W81XWH-17-T-0071.docx

W81XWH-17-T-0071

Section SF 1449 - CONTINUATION SHEET

Base - Database Upgrades

FFP

Base Year - License Upgrade for 15 users and Hotline Support for 12 months. Please refer to the Performance Work Statement (PWS) for further clarification.

FOB: Destination

PURCHASE REQUEST NUMBER: 0010958056

NET AMT

Base - On Site Support

Base Year - On Site Support. Please refer to the Performance Work Statement (PWS) for further clarification.

NET AMT

Base - Contractor Manpower Reporting

The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower (including subcontractor manpower) required for performance of this contract. The contractor is required to completely fill in all the information in the format using the following web address: https://cmra.army.mil

NET AMT

FFP

Base Year - License Upgrade for 15 users and Hotline Support for 12 months. Please refer to the Performance Work Statement (PWS) for further clarification.

NET AMT

FFP

Base Year - On Site Support. Please refer to the Performance Work Statement (PWS) for further clarification.

NET AMT

FFP

The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower (including subcontractor manpower) required for performance of this contract. The contractor is required to completely fill in all the information in the format using the following web address: https://cmra.army.mil

NET AMT

FFP

Base Year - License Upgrade for 15 users and Hotline Support for 12 months. Please refer to the Performance Work Statement (PWS) for further clarification.

NET AMT

FFP

Base Year - On Site Support. Please refer to the Performance Work Statement (PWS) for further clarification.

NET AMT

FFP

The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower (including subcontractor manpower) required for performance of this contract. The contractor is required to completely fill in all the information in the format using the following web address: https://cmra.army.mil

NET AMT

FFP

Base Year - License Upgrade for 15 users and Hotline Support for 12 months. Please refer to the Performance Work Statement (PWS) for further clarification.

NET AMT

FFP

Base Year - On Site Support. Please refer to the Performance Work Statement (PWS) for further clarification.

NET AMT

FFP

The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower (including subcontractor manpower) required for performance of this contract. The contractor is required to completely fill in all the information in the format using the following web address: https://cmra.army.mil

NET AMT

PWS

PERFORMANCE WORK STATEMENT (PWS)

Electronic Museum (KE EMu) Software Support and Maintenance Part 1 General Information

1. GENERAL: This is a non-personnel services contract to provide Electronic Museum (KE EMu) Software Support and Maintenance. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Electronic Museum (EMu) Software Support and Maintenance as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: The National Museum of Health and Medicine (the Museum) is responsible for the development and maintenance of a unified electronic system to manage information and inventory of its diverse collection to include: biological and anthropological research specimens, artifacts, archives, and artwork. The Museum has determined that a database developed by Axiel ALM Canada, Inc. (formerly KE Software) known as “Electronic Museum” (KE EMu) is the most effective automated system developed specifically for research, archives and artifact collections. The software has been fully integrated as a key tool for managing the collections of the museum since 2006. This request is for renewal of KE Emu support and maintenance services. The Museum is a component of the Defense Health Agency (DHA) of the United States Department of Defense (DoD) and part of the Military Health System (MHS)

1.3 Objectives:

· Annual renewal of 15 user licenses

· Version upgrades as required

· Hotline support and maintenance

· Site visits for local support and maintenance.

1.4 Scope: The KE Emu database may require periodic upgrades, maintenance and/or support throughout the period of an annual service contract. The contractor shall provide the following services to maintain all aspects of the KE Emu database system:

1.4.1 Provide license renewal and version upgrades, as required, for 15 user runtime licenses. This includes 15 user runtime licenses for Texpress plus option modules Texql, Texapi, and Texhtml.

1.4.2 Provide hotline support

1.4.2 Provide 10 days on site-support to be used per year on an as needed, on-call basis. The vendor will provide on-site support for the Museum to assist with training, implementation and maintenance of KE Emu to include client/server rollout, database customizations, data migration and application administration. In lieu of remote access these activities must be performed on site with the supervision and assistance of local IT staff.

0. Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and three (3) 12-month option years to begin after contract award. The Period of Performance reads as follows:

Base Year from contract award date Option Year I Option Year II Option Year III

1.6 General Information

1.6.1 Quality Control – DELIVERABLE 7: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. The Quality Control Plan (Deliverable 7) shall be delivered, within 30 days after contract award or with the contractor’s proposal if it is an evaluation factor, one copy of a comprehensive written QCP shall be submitted to the KO and COR within 5 working days when changes are made thereafter. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system.

1.6.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The contractor is not expected to perform on the following US Federal holidays:

1.6.4 Hours of Operation: The contractor is responsible for conducting business, between the hours of 0730-1600 EST Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5 Place of Performance: With the expection of site visits, the work to be performed under this contract will be performed at the contractor’s facility. Site visits are to be performed at the museum facility at 2500 Linden Lane, Silver Spring, MD 20910

1.6.6 Type of Contract: The government will award a Firm-Fixed-Price contract.

1.6.7 Security Requirements: Not applicable

1.6.7.1 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use.

1.6.7.2 Information Security: The Contractor shall be responsible for the security of all information. Information made available to the contractor by the Government for the performance or administration of this effort will be used only for those purposes and will not be used in any other way without the written agreement of the Contracting Officer. The contractor agrees to assume responsibility for protecting the confidentiality of Government records, which are not public information. Each contractor or employee of the contractor to whom information may be made available or disclosed will be notified in writing by the contractor that such information may be disclosed only for a purpose and to the extent authorized herein.

1.6.8 Special Qualifications: Personnel performing on-site technical support must have a minimum of two years of working experience with KE Emu to include software development, troubleshooting, data migrations, server support, and other technical needs related to the software.

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10 Contracting Officer’s Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11 Key Personnel: The follow personnel are considered key personnel by the government: Contract Manager. The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available 9:00 am to 5:30pm Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

1.6.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Employees of the service provider when at a government on-site location will be required to be identifiable as a visitor by means of wearing a museum-issued badge.

1.6.13 Contractor Travel: Contractor will be required to travel CONUS and within the NCR during the performance of this contract. All travel requires Government approval/authorization and notification to the COR.

1.6.14 Other Direct Costs: Not applicable

1.6.16 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may effect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.9. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.12. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.12. WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. ACRONYMS:

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Services: The Government will provide all necessary office and or specific program services needed in order to complete defined tasks required for on-site task performance.

3.2 Facilities: The Government will provide space for on-site visits at the National Museum of Health and Medicine located at 2460 Linden Lane, Building 2500, Silver Spring, MD 20910.

3.3 Materials: The Government will provide supplies and electronic data as needed in order to complete defined tasks.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

PART 5

SPECIFIC TASKS

5. SPECIFIC TASKS:

5.1. Basic Services. The contractor shall provide license renewal and services for periodic upgrades, maintenance and/or support for KE Emu software package throughout the period of an annual service contract.

5.2. Task 1 - Software upgrades – DELIVERABLE 2: The contractor shall provide software upgrades as required.

5.3. Task 2 - Hotline Support - DELIVERABLE 3: The contractor will provide hotline support on an as-needed basis for museum staff within one business day of receipt of request and maintain a record for all support requests, including reporting of client issues, for reference and tracking purposes. The contractor will provide a report on the status of hotline support monthly

5.4. Task 3 - On-site Support – DELIVERABLE 4: The contractor will provide 10 site visits to be used per year on an as needed, on-call basis to provide training and technical support for KE Emu to include client/server rollout, database customizations, data migration and application administration. In lieu of remote access technical support must be performed on site with the supervision and assistance of local IT staff.

5.4.1. Personnel performing on-site technical support must have a minimum of two years of working experience with KE Emu to include software development, troubleshooting, data migrations, server support, and other technical needs related to the software.

5.4.2. The contractor will be responsible for arranging and completing travel within one month of request. Foreign National (non US) citizens must be cleared by the Defence Health Agency to work on site.

5.5. Task 4 – License renewal – DELIVERABLE 1: The contractor shall provide annual renewal of 15 existing user licenses to include runtime licenses for Texpress plus option modules Texql, Texapi, and Texhtml.

PART 6

OTHER TERMS, CONDITIONS, AND PROVISIONS

6.0 OTHER TERMS, CONDITIONS, AND PROVISIONS

6.1 Non-Disclosure /Non-Use Agreement – DELIVERABLE 5: The Contractor shall ensure that the Non-Disclosure/Non-Use Agreement (Attachment 4 to PWS) (Deliverable 5) is signed by all staff assigned to or performing on this Task order before performing any work, including all subcontractors and consultants. The Non-Disclosure/Non-Use Agreement shall be cosigned by a corporate official (Contractor Task Manager or higher). The Contractor shall also ensure that all staff understand and adhere to the terms of the non-disclosure statement, protecting the procurement sensitive information of the Government and the proprietary information of other Contractors. Assignment of staff who have not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor.

6.2 Information Assurance: Standard Information Assurance applies and is incorporated into this PWS as follows.

6.3 Enterprise Architecture (EA): Standard Enterprise Architecture contract language is not applicable to this PWS.

6.3.1. Information Technology Standards Repository (DISR): The Contractor shall provide COTS solutions that are IPv6 capable. An IPv6 capable system or product shall be capable of receiving, processing, transmitting and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to that of IPv4. Specific criteria to be deemed IPv6 capable are:

6.3.1.1. Conformance to the DoD Information Technology Standards Repository (DISR) developed DoD IPv6 Standards Profile. Systems being developed, procured or acquired shall comply with the Global Information Grid Architecture and DISR standard IPv6 Capable definition. An IPv6 Capable system must meet the IPv6 base requirements defined in the “DoD IPv6 Standards Profile v6.0” dated July 2011 available from the DISR.

6.3.1.2. Maintenance of interoperability with IPv4. Systems being developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities. Systems should implement IPv4/IPv6dual-stack and should also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with. If either protocol is possible, systems should employ IPv6.

6.3.1.3. Availability of contractor/vendor IPv6 technical support for system development, implementation and management. DoD IPv6 security guidelines, standards, and solutions shall be utilized and adhered to when available. Currently, DoD IPv6 Information Assurance (IA) guidance is available from: http://www.hpc.mil/index.php..

6.4 Protection of Information

6.4.1 Dissemination of Information/Publishing: There shall be no dissemination or publication, except within and between the Contractor and any subcontractors or specified Integrated Product/Process Team (IPT) members who have a need to know, of information developed under this order or contained in the reports to be furnished pursuant to this order without prior written approval of the DHA TM or the Contracting Officer. DHA approval for publication will require provisions which protect the intellectual property and patent rights of both DHA and the Contractor.

6.4.2 Contractor Employees:

6.4.2.1 Contractor Identification

The Contractor shall ensure that Contractor personnel identify themselves as Contractors when attending meetings, answering Government telephones, providing any type of written correspondence, or working in situations where their actions could be construed as official Government acts.

6.4.2.2 Attendance at Meetings

Contractor personnel may be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel make their Contractor status known during introductions.

6.4.2.3 Use of Military Rank by Contractor Personnel

Contractor personnel, while performing in a Contractor capacity, are prohibited from using their retired or reserve component military rank or title in all written or verbal communications associated with the contract under which they provide services.

6.4.3 Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws: The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data. The Contractor shall also ensure the confidentiality, integrity, and availability of Government data in compliance with all applicable laws and regulations, including data breach reporting and response requirements, in accordance with Defense Federal Regulations Subpart 224.1 (Protection of Individual Privacy), which incorporates by reference current versions DoDD 5400.11, “DoD Privacy Program,” and DoD 5400.11-R, “DoD Privacy Program.” The Contractor shall also comply with federal laws relating to freedom of information and records management. The Contractor shall analyze any breach of PII/PHI for which it is responsible under the terms of this Contract under both the Privacy Act and Health Insurance Portability and Accountability Act (HIPAA), if applicable, to determine the appropriate course of action under each requirement, if any.

6.4.4 Health Insurance Portability and Accountability Act: The Contractor shall comply with all requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191), as implemented by the HIPAA Privacy and Security Rules codified at 45 Code of Federal Regulations Parts 160 and 164, and as further implemented within the Military Health System (MHS) by DoD 6025.18-R, "DoD Health Information Privacy Regulation," January 24, 2003, and DoD 8580.02-R, “DoD Health Information Security Regulation, July 12, 2007. The Contractor shall also comply with all applicable HIPAA-related rules and regulations as they are published and as further defined by later-occurring Government requirements and DoD guidance, including current and forthcoming DoD guidance implementing applicable amendments under the American Recovery and Reinvestment Act of 2009. Any rules and regulations that are published, and/or requirements that are defined after the award date of this contract, and that require expenditure of additional Contractor resources for compliance, may be considered “changes” and will be subject to the “changes” clause under the contract. In addition, specific HIPAA requirements, including but not limited to, HIPAA breach responses in Section 1.36.3.

6.4.5 Privacy Act Breach Response: Current version DoD 5400.11-R, “DoD Privacy Program,” incorporated herein by reference, defines a breach as the “actual or possible loss of control, unauthorized disclosure, or unauthorized access of personal information where persons other than authorized users gain access or potential access to such information for other than authorized purposes where one or more individuals will be adversely affected.” Within one hour of discovery, the breach must be reported to the US Computer Emergency Readiness Team (US CERT), the DHA Privacy Office, and the DHA Contracting Officer.

The Contractor shall adhere to the reporting and response requirements set forth in the Office of the Secretary of Defense Memorandum 1504-07, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information,” June 5, 2009; DoD 5400.11-R, also incorporated herein by reference, and consult DHA Privacy Office for guidance.

6.4.6 Federal Information Security Management Act (FISMA) – DELIVERABLE 6: OMB Memorandum M-09-29 asserts that agencies are responsible for ensuring information technology acquisitions comply with the information technology security requirements in the Federal Information Security Management Act (44 U.S.C. 3544), OMB’s implementing policies including Appendix III of OMB Circular A-130, and guidance and standards from the National Institute of Standards and Technology (NIST).

If required by DHA, The Contractor shall, in accordance with DoD regulations, create and deliver to the government, a report consisting of the results of the quarterly FISMA assessment (Deliverable 6).

6.4.7 Data at Rest: The Contractor shall provide encryption of data at rest in accordance with information assurance control ECCR-1 Encryption for Confidentiality (Data at Rest) and Encryption of data in transit in accordance with information assurance control ECCT-1 Encryption for Confidentiality (Data in Transit),per DoDI 8500.2, Information Assurance (IA) Implementation, February 6, 2003; DoDI 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP), November 28, 2007 and DoD Memorandum Department of Defense Guidance on Protecting Personally Identifiable Information (PII), August 18, 2006.

6.4.8 Systems of Records –DELIVERABLE 8: In order to meet the requirements of 5 U.S.C. 552a, the Privacy Act of 1974, and its implementation within the Military Health System (MHS) under DoD 5400.11-R, “ DoD Privacy Program,” May 14, 2007, the Contractor shall identify to the Contracting Officer Representative (COR) systems of records that are maintained or operated for DHA where records of personally identifiable information (PII) collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the COR, and prior to the lawful operation of such systems, if required by the DHA the Contractor shall coordinate with the DHA Privacy Office to complete Systems of Records Notices (SORNs) (Deliverable 8) for submission and publication in the Federal Register as coordinated by the Defense Privacy Office, and as required by DoD 5400.11-R.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by DoD 5400.11-R, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, and OMB Circular A-130.

6.4.9 Privacy Impact Assessment (PIA) – DELIVERABLE 9: The Contractor shall provide for the completion of a PIA for any applicable systems that collect, maintain, use or disseminate PII or PHI about members of the public, federal personnel, contractors, or in some cases foreign nationals.

