Sources Sought Notice – 70– PR# 629-16-2-7224-0117, Project Legacy, Sup PACS Cardiovascular Info System
Notice Type: Sources Sought Notice
Posted Date:
Office Address:
Subject: 70-- PR# 629-16-2-7224-0117, Project Legacy, Sup PACS Cardiovascular Info System
Classification Code: 70 - General purpose information technology equipment
Solicitation Number: VA25616Q0445
Contact: Paul G FilhiolContracting Officer 318-990-4088 mailto:paul.filhiol@va.gov
Setaside: Total Small BusinessTotal Small Business
Place of Performance (address):
Place of Performance (zipcode): 70119
Place of Performance Country:
Description:
Shreveport VAMC
STATEMENT OF OBJECTIVES (SOO)Cardiovascular Information System
1. Program Objective
1.1 Contractor shall provide all equipment, labor, material, warranty, installation, technical and clinical user training, and supplies necessary to provide a fully functional cardiovascular information management system solution, to the
2. Scope:
2.1 The contractor shall provide a comprehensive turnkey solution that enables SLVHCS to improve clinical care by improving access to information within multiple assigned areas: The information system must be designed to interface and integrate in multiple locations and within multiple modalities utilizing the most recent technology and hardware prior to the installation of the equipment. The overall purpose of the system is to allow clinicians to streamline workflow by utilizing a single application for viewing images and generating reports across a variety of equipment and modalities in one workspace. The system will be utilized for echocardiograms, cardiac catheterizations, cardiac nuclear stress tests, electrophysiology, cardiac magnetic resonance imaging, and cardiac computed tomography. It will facilitate comprehensive care for patients. The system must link with existing Vista and CPRS systems. This system will allow us to facilitate comprehensive care for our patients as we can review all cardiac imaging modalities on the same system without having to use multiple work stations.
These are the areas, which require the system.
2.2.1 Operating rooms
2.2.2 Echo reading room
2.2.3
2.2.4 Intensive Care Unit
2.2.5 Emergency room
2.2.6 Cardiology clinic
2.3 The integration system must permit maintenance professionals the ability to connect to the Integration system to perform diagnostics, troubleshooting, and maintenance.
2.3.1 Preventive Maintenance:
2.3.1.1 The vendor must have preventative maintenance service to meet at minimum
2.3.2 Corrective Maintenance and Updates:
2.3.2.1 The vendor must currently have, or being the process to provide
2.4 The operating system must be equivalent to Windows 7 or newer.
2.5 The information system must operator 24 hours a day, 7 days a week.
2.6 The contractor shall provide a training program to Biomedical Engineering and in-house personnel.
2.7 The vendor shall provide a warranty.
2.8 DELIVERY, INSTALLATION AND IMPLEMENTATION
2.8.1 DELIVERY
2.8.1 DELIVERY
2.8.1.1 Contractor shall deliver all equipment to the
2.8.1.2 Deliver materials to job in manufacturer's original sealed containers with brand name marked thereon.
2.8.1.3 Package to prevent damage or deterioration during shipment, handling, storage, and installation. Maintain protective covering in place and in good repair until removal is necessary.
2.8.1.4 Deliver specified items only when the site is ready for installation work to proceed.
2.8.1.5 Store products in dry condition inside enclosed facilities.
2.8.1.6 Any government requested delayed delivery up to 90 days after initial award delivery date, shall be at no additional cost to the Government.
2.8.1.7 A pre-delivery meeting will be conducted 60 days prior to initial award delivery date for verification of delivery and installation dates.
2.8.1.8 Delivery and Installation will be coordinated through the COR.
2.8.2 INSTALLATION AND IMPLEMENTATION
2.8.2.1 The contractor shall provide installation and implementation project management to include site visits for each building to confirm physical installation of the Integration system, including networked components. Contractors shall provide a final project schedule within 30 days of award.
2.8.2.2 The hospital is responsible for furnishing all conduit and raceways unless specified otherwise on the delivery order.
2.8.2.3 The contractor shall be responsible for all equipment until installed and accepted by the Government.
2.8.2.4 All required equipment shall be fully installed by the Contractor, to include painting and patching of walls penetrated by the Contractor.
2.8.2.5 The Contractor shall remove all related shipping debris and cleanup, any construction associated with delivery and installation of the specified items. Contractor shall remove all packaging from the SLVHCS premises. The Contractor shall be responsible for any damage to the building that occurs due to Contractor error or neglect.
2.8.2.6 Delivery and unloading shall be at the Central Energy Plant loading docks off of
2.8.2.7 The contractor shall coordinate all deliveries, staging areas, installations, and parking arrangements with the COR.
2.8.2.8 Upon coordination with COR for installation, the contractor shall inform the Contracting Officer of any problems which may be anticipated in connection with installation or which will affect optimum performance once installation is completed.
2.8.3 INSTALLATION SCHEDULE
2.8.3.1 The area will be available for installation and training from
2.8.3.2 Phasing Schedule:
" Final Approved Schedule: 10 Days after Award
" Network Design Plan: 30 Days after Award
" Physical Installation: 75 Days after Award, but the installation cannot occur until the Network Plan is approved by the COR
" Implementation: 75 Days after Training
" 90 Days after completion of Installation and Implementation
2.8.4 SITE CONDITIONS
2.8.4.1 There shall be no smoking, eating, or drinking inside the hospital at any time.
3. PERIOD OF PERFORMANCE:
3.1 The anticipated Period of Performance for delivery and installation is from
3.2 The anticipated period of performance for support services is
4. INSPECTION AND ACCEPTANCE
4.1 The Contractor shall conduct a joint inspection with the COR once all equipment had been delivered and installed. The COR shall inspect all phases of delivery and installation and provide a punch list of any and all missing or damaged products.
4.2 Contractor shall provide dates of completion of punch list items and replacement parts and/or short ship items from the manufacturer(s).
4.3 The COR shall ensure all work is completed satisfactorily prior to acceptance. Disputes shall be resolved by the Contracting Officer.
5. DELIVERY/STORAGE REQUIREMENTS
5.1 Deliver materials to job in manufacturer's original sealed containers with brand name marked thereon.
5.2 Package to prevent damage or deterioration during shipment, handling, storage and installation. Maintain protective covering in place and in good repair until removal is necessary.
5.3 Deliver specified items only when the site is ready for installation work to proceed.
5.4 Store products in dry condition inside enclosed facilities.
5.5 Any government requested delayed delivery up to 90 days after initial negotiated delivery date, shall be at no additional cost to the Government.
5.6 A pre-delivery meeting will be conducted 60 days prior to initial negotiated delivery date for verification of delivery and installation dates.
6. DELIVERABLES
6.1 The contractor shall provide a proposed network design to be approved by the COR.
6.2 Contractor shall provide documentation of the network and include a marked up drawing (as built) showing jacks and room locations after the installation is complete.
6.3 The Contractor shall provide a Final Schedule that can be imported into
6.4 User and Service Manuals
6.4.1 The Contractor shall provide, at no charge, two (2) complete and unabridged printed copies and one (1) electronic version (CD) of operator manuals, service manuals, electronic schematics, troubleshooting guides and parts lists for each model of equipment purchased to the Contracting Officer's Representative (COR) with delivery of equipment. Additionally the Contractor free of charge shall provide any upgrades to these documents. These manuals will include all components and subassemblies, including those not manufactured by the Contractor. These manuals and documentation shall contain the diagnostic codes, commands, and passwords utilized in maintenance, repair and calibration of the equipment.
7. PROTECTION OF PROPERTY
7.1 Contractor shall protect all items from damage. The Contractor shall take precaution against damage to the building(s), grounds and furnishings. The Contractor shall repair or replace any items related to building(s) or grounds damaged accidentally or on purpose due to actions by the Contractor.
7.2 The Contractor shall perform an inspection of the building(s) and grounds with the COR prior to commencing work. To insure that the Contractor shall be able to repair or replace any items, components, building(s) or grounds damaged due to negligence and/or actions taken by the Contractor. The source of all repairs beyond simple surface cleaning is the facility construction contractor (or appropriate subcontractor), so that building warranty is maintained. Concurrence from the VA Facilities Management POC and COR is required before the Contractor may perform any significant repair work. In all cases, repairs shall utilize materials of the same quality, size, texture, grade, and color to match adjacent existing work.
7.3 The Contractor shall be responsible for security of the areas in which the work is being performed prior to completion.
7.4 Contractor shall provide floor protection while working in all
8. PERFORMANCE REQUIREMENTS SUMMARY
8.1 The Contractor shall provide a proposed Performance Requirements Summary (PRS) for review and approval.
9. SECURITY REQUIREMENTS
9.1 Contractor is responsible for notifying COR for escorting duties prior to arriving at the facility. Contractor personnel shall check in with
9.2 Contractor is responsible for notifying COR for vehicle parking prior to arriving at the facility. All contractor personnel must provide vehicle insurance, registration and valid driver's license at the time of check-in to receive a vehicle-parking pass. Vehicle parking passes must be displayed on the front dashboard of the registered vehicle at all times while on SLVHCS property. Contractor personnel will be allowed to register up to five (5) vehicles only. All contractor personal vehicles will be allowed to park in the designated vehicle parking spaces in the parking garage as advised by the
9.3 Information System Security/Privacy Language:
1. SECURITY CLAUSE:
"A&A requirements do not apply'ecurity Accreditation Package is not required".
2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS
a. A Contractor/Subcontractor shall request logical (technical) or physical access to
b. All Contractors, Subcontractors, and third-party servicers and associates working with
c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared
d. Custom software development and outsourced operations must be located in the
e. The Contractor or Subcontractor must notify the Contracting Officer immediately when an employee working on a
3. VA INFORMATION CUSTODIAL LANGUAGE
a. Information made available to the contractor or subcontractor by
b.
c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from
d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of
e. The contractor/subcontractor shall not make copies of
f. If
g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.
h. The contractor/subcontractor must store, transport, or transmit
i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed
j. