor US Location TBD - CONUS Y 1 1 3

Option Period 2:

(Y/N)

# of

Trips

# of

People

# of

Days

Vendor US Location Falls Church, VA Y 1 1 3

Vendor US Location FT Carson, CO Y 1 1 3

Vendor US Location FT Leonard Wood, MO Y 1 1 3

Vendor US Location FT Riley, KS Y 1 1 3

Vendor US Location Naval Medical Center San Diego, CA Y 1 1 3

Vendor US Location FT Sam Houston, TX Y 1 1 3

Vendor US Location FT Benning, GA Y 1 1 3

Vendor US Location FT Steward, GA Y 1 1 3

Vendor US Location FT Hood, TX Y 1 1 3

Vendor US Location FT Polk, LA Y 1 1 3

Vendor US Location Elgin AFB, FL Y 1 1 3

Vendor US Location Keesler AFB, MS Y 1 1 3

Option Period 3:

(Y/N)

# of

Trips

# of

People

# of

Days

Vendor US Location Falls Church, VA Y 1 1 3

Vendor US Location Naval Hospital Jacksonville, FL Y 1 1 3

Vendor US Location Walter Reed NMMC, MD Y 1 1 3

Vendor US Location West Point, NY Y 1 1 3

Vendor US Location FT Belvoir, VA Y 1 1 3

Vendor US Location Naval Hospital Camp Lejeune, NC Y 1 1 3

Vendor US Location FT Bragg, NC Y 1 1 3

Vendor US Location FT Campbell, KY Y 1 1 3

Vendor US Location Wright-Patterson AFB, OH Y 1 1 3

Vendor US Location Joint Base Langley-Eustis, VA Y 1 1 3

Vendor US Location Naval Hospital Portsmouth, VA Y 1 1 3

Vendor US Location TBD - CONUS Y 1 1 3

Vendor US Location TBD - CONUS Y 1 1 3

Option Period 4:

(Y/N)

# of

Trips

# of

People

# of

Days

Vendor US Location Falls Church, VA Y 1 1 3

Vendor US Location Landstuhl, Germany Y 1 1 3

Vendor US Location Aviano AFB, Italy Y 1 1 3

Vendor US Location RAF Lakenheath, England Y 1 1 3

Vendor US Location Seoul, Korea Y 1 1 3

Vendor US Location FT Shafter, HI Y 1 1 3

Vendor US Location Naval Hospital Okinawa, Japan Y 1 1 3

Vendor US Location Naval Hospital Yokosuka, Japan Y 1 1 3

Vendor US Location Yokota AFB, Japan Y 1 1 3

5.2.1 Travel Outside of the U.S.

6.0 OTHER TERMS, CONDITIONS, AND PROVISIONS

6.1 Non-Disclosure / Non-Use Agreement – Deliverable 1

The Contractor shall ensure that the Non-Disclosure Statement (Attachment to the PWS) (Deliverable 1) is signed by all staff assigned to or performing on this Task order before performing any work, including all subcontractors and consultants. The Non-Disclosure / Non-Use statement shall be cosigned by a corporate official (Contractor

Task Manager or higher). The Contractor shall also ensure that all staff understand and adhere to the terms of the non-disclosure statement, protecting the procurement sensitive information of the Government and the proprietary information of other Contractors. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor.

6.2 Information Assurance

1. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow:

2. Health Insurance Portability and Accountability Act (HIPAA). The contractor shall comply with the Health

Insurance Portability and Accountability Act of 1996 (HIPAA) (P.L. 104-191) requirements, specifically the administrative simplification provisions of the law and the associated rules and regulations published by the

Secretary, Health and Human Services (HHS) and the published Defense Health Agency (DHA) implementation directions. This includes the Standards for Electronic Transactions, the Standards for Privacy of Individually

Identifiable Health Information and the Security Standards. It is expected that the contractor shall comply with all

HIPAA-related rules and regulations as they are published and as DHA requirements are defined (including identifiers for providers, employers, health plans, and individuals, and standards for claims attachment transactions).

3. Personnel Security

3.1 The contractor shall comply with DoD Directive 8500.01E, "Information Assurance (IA)," DoD Instruction

8500.2, "Information Assurance (IA) Implementation," DoD Directive 5400.11, "DoD Privacy Program," DoD

6025.18-R, "DoD Health Information Privacy Regulation," and DoD 5200.2-R, "Personnel Security Program

Requirements."

3.2 Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

3.2.1 Follow the DHA Personnel Security Branch guidelines for submittal of Automated Data Processor/Information

Technology (ADP/IT) security clearances and ensure all contractor personnel are designated as ADP/IT-I, ADP/IT-

II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations. Reference DoD 5200.2-

R, “Personnel Security Program Requirements.” http://www.dtic.mil/whs/directives

3.2.2 Initiate, maintain, and document personnel security investigations appropriate to the individual's responsibilities and required access to Military Health System (MHS) Sensitive Information (SI).

3.2.3 Immediately report to the DHA Privacy Office and deny access to any automated information system (AIS), network, or MHS SI information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate government representative for security reasons.

3.2.4 Ensure that all contractor personnel receive cybersecurity awareness training before being granted access to

DoD AISs/networks, and/or MHS SI information.

4. Electronic Security.

4.1 Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of the

DoD Military Health System shall operate in accordance with controlling laws, regulations, and DoD policy.

4.2 Certification & Accreditation (C&A) requirements apply to all DoD and contractor's IS/networks that receive, process, display, store or transmit DoD information. The contractor shall comply with the C&A process for safeguarding SI. Certification is the determination of the appropriate level of protection required for IS/networks.

Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

4.3 Accreditation is the formal approval by the government to operate the contractor's IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows

IS/networks to operate within the given operational environment with stated interconnections; and with appropriate level of protection for the specified period.

4.4 The contractor shall comply with C&A requirements, as specified by the government that meet appropriate DoD

Cybersecurity requirements. The C&A requirements shall be met before the contractor's system is authorized to access DoD data or interconnect with any DoD IS/network that receives, processes, stores, displays or transmits

DoD data. The contractor shall initiate the C&A process by providing the Contracting Officer, within 60 days following contract award, the required documentation necessary to receive an Approval to Operate (ATO). The contractor shall make their IS/networks available for testing, and initiate the C&A testing four months (120 days) in advance of accessing DoD data or interconnecting with DoD IS/networks. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

Attending and supporting C&A meetings with the government

Supporting/conducting the vulnerability mitigation process

Supporting the C&A Team during system security testing

4.4.1The Contractor shall support Defense Information Assurance Certification and Accreditation Process

(DIACAP) and DoD Risk Management Framework processes as directed by the Government to maintain the ATO.

The Contractor shall support the process for Assured Compliance Assessment Solution (ACAS) scanning required for continuous reporting and various accreditation efforts. The Contractor’s software shall adhere to DoD requirements for encryption of data at rest and data in transit.

4.5 Contractors must confirm that their IS/networks are locked down prior to initiating testing. Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA) Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

4.6 Any re-configuration or change in the system during the C&A testing process will require a re-baselining of the system and documentation of system changes.

4.7 Vulnerabilities that have been identified by the government as "must-fix" issues during C&A process must be mitigated according to the timeline identified by the Government Representative. C&A Checklists are provided for complying DoD C&A requirements.

4.7.1 A request for risk acceptance to the C&A requirements may be submitted for temporary testing and other usual circumstances. A risk acceptance request must be submitted, in writing, to the Designated Approving Authority

(DAA). The request must include mitigation strategies that ensure adequate protection measures and security controls are in place (for example: air gapping a testing network).

4.8 Information Assurance Vulnerability Management (IAVM). The contractor shall implement an information assurance vulnerability management program. The DoD IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to MHS systems. As part of the program, the contractor shall provide a primary and secondary point of contact in the Vulnerability Management System (VMS) and to the MHS Information Assurance Vulnerability Alert (IAVA) Monitor. The point of contact shall provide, upon receipt of a vulnerability message, an acknowledgment of receipt via the VMS. The contactor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance in the

VMS. Receipt and compliance messages to the government shall occur within the stipulated time window, as stated in the vulnerability message or in the VMS.

4.8.1 The contractor shall ensure AIS assets that are under development are registered in the VMS and have all applicable electronic patches installed for the system (1) when the system is delivered to the Government, or (2) if the AIS assets are used to store…