To begin the PIA process, if required by the DHA, the Contractor is responsible for the completion of the PIA Determination Checklist (Deliverable 9). This Checklist provides basic system information to the DHA Privacy Office and ensures that the appropriate decision concerning PIA requirements is made. The current mandatory Checklist is available from the DHA Privacy Office.

The Contractor is responsible for the employment of practices that satisfy the requirements and regulations of: Section 208 of E-Government (E-Gov) Act of 2002, (Pub. L. 107-347); DoDI 5400.16, “DoD Privacy Impact Assessment (PIA) Guidance,” February 12, 2009; and, Office of Management and Budget (OMB) Memorandum 03-22, “OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002,” September 26, 2003. These documents are incorporated by reference. When completing PIA, the Contractor is responsible for using DoD-approved PIA Template, DD Form 2930.

Completed PIA Determination Checklists and DD Form 2930s will be sent to the DHA Privacy Office.

6.4.10 Data Sharing Agreement (DSA) – DELIVERABLE 10: A DSA which may be referred to in other sources as a Data Use Agreement (DUA), is currently used to control the disclosure, use, storage and/or destruction of MHS data that is managed by DHA to ensure compliance with privacy and security requirements applicable to PII, including but not limited to PHI. In addition, research requests for MHS data that include PHI must be reviewed for HIPAA compliance by the DHA Privacy Board.

Under DoD 6025.18-R, “DoD Health Information Privacy Program,” January 24, 2003, C8.3.4, a DSA is required to establish permitted uses for certain types of data IAW HIPAA requirements to prevent the unauthorized use and/or disclosure of any PII or PHI. Likewise, all uses, disclosures, and destruction of PII and PHI data are generally subject to DoD 5400.11-R, “DoD Privacy Program,” May 14, 2007, as well as DoDI 8500.2, “Information Assurance (IA) Implementation,” Feb. 6, 2003, and DoD 8580.02-R, “DoD Health Information Security Regulation,” July 12, 2007.

To begin the data sharing request process, the Contractor shall complete and submit a Data Sharing Agreement Application (DSAA) or contact the DHA Privacy and Civil Liberties Office (Privacy Office), and copy the Contracting Officer (Deliverable 10). If the application is approved, the requestor will enter into one of the following agreements, depending on the data involved:

· DSA for De-Identified Data

· DSA for PHI

· DSA for PII Without PHI

· Data Use Agreement for Limited Data Set.

After receiving DSA approval, anyone needing access to information system applications or data sources must contact the responsible system program office. DSAs are active for one year, or until the end of the current option year, whichever comes first. If the DSA will not be renewed, the Contractor shall provide a Certificate of Data Disposition (CDD) to the Privacy Office.

6.4.11 Privacy Act and HIPAA Training – DELIVERABLE 11: If required by the DHA, the Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act of 1974 (5 U.S.C. 552a) and Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191). The training requirements are mandated by OSD Memorandum 15041-07, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information”: DoD 6025.18-R, “DoD Health Information Privacy Regulation”, January 24, 2003; and the DHA Workforce Training Policy Memorandum, dated May 28, 2008, on the subject, “Workforce Training Policy Pursuant to the Department of Defense Privacy Act Regulations and the Department of Defense Health Insurance Portability and Accountability Act Privacy and Security Regulations”.

All required Privacy Act and HIPAA training will be conducted online through Military Health System Learn (MHS Learn) or the current DHA learning management system (LMS) in place to deliver training to meet the above requirements. The Contractor shall ensure all employees and subcontractors supply a certificate of Privacy Act and HIPAA training completion to the COR within 30 days of being assigned to the Task Order and on an annual basis based on the trainee’s birth month thereafter.

6.4.12 Records Management: When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (USC), 41 USC, 36 Code of Federal Regulations, Department of Defense Administrative Instruction No. 15 (DOD AI-15), “Records Management, Administrative Procedures and Records Disposition Schedules,” and Chapter 2 of the TRICARE Operations Manual.

6.4.13 Freedom of Information Act (FOIA) Office: DHA Freedom of Information (FOIA) procedures require a written request under the Act to be addressed to the FOIA Officer, DHA, 16401 East Centretech Parkway, Aurora, Colorado 80011-9066. The request shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. No more than ten working days shall elapse after a request has been received by the Freedom of Information Officer before notification is sent that the request has been granted or denied. The administrative time limit for responding to FOIA requests does not begin until the request is received by DHA.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference the Freedom of Information Act shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between DHA contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves under the Privacy Act procedures when those procedures are more advantageous to the requestor.

6.5 Enterprise-wide Contractor Manpower Reporting Application, Policy Alert 13-38 dated 13 May 2013, DPAP Memorandum dated 28 November 2012 and Policy Alert 13-59 dated 14 Aug 2013.

CONTRACTOR MANPOWER REPORTING FOR CONTRACT PERFORMANCE WORK STATEMENTS and Related Background Information

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Museum via a secure data collection site. The contractor is required to completely fill in all required data fields in the Enterprise-wide Contractor Manpower Reporting Application.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2017. Contractors may direct questions to the Enterprise-wide Contractor Manpower Reporting Application Help Desk.

PART 7

APPLICABLE PUBLICATIONS

7. Not Applicable

PART 8

ATTACHMENT/TECHNICAL EXHIBIT LISTING

8. Attachment/Technical Exhibit List:

0. Attachment 1/Technical Exhibit 1 – Performance Requirements Summary

0. Attachment 2/Technical Exhibit 2 – Deliverables Schedule

0. Attachment 3/Technical Exhibit 3 - Non Disclosure/ Non-Use Agreement

0. Attachment 4/Technical Exhibit 4 - Quality Assurance Surveillance Plan (QASP)

TECHNICAL EXHIBIT 1

Performance Requirements Summary The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

PRS # 1.

The contractor shall provide license renewal for 15 existing KE Emu software user licenses per PWS paragraph 5.5.

The contractor shall renew license

PRS # 2.

The contractor shall provide KE Emu software upgrades per PWS paragraph 5.2.

PRS # 3

The contractor will provide hotline support per PWS paragraph 5.3.

PRS # 4

The contractor will provide 10 site visits to be used per year on an as needed, on-call basis per PWS Paragraph 5.4

TECHNICAL EXHIBIT 2

DELIVERABLES SCHEDULE

Deliverable 1 The contractor shall provide license renewal for 15 existing user licenses per PWS paragraph 5.5 Annual

Deliverable 2 The contractor shall provide KE Emu software upgrades per PWS paragraph 5.2.

As necessary

1 original server and client executable files

COR

Deliverable 3 The contractor will provide report on status of Hotline support 5.3.

Deliverable 4 The contractor will provide 10 site visits to be used per year on an as needed, on-call basis per PWS Paragraph 5.4 As necessary

Deliverable 5 The Contractor shall submit Non-Disclosure/Non-Use Agreement (Technical Exhibit 3) signed by all staff assigned to or performing on this Task order per PWS paragraph 6.1

Deliverable 6 The Contractor will provide report consisting of the results of the quarterly FISMA assessment per PWS paragraph 6.4.6 Quarterly

Deliverable 7 Quality Control Plan Paragraph 1.6

Deliverable 8 System of Records Notices PWS 6.4.8

Deliverable 9 Privacy Impact Assessment Determination Checklist Paragraph 6.4.9

Deliverable 10 Data Sharing agreement application Paragraph 6.4.10

Deliverable 11 Certificate of training completion on US Privacy Act and HIPAA Paragraph 6.4.11

