A02_-_PWS_JPSR_-_(DRAFT).pdf

JPSR COTS PWS

W81XWH19R0053

Department of Defense (DoD) Defense Health Agency (DHA)

Joint Patient Safety Reporting (JPSR)

Commercial-Off-the-Shelf (COTS) Software Licenses and System Maintenance and Sustainment Services

J-6 Health Information Technology

Solution Delivery Division, Clinical Support Program Management Office, Health Care Delivery

Performance Work Statement

Version: 1 Date: 16 May 2019

PART 1

1.0 GENERAL INFORMATION

1.0 Scope

This award provides for the code maintenance, configuration management, and application support activities of a joint patient safety reporting solution that supports patient safety reporting business requirements of the DOD, VA, Navy Fleet, and TRANSCOM.

The configuration management scope of the work will be performed utilizing Agile methodology. Agile includes participation in user story and acceptance criteria development, participating in change request backlog grooming/scrubbing session, scrum meetings throughout each sprint, and Sprint Retrospective Reviews.

The Contractor shall obtain and maintain updated test PIV cards for the purpose of testing to ensure there is no negative impact to the VHA after an IAVA patch, iAS reboot/upgrade, and each JPSR release prior to and following go-live in the Production environment.

1.1 This is a non-personal services contract to purchase Datix Web enterprise software licenses with the developer supported license agreement and the required platform and software maintenance and sustainment services for the Joint Patient Safety Reporting (JPSR) information technology solution. JPSR provides the patient safety reporting and data analysis capabilities required by the Department of Defense (DoD) Defense Health Agency (DHA) and the Department of Veterans Affairs (VA) Veteran’s Health Administration (VHA).

1.2 Description of services/introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to deliver Datix, Incorporated Commercial Off the Shelf (COTS) enterprise software licenses for the DHA and the VHA and perform system maintenance and sustainment activities in the hosting environment designated by the DHA as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The Contractor shall perform to the standards in this performance work statement.

1.3 Background

The Patient Safety Reporting (PSR) system (DatixWeb) was fully deployed in 2010 as a tri-service web-based system to provide standardized patient safety event reporting and investigation data collection and data analysis capability, for the Military Health System’s (MHS) direct care facilities and theater operations. PSR provides analytic tools to identify areas for patient safety and quality improvement initiatives to achieve goals for reducing the frequency and severity of medical safety events.

W81XWH19R0053

1.3.1 Public Law (PL) 106-398 (Sec 742) established a requirement for the DOD and the VA to develop processes for sharing information regarding error tracking as it relates to patient care.

1.3.2 In 2014 a joint decision was fostered through the collaborative efforts of the DHA Patient Safety Program and the VA National Center for Patient Safety (NCPS) to seek Joint Incentive Funding (JIF) to pilot the PSR solution at VA medical facilities. A charter between the VA and DHA was established and executed by signature in October 2015. The charter establishes the direction for the VA to leverage the DHA PSR system to comply with Public Law (PL) 106-398 (Sec 742) and to gain a VA enterprise view of patient safety for the NCPS. The system, now commonly referred to as Joint Patent Safety Reporting (JPSR), was configured and deployed to all VA medical centers and subordinate clinics as a JIF project governed by the Heath Executive Committee (HEC). In August 2018, JPSR transitioned to a single sustainment effort after successfully completing the JIF project.

1.3.3 Additionally, JPSR has been configured for use by the Navy Fleet command and will incorporate Clinical Portfolio Management Board (CPMB) approved requirements for use by the United States Transportation Command (TRANSCOM) scheduled for deployment in third quarter Fiscal Year 2019.

1.4 Objectives

The Contractor shall provide the DatixWeb enterprise licenses with developer supported license agreement for the DHA and the VA, as well as the skilled resources to maintain and sustain the system in the designated hosting environment. Currently the system is hosted in the Defense Information Systems Agency’s Defense Enterprise Computing Centers in Oklahoma City, OK and San Antonio, TX. The Contractor shall:

Joint Objectives:

1. Provide the skilled cybersecurity resources to maintain system compliance for a Risk Management Framework Authority to Operate

2. Provide the necessary expertise to manage, alter, modify, and/or replace the proprietary code in which the application was written

3. Provide the skilled resources to respond to service desk inquires within the specified timeframes

4. Detail the annual license agreement to include all planned software releases

DHA Objectives:

1. Provide the license key and developer supported license agreement for the DHA

2. Provide the skilled technical resources to maintain and sustain the system for the DHA

3. Provide standardized training services and documentation for the DHA user community

VA Objectives:

1. Provide the license key and developer supported license agreement for the VA

2. Provide the skilled technical resources to maintain and sustain the system for the VA

3. Provide standardized training services and documentation for the VA JPSR user community.

1.5 Non-Personal Services. This award identifies services that are strictly non-personal in nature.

1.6 Severable / Non-Severable Services. This award identifies services that are severable in nature.

1.7 Inherently Governmental Functions. This requirement has been reviewed and contains no services that are inherently governmental functions.

1.8 Organizational Conflict of Interest (OCI) Category

The FAR Part 9.5 prescribes responsibilities, general rules, and procedures for identifying, evaluating, and resolving Organizational Conflict of Interest (OCI), provides examples to assist Contracting Officers in applying these rules and procedures to individual contracting situations; and implements section 8141 of the 1989 Department of Defense Appropriation Act. The two (2) underlying principles which the FAR seeks to avoid are preventing the existence of conflicting roles that might bias a Contractor's judgment and preventing unfair competitive advantage. An unfair competitive advantage exists where a Contractor competing for award of any Federal contract possesses --

(1) Proprietary information that was obtained from a Government official without proper authorization; or

(2) Source selection information (as defined in FAR 2.101) that is relevant to the contract but is not available to all competitors, and such information would assist that Contractor in obtaining the contract. The following subsections http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/02.htm#P10_603

W81XWH19R0053

prescribe certain limitations on contracting as the means of avoiding, neutralizing or mitigating organizational conflicts of interest.

It is the Contractor’s responsibility to notify the Contracting Officer of any potential OCI. In the event that an OCI exists the Contractor shall propose a Mitigation Plan that shall be reviewed and accepted by the Contracting Officer prior to continuance of the work that presents an OCI. Should the proposed Mitigation Plan not be accepted by the Contracting Officer, the Government may terminate this contract, disqualify the Contractor from subsequent related contractual efforts, and pursue any remedies as may be permitted by the law or this contract.

Contractors shall sign a Non-Disclosure Agreement at the start of their performance on the contract.

If, under this contract, the Contractor will provide systems engineering and technical direction for a system, but does not have overall contractual responsibility for its development, integration, assembly, checkout or production, the Contractor shall not be awarded a subsequent contract to supply the system or any of its major components, or to act as consultant to a supplier of any system, subsystem, or major component utilized for or in connection with any item or other matter that is (directly or indirectly) the subject of the systems engineering and technical direction. The term of this prohibition shall endure for the entire period of this contract and for two (2) years thereafter.

If, under this contract, the Contractor will prepare and furnish complete specifications covering non-developmental items, to be used in a competitive acquisition, the Contractor shall not be permitted to furnish these items, either as a prime or subcontractor. The term of this prohibition shall endure for the entire period of this contract performance and for either two (2) years thereafter or the duration of the initial production contract whichever is longer. This rule shall not apply to Contractors who furnish specifications or data at Government request or to situations in which Contractors act as Government representatives to help Government agencies prepare, refine or coordinate specifications, provided this assistance is supervised and controlled by Government representatives.

If, under this contract, the Contractor will prepare or assist in preparing a work statement to be used in competitively acquiring a system or services, the Contractor shall not supply the system, its major components, or the service unless the Contractor is the sole source, the Contractor has participated in the development and design work, or more than one Contractor has been involved in preparing the work statement. The term of this prohibition shall endure for the length of this contract.

If, under this contract, the Contractor will provide technical evaluation of products or advisory and assistance services, the Contractor shall not provide such services if the services relate to the Contractor's own or a competitor's products or services unless proper safeguards are established to ensure objectivity.

If, under this contract, the Contractor gains access to proprietary or source selection information of other companies in performing advisory assistance services for the Government, the Contractor agrees to protect this information from unauthorized use or disclosure and to refrain from using the information for any purpose other than that for which it was furnished. A separate agreement shall be entered into between the Contractor and the company whose proprietary information is the subject of this restriction. A copy of this agreement shall be provided to the Contracting Officer.

The Contracting Officer has significant discretion as to the acceptability of any mitigation plan offered.

Contractors are encouraged to present their best strategy for mitigation of any potential OCI under this contract. Contractors shall submit a mitigation plan at the Contract level and update it as often as necessary throughout the life of the Contract.

The Contracting Officer (and when applicable the appropriate program office, acquisition manager, and legal counsel) will review the comparative analysis and, if provided, the Avoidance or Mitigation Plan, in accordance with the requirements of FAR Subpart 9.5 (Organizational Conflict of Interest) to determine whether award to that Offeror would be consistent with those requirements and review as necessary throughout the life of the contract. If it is unilaterally determined by the Contracting Officer that no OCI would arise or that the OCI Avoidance or Mitigation Plan adequately protects the interests of the government in the event of award to that Offeror, the Offeror will be determined eligible for award. If the Contracting Officer reasonably determines that a Contractor has not

W81XWH19R0053

provided either a comparative analysis or avoidance/mitigation plan, or both, or that the analyses or plan provided is inadequate, sanctions including elimination from the award process, or termination of the related contract effort already awarded, as well as other appropriate sanctions will be considered.

If the Offeror/Contractor knows of no OCI in accepting work under this contract, it shall certify its OCI status and submit the certification with its proposal and any later award, if awarded the contract. The Contractor shall also obtain a similar certification of OCI status from all sub-Contractors, teaming partners or consultants prior to tasking any such party under this contract.

For breach of any of the above restrictions or for nondisclosure or misrepresentation of any relevant facts required to be disclosed concerning this contract, the Government may terminate this contract, disqualify the Contractor from subsequent related contractual efforts, and pursue any remedies as may be permitted by law or this contract.

Prior to a contract modification involving a change to the Performance Work Statement, or an increase in the level of effort or extension of the term of the contract, the Contractor shall submit any applicable organizational conflict of interest disclosure or an update of the previously submitted disclosure or representation.

1.9 Transition: Transition-in/transition-out period

1.9.1 Transition-in period. – Not Applicable

1.9.2 Transition-out period – Not Applicable

1.10 Administrative specifications

1.10.1 Place of performance. The work shall be performed at the Contractor’s facility in the Washington, DC, Metropolitan Area.

1.10.2 Recognized Federal holidays. The Contractor shall provide on-call emergency support on Federal holidays.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.10.3 Hours of operation. The Contractor is responsible for conducting business Monday thru Friday except

Federal holidays or when the Government is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.11 Emergency Services. On occasion, services may be required to support an activation or exercise of contingency plans outside other normal duty hours.

1.11.1 24/7 on-call emergency support, outside normal duty hours, is required to maintain JPSR availability around the clock for a world-wide user base. Additionally, schedule maintenance activities occurring outside normal duty hours require dedicated support from the appropriate tier III team member(s).

1.12 Conduct: Contractor personnel shall adhere to standards of conduct as established by the DHA Commander.

1.13 Contractor travel. The Contractor may be required to travel to attend meetings, conferences, and training events.

Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. Travel costs shall be incurred and billed in accordance with Federal Acquisition Regulation (FAR) Part 31. Costs for these expenses will be reviewed, certified and approved by the Contract Office Representative (COR). All travel and transportation shall utilize commercial sources and carriers. The Government will not pay for business class or first class travel. Lodging and meals shall be reimbursed in accordance with regulations defined in FAR PART 31.

W81XWH19R0053

DOD – Contractor location to DC VA – Contractor location to Ann Arbor, MI

# of People # of Trips # of People # of Trips

Base Period 2 4 2 2

Option 1 2 4 2 2

Option 2 2 4 2 2

Option 3 2 4 2 2

Option 4 2 4 2 2

1.14 Other Direct Costs (ODC):

1.14.1 ODCs shall be billed on a cost reimbursable basis. Costs are defined as the purchase price of materials or service plus General and Administrative charges (G&A) or material and handling charges (M&H). All ODCs shall be fully supported in compliance with all competition requirements of the FAR PART 19. All ODCs shall be reported as stated in the Monthly Progress Report (MPR).

The Contractor may be required to ship training materials to training locations in support of this PWS.

The Contractor may be required to pay postage and other costs associated with obtaining and maintaining the security clearance for each employee assigned to this project.

The Contractor may be required to pay postage and mailing material costs for securing and maintaining test PIV and CAC cards for end to end testing events.

The Contractor may be required to pay an annual subscription fee for a training video development/maintenance environment (e.g. VIMEO)

1.15 Quality

1.15.1 Quality Control Plan (QCP) (Deliverable 1). The Contractor shall prepare and adhere to a QCP. The

QCP shall be updated following contract award. The QCP shall document how the Contractor will meet and comply with the quality standards established in this statement of work. At a minimum, the QCP must include a self-inspection plan, an internal staffing plan, and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, customer satisfaction, and any other requirements set forth in this PWS.

1.15.2 Quality Assurance. The Government will evaluate the contractor’s monthly performance and review progress reports and will attend regular task performance review meetings with the Contractor to survey quality of products and services. The Government intends to utilize a Quality Assurance Surveillance Plan (QASP) to monitor the quality of the Contractor’s performance. The oversight provided for in the QASP will help to ensure that service levels reach and maintain the required levels throughout the contract term.

Further, the QASP provides the COR with a proactive way to avoid unacceptable or deficient performance, and provides verifiable input for the required Past Performance Information Assessments. The QASP will be finalized immediately following award and a copy provided to the Contractor after award. The QASP is a living document and may be updated by the Government as necessary.

1.16 Key personnel (Contractor). The Contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the CO. The contract manager or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 5:00 p.m. Eastern Time, Monday thru Friday except Federal holidays or when the government is closed for administrative reasons.

1.17 Data rights. Unless the Contracting Officer agrees in writing to different rights, the Government will be provided unlimited rights to all software, data, documentation, training material, etc. produced in performance of this task/effort.

W81XWH19R0053

1.18 Section 508 Requirement. The Contractor shall comply with Section 508 of the Rehabilitation Act of 1973

(29 U.S.C. 794d). Specifically, the procurement, development, maintenance, or integration of electronic and information technology (EIT) under this contract must comply with the applicable accessibility standards issued by the Architectural and Transportation Barriers Compliance Board at CFR part 1194.

1.19 Contractor Manpower Reporting (CMR). The Office of the Secretary of Defense (OSD) Personnel and

Readiness (P&R) operates and maintains a secure data collection site where the Contractor shall report Contractor manpower (including Subcontractor manpower). Purchases with a total contract value of $3 million or more for services in the following service acquisition portfolio groups: logistics management services, equipment related services; knowledge-based services; and electronics and communication services shall completely fill in all the information in the format using the following web address http://www.ecmra.mil/.

1.20 Non-Disclosure Agreement (NDA). All DHA Government Contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA Contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The Contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all Subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other Contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period.

Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor. The Contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR. Non-Disclosure Agreement (NDA) (Deliverable 2)

1.21 Contracting Officer Representative (COR). The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract;

perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notifies both the CO and Contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.22 Post award conference/periodic progress meetings. The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the CO will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.23 Integrated Master Schedule (IMS). The Contractor shall establish and maintain an IMS (Deliverable 3) in accordance with DID DI-MGMT-81650, "Integrated Master Schedule" and SDD guidance, to be used to verify the attainability of task order objectives, to evaluate progress toward meeting program objectives, and to integrate the program schedule activities with all related components. The IMS shall depict task order milestones, accomplishments, and discrete tasks/activities from task order award to the completion of task order.

1.24 Contingency Operations Plan (COP): The Contractor shall develop and submit a Contingency Operations

Plan (Deliverable 4) to the Government to specify planning for the remediation of specific systems, equipment, software, and/or operations in the event of critical impact resulting from natural, accidental, or http://www.ecmra.mil/

W81XWH19R0053

intentional events. The COP shall document Contractor plans and procedures to maintain DHA support during an emergency. The COP shall include the following:

• A description of the Contractor’s emergency management procedures and policy,

• A description of how the Contractor will account for their employees during an emergency,

• Planned temporary work locations or alternate facilities,

• How the Contractor will communicate with DHA during emergencies,

• A list of primary and alternate Contractor points of contact, each with primary and alternate:

o Telephone numbers, o E-mail addresses,

• Procedures for protecting Government furnished equipment (if any), and

• Procedures for safeguarding sensitive and/or classified Government information (if applicable).

1.25 Operations during Emergency Situations. Individual contingency operation plans shall be activated immediately after determining that an emergency has occurred, shall be operational within twelve (12) hours of activation, and shall be sustainable until the emergency situation is resolved and normal conditions are restored or the contract is terminated, whichever comes first. In case of a life threatening emergency, the COR will immediately make contact with the Contractor Task Manager to ascertain the status of any Contractor personnel who were located in Government controlled space affected by the emergency. When any disruption of normal, daily operations occur, the Contractor Task Manager shall promptly open an effective means of communication with the COR and verify:

• Key points of contact (Government and Contractor).

• Temporary work locations (alternate office spaces, telework, virtual offices, etc.).

• Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.).

• Essential work products expected to continue production by priority.

The Contractor’s Task Manager, in coordination with the COR, shall make use of the resources and tools available to continue DHA contracted functions to the maximum extent possible under emergency circumstances. The Contractor shall obtain approval from the COR and CO prior to incurring costs over and above those allowed for under the terms of this contract. Regardless of contract type, and of work location, Contractors performing work in support of authorized tasks within the scope of its contract shall charge those hours accurately in accordance with the terms of this contract.