TECHNICAL EXHIBIT 3

NON-DISCLOSURE/ NON-USE AGREEMENT

Non-Disclosure Agreement for Contractor Employees and Subcontractors I, __________, am an employee of or a subcontractor to [Company Name], a Contractor acting under contract to the [DHA/NMHM] under Prime Contract No. ____, through Task Order ______. I understand that in the performance of this task, I may have access to sensitive or proprietary business, technical, financial, and/or source selection information belonging to the Government or other Contractors. This information includes, but is not limited to, cost/ pricing data; Government spend plan data; Planning, Programming, Budgeting and Execution (PPBE) documents and information, as defined in DoD Directive 7045.14; Contractor technical proposal data; independent government cost estimates; negotiation strategies and Contractor data presented in negotiations; contracting plans and statements of work. I agree not to use, discuss, divulge, or disclose any such information or data to any person or entity except those persons directly concerned with the use or performance of this delivery order. I have been advised that the unauthorized disclosure, use or negligent handling of the information by me could cause irreparable injury to the owner of the information. The injury could be source sensitive procurement information of the government or proprietary/trade secret information of another company.

I understand that the United States Government may seek any remedy available to it to enforce this Agreement, including, but not limited to, application for a court order prohibiting disclosure of information in breach of this agreement. Court costs and reasonable attorney fees incurred by the United States Government may be assessed against me if I lose such action. I understand that another company might file a separate claim against me if I have misused its proprietary information.

In the event that I seek other employment, I will reveal to any prospective employer the continuing obligation in this agreement prior to accepting any employment offer.

The obligations imposed herein do not extend to information/data which is:

a. in the public domain at the time of receipt or it came into the public domain thereafter through no act of mine;

b. disclosed with the prior written approval of the DHA designated Contracting Officer;

c. demonstrated to have been developed by [Company Name] , or me independently of disclosures made hereunder;

d. disclosed pursuant to court order, after notification to the DHA designated Contracting Officer;

e. disclosed inadvertently despite the exercise of the same reasonable degree of care a party normally uses to protect its own proprietary information.

I have read this agreement carefully and my questions, if any, have been answered to my satisfaction.

(Printed Name of Employee or Subcontractor) Date

(Signature) Organization

(Signature of Corporate Official) Date

(Printed Name of Corporate Official) (Printed Title –Task Manager or higher)

TECHNICAL EXHIBIT 4

Quality Assurance Surveillance Plan < This template has been developed to assist DHA requiring activities with creating a QASP. The purpose of the QASP is to provide the Government and Contractor with evaluation criteria that determine whether or not the performance standards for a specific contract have been met. IAW FAR 46.401 the QASP should be prepared in conjunction with the preparation of the statement of work. Complete as much development of the QASP as possible before contract award. Since the winning offeror; their key staff; and final performance standards are not known until after award, the QASP will remain in draft form until the contract is awarded.

The draft QASP (including the attached templates for Performance Report and Contract Discrepancy Report) (CDR) will be submitted with the requirement.

Upon contract award, you should finalize the draft QASP. The QASP is a “living document” and the Government may review and revise it as needed. >

For <enter contract title> Contract Number: < upon award, enter contract number> Contract Description: < enter Contract description > Contractor’s name: < upon award, enter Contractor name > (hereafter referred to as the Contractor).

1. PURPOSE. This Quality Assurance Surveillance Plan (QASP) provides a systematic method to evaluate performance for the stated contract. This QASP explains the following:

• What will be monitored.

• How monitoring will take place.

• Who will conduct the monitoring.

• How monitoring efforts and results will be documented.

This QASP does not detail how the Contractor accomplishes the work. Rather, the QASP is created with the premise that the Contractor is responsible for management and quality control actions to meet the terms of the contract. It is the Government’s responsibility to be objective, fair, and consistent in evaluating performance. In addition, the QASP should recognize that unforeseen and uncontrollable situations may occur.

This QASP is a “living document” and the Government may review and revise it on a regular basis to ensure that the QASP remains a valid, useful, and enforceable document. However, the Government will coordinate changes with the Contractor. Copies of the original QASP and revisions will be provided to the Contractor and Government officials implementing surveillance activities.

The following FAR clauses may apply…