1.26 Contractor Personnel Performance/Replacement. Substitutions of proposed Key Personnel shall not be allowed for a period of six months after award, except under extreme circumstances. Any substitution or replacement Key Personnel shall have the necessary experience/knowledge required to perform the duties in support of the tasks defined herein. For temporary and/or permanent replacement of Key Personnel, the Contractor shall provide a resume for each individual to the COR. Resumes shall be provided at least two weeks (or as mutually agreed upon) prior to making any personnel changes. The Government reserves the right to pre-approve any replacement or substitution of Key Personnel. Contractor personnel must submit necessary information to be issued a clearance prior to reporting for performance.

1.27 Kick-off Meeting and Program Reviews. The Contractor shall schedule and conduct a kick-off meeting in coordination with the Government within 5 days after contract award and annually at the beginning of each new period of performance. The Contractor shall meet with the Government to present an overview of their approach and establish schedules, procedures, and points of contact necessary to conduct the tasks outlined herein. This meeting shall not exceed two hours in length. The primary outcome of this meeting is to come to an agreement on the cost, schedule, and performance baselines. Kick-off Meeting / Program Review Briefing (Deliverable 5)

1.28 Integrated Baseline Reviews (IBRs). The Contractor shall convene an IBR, at the beginning of each period of performance or when contract modifications occur, to verify the technical content and the realism of the related performance budgets, resources, and schedules. The IBR shall provide for a mutual understanding of the inherent risks in Contractors’ performance plans and the underlying management control systems, and it should

W81XWH19R0053

formulate a plan to handle these risks. The IBR Process enables management to effectively utilize the project Performance Measurement Baseline (PMB) to assess performance, and to better understand inherent risks.

Integrated Baseline Review (IBR) (Deliverable 6)

1.29 Monthly Progress Review (MPR) Materials. The Contractor shall participate in routine meetings with a frequency of not less than monthly with the Government to review progress and status of activities under this contract. Each review shall provide insight into expenditures, staffing, progress, risks, and status of GFE, including Contractor purchased, Government owned items. The Contractor shall provide project briefings addressing cost/price, schedule, performance, and status of each key element of this PWS, noting any problems or risks, and alternative and recommended solutions. The Contractor shall provide a staffing report with the name, credentials, and cybersecurity certification date for each person performing on this contract. Monthly Progress Review Meeting Materials (Deliverable 7)

1.29.1 Performance Monitoring. The Contractor shall support the Government in measuring and monitoring the performance objectives of the SDD PEO. The Contractor shall report the assigned measurements monthly in the MPR (Deliverable 7). This includes identification of data tables that have been updated, assessments of the production system modifications and integration activities, releases planned and achieved, SIRs by products/components, DIT, DT&E, and SQT testing cycles, security testing cycles, technology training and certifications received, PIG completely and accurately guides operational deployments, and an itemization of ODCs billed.

1.30 Subcontracting Plan. Not Applicable.

1.30.1 Subcontract Expenditures Report. If Subcontractors are used, the Contractor shall prepare and deliver a Subcontract Expenditures Report (Deliverable 8) that discloses actual subcontract expenditures by company name, business size standard (i.e. Woman Owned Business, Veteran Owned Business, etc.), and other socioeconomic programs (i.e. Indian Incentive Program, Historically Black Colleges and Universities and Minority Institutions, etc.).

1.31 Lessons Learned. The Contractor shall provide the government with Lessons Learned Report (Deliverable

9) The document shall include, but not be limited to:

• The incident or accomplishment that occurred,

• The date of occurrence,

• The resolution and root cause,

• The lessons that were learned and how to avoid the incident or repeat the accomplishment in the future, and

• The lessons learned during the execution of any and all maintenance activities.

• Note that activity that leads to the lessons learned may impact a SOP and generate the need to generate and resubmit a SOP Deliverable.

1.32 Risk Management. The Contractor shall establish and maintain a Risk Management Program. The identified risks, risk assessments, and risk mitigation strategies must be documented in a Risk Management Plan (RMP) (Deliverable 10). The RMP shall assess identified risks by 1) the probability and consequences of occurrence, and 2) the impact of the identified risks on cost, schedule and performance. Risk mitigation strategies shall be developed and implemented for all risks identified.

1.33 Dissemination of Information/Publishing. There shall be no dissemination or publication, except within and between the Contractor and any Subcontractors or specified Integrated Product/Process Team (IPT) members who have a need to know, of information developed under this order or contained in the reports to be furnished pursuant to this order without prior written approval of the DHA COR or the CO. DHA approval for publication will require provisions which protect the intellectual property and patent rights of both DHA and the Contractor.

1.34 Contractor Employees Contractor Identification. The Contractor shall ensure that Contractor personnel identify themselves as Contractors when attending meetings, answering Government telephones, providing any

W81XWH19R0053

type of written correspondence, or working in situations where their actions could be construed as official Government acts.

1.35 Attendance at Meetings. Contractor personnel may be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their Contractor status known during introductions.

1.36 Use of Military Rank by Contractor Personnel. Contractor personnel, while performing in a Contractor capacity, are prohibited from using their retired or reserve component military rank or title in all written or verbal communications associated with the contract under which they provide services.

1.37 Performance Metrics Support. (Deliverable 11) The Contractor shall deliver reports attached to the Monthly

Progress Report in support of performance metrics:

1. Metrics to monitor Quality Assurance Surveillance Plan (QASP) contract performance progress

2. Releases planned and achieved

3. SIRs by products / components

4. DIT, DT&E, and SQT testing cycles

5. Security testing cycles

6. Technology training and certifications received

7. PIG completely and accurately guides operational deployments

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS

2.1 Definitions:

2.1.1 Category D. Information Technology and Telecommunications Services (called D-Services)

2.1.2 Category R. Support (Professional/Administrative/Managements) Services (called R-Services)

2.1.3 Contracting Officer (CO). A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR). An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the contracting officer to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Non-personal services contract. A contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance. The Government may either prepare the quality assurance surveillance plan or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.1.7 Contractor. A supplier or vendor awarded a contract to provide specific supplies or service to the government.

The term used in this contract refers to the prime.

2.1.8 Deliverable. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.9. Key Personnel. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as

W81XWH19R0053

an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.10. Physical Security. Actions that prevent the loss or damage of Government property.

2.1.11. Quality Assurance. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.13. Quality Control. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.14. Work Week. Monday through Friday, unless specified otherwise.

2.2 Acronyms:

AO Authorizing Official ATO Authority to Operate CAP Cloud Access Point CDRL Contract Data Requirement List CIO Chief Information Officer CJCSM Chairman of the Joint Chiefs of Staff Manual CND SP Computer Network Defense Service Provider CNSS Committee on National Security Systems CO Contracting Officer CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CS Contract Specialist CSP Cloud Service Provider CUI Controlled Unclassified Information DD 254 Department of Defense Contract Security Requirement List (if applicable) DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information Systems Agency DoD Department of Defense DoDI Department of Defense Instruction EULA End User License Agreements.

FAR Federal Acquisition Regulation FedRAMP Federal Risk Authorization and Management Program HIT Health Information Technology iRAPT Invoicing, Receipt, Acceptance, and Property Transfer (formerly Wide Area Work Flow) IA Information Assurance IS Information System IAVM Information Assurance Vulnerability Management JPSR Joint Patient Safety Reporting NDA Non-Disclosure Agreement NIST National Institute of Standards and Technology OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs P-ATO Provisional Authorization to Operate PA Provisional Authorization PHI Protected Health Information PII Personally Identifiable Information PK Public Key PKI Public Key Infrastructure

W81XWH19R0053

PMO Program Management Office POC Point of Contact PoP Period of Performance PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RMF Risk Management Framework SAR Security Assessment Report SP Special Publication SRG Security Requirements Guide(s) STIG Security Technical Implementation Guide(s) TE Technical Exhibit TOS Terms of Service

2.3 Applicable Publication

The following publications in their most current editions are applicable to this PWS:

• DODD 8320.1, “DOD Data Administration,” Mar 1994.

• DODD 5000.1, Defense Acquisition, (replaced the DOD Manual 8120.2, DODI 8120.2 and the

DODI 5000.2), change 1 – January 4, 2001.

• DOD Manual 8020.1-M, Functional Process Improvement, 7 January 2000

• DOD Regulation 5200.2-R, “DOD Personnel Security Program,” 9 April 1999

• Department of Defense Joint Technical Architecture, Version 3.0, January 28, 2000 (DISA web site).

• Principle Deputy Assistant Secretary for Health Affairs (PDASD-HA Memo, “Use of DOD Standards in MHS Migration Systems,” 11 March 1996

• MHS Architectural Framework, Version 2.1, July 1998

• Deputy Assistant Secretary of Defense for Health Budgets and Programs (PDASD-HBP Memo) “FY97

Defense Health Program (DHP) Funding Guidance - Revised,” 2 December 1996

• MHS Configuration Management Integration Plan of 10 January 1997

• MHS Minimum Server Hardware Requirements, December 2, 2000

• MHS Office Automation Guidance, September 7, 2000

• MHS Personal Computer Hardware Requirements, September 7, 2000

• MHS Minimum Standard Notebook Hardware, September 7, 2000

• Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance

(C4ISR) Architecture Framework

• Health Insurance Portability and Accountability Act of 1996 (HIPAA) and accompanying regulations.

Reference Documents The following documents may be helpful to the Contractor in performing the work described in this document:

Public Law 104-106: Clinger-Cohen Act of 1996, February 10, 1996 Health Insurance Portability and Accountability Act, 1996 Public Law 104-113: National Technology Transfer and Advancement Act of 1995. 104th Congress, March 7, 1996 Public Law 93-579: Privacy Act of 1974 Federal Information Security Management Act of 2002 DOD Architecture Framework Version 1.0, February 9, 2004 Global Information Grid (GIG) Capstone Requirements Document, 5 JROCM 134-01, August 30, 2001 Global Information Grid (GIG) Architecture Version 2.0, August 2003 CJCSI 3170.01D Joint Capabilities Integration and Development, March 12, 2004

W81XWH19R0053

CJCSM 3170.01A Operation of the Joint Capabilities Integration and Development System, March 12, 2004

CJCSI 6212.01C Interoperability and Supportability of Information Technology (IT) and National Security systems (NSS), November 20, 2003

DOD CIO Memo “Internet Protocol Version 6 Transition Guidance” 29 September 2003 DOD CIO Memo “Internet Protocol Version 6,” June 9, 2003 DOD CIO Memo “Department of Defense (DOD) Net-Centric Data Management Strategy:

Metadata Registration,” April 3, 2003 DOD Net-Centric Data Strategy, May 9, 2003 DOD CIO Memo “DOD Net-Centric Data Strategy: Visibility – Advertising Data Assets with

Discovery Metadata,” May 30, 2003 DOD CIO Memo “Department of Defense (DOD) Net-Centric Data Strategy: Visibility – Tagging and Advertising Data Assets with Discovery Metadata,” October 23, 2003 DOD Deputy CIO, Information Management Memorandum, “Department of Defense (DOD) Net-

Centric Data Strategy: Accessibility – Posting Data to Shared Spaces: Memoranda Coordination Request—Action Memorandum”, November 14, 2003

DOD Director, Information Management Memorandum, “Migration of DOD Data Dictionary System (DDDS) Data Assets --- DOD Metadata Registry and Clearing House”, November 24, Draft DOD Discovery Metadata Standard (DDMS), June 2, 2003 DODI 5200.40 DOD Information Technology Security Certification and Accreditation

Process (DITSCAP), December 30, 1997 DOD 5200.1-R Information Security Program, January 1997 DOD 5025.1-M DOD Directives System Procedures, March 3, 2003 DOD 5500.7-R Joint Ethics Regulation, Change 4, August 6, 1998 DOD 6015.1-M Glossary of Healthcare Terminology DOD Information Technology Standards Registry (DISR), Version 6.0, October 3, 2003 DOD Business Management Modernization Program, Systems Compliance Checklist, July 2004 DODD 4630.5 Interoperability and Supportability of Information Technology (IT) and National

Security systems (NSS), May 5, 2004 DODD 5000.1 Defense Acquisition Systems, May 12, 2003 DODD 8000.1 Management of DOD Information Resources and Information Technology, February

27, 2002 DODD 8100.1 Global Information Grid Overarching Policy, September 19, 2002 DODD 8500.1, Information Assurance, October 24, 2002 DODD 8500.2, Information Assurance (IA) Implementation, February 6, 2003 DODD 8100.2, Use of Commercial Wireless Devices and Services in the DOD Global Information

Grid, April 14, 2004 DODI 4630.8 Procedures for Interoperability and Supportability of Information Technology (IT) and National Security systems (NSS), June 30, 2004 DODI 5000.2 Operation of the Defense Acquisition System, May 12, 2003 IEEE Std. Series Joint Vision 2020, 7 “Future Warfare,” June 2000 NSTISSP No. 11, 4 National Policy Governing Information Assurance and Information

Assurance Enabled Information Technology Products, January 2000 Office of Management and Budget (OMB) Circular NO. A-130: Management of Federal

Information Resources, November 28, 2000 President’s Management Agenda, OMB Circular A-11, Part 7, Section 300, IB Secretary of Defense Memorandum, “Implementation of Subdivision E of the Clinger Cohen Act of

1996 (Public Law 104-106),” June 2, 1997 Secretary of Defense Letter, subject: “Business Management Modernization Program—System

Investment Certification/Approval,” July 16, 2004 DOD CIO Memorandum, “Global Information Grid Enterprise Services (GIG ES): Transforming to a Net-

Centric Environment—President’s Budget FY 2006-2011,” July 30, 2004

W81XWH19R0053

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3.1 Services: The Government will provide facilities, utilities, equipment and materials. The Contractor shall maintain a detailed inventory accounting system for Government Furnished Equipment/Material or Contractor- Acquired-Government Owned Property. The inventory accounting system must specify, as a minimum: product description (make, model), Government tag number, date of receipt, name of recipient, and location of receipt, current location, purchase cost, and contract/order number under which the equipment is being used. The Contractor shall either: a) attach an update inventory report to each monthly performance and progress report, or b) certify that the inventory has been updated and is available for Government review. In either case the Contractor’s inventory listing must be available for Government review within one business day of COR and/or Property Book Administrator request. The contractor is responsible for making the property available for use, such as payment of all transportation, installation or rehabilitation costs. The Property Book Administrator will perform quarterly inventory reports with which the contractor is required to comply.

3.2 Facilities: The Government will provide the necessary workspace for on-site Contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, supplies and other items necessary to maintain an office environment.

3.3 Utilities: The Government will provide all utilities required by the on-site Contractor in support of the required tasks outlined in this PWS (power, network, etc.) The Contractor shall instruct employees in utilities conservation practices. The Contractor shall be responsible for operating under conditions that preclude the waste of utilities.

3.4 Equipment: The Government will provide all office equipment required by the on-site Contractor in support of the requirements in this PWS to include laptops, shared printers, telephones, copiers, and desk/work space. For approved off-site personnel the Government will provide remote enabled laptops, docking stations, keyboard and monitors. The Government will provide laptops equipped with Common Access Card readers to enable staff secure access to the JPSR system hosted on the Defense Information System Agency, Defense Enterprise Computing Centers in San Antonio, TX and Oklahoma City, OK. The Government furnished property to be provided under this contract are detailed under Attachment 0001.

The Contractor shall maintain a detailed inventory accounting system for Government Furnished Equipment/Material or Contractor-Acquired-Government Owned Property (CAP). The inventory accounting system must specify, as a minimum, product description (make, model), Government tag number, date of receipt, name of recipient, location of receipt, current location, purchase cost (if CAP), and contract/order number under which the equipment is being used. The Contractor shall either (a) attach an update inventory report to each monthly performance and progress report or (b) certify that the inventory has been updated and is available for Government review. In either case, the Contractor’s inventory listing must be available for Government review within one (1) business day of the COR’s request. A GFE listing will be provided to the Contractor.

3.5 Materials: The Contractor shall provide any special office furniture/equipment that is required for employees who have special needs/health issues (e.g. specific chairs, keyboards, display screens that are above what the Government procures for Government civilians/Government facilities).

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to off-site personnel in support of the required tasks as outlined in the PWS.

4.2 Materials: The Contractor shall provide any special software, office furniture/equipment that is required for employees who have special needs/health issues (e.g. specific chairs, keyboards, display screens that are above what the Government procures for Government civilians/Government facilities).

W81XWH19R0053

4.3 Equipment: The Contractor shall provide any special office furniture/equipment that is required for employees who have special needs/health concerns (e.g. specific chairs, keyboards, display screens that are above what the Government procures for Government civilians/Government facilities).

4.4 Facilities: The Contactor shall provide the necessary workspace for off -site personnel. The Contractor will provide the support outlined in the PWS to include desk space, telephones, utilities, and supplies and other items necessary to maintain an office environment. For approved off site personnel the Contractor is responsible for providing appropriate network infrastructure (home internet, wireless, cable etc.) to allow off-site personnel to access, create, read, update, test, and document work to support tasks in the PWS. The contractor is responsible for coordinating with the Government any provisions for handicapped employees to include parking, accessibility to and from seating etc.

PART 5

5.0 SPECIFIC TASKS

5.1 Joint Patient Safety Reporting System (JPSR) software license renewal:

5.1.1 Defense Health Agency (DHA) Datix, Inc. enterprise license renewal with license agreement with associated software key to maintain current software version. . (Deliverable 12)

5.1.2 Veteran’s Health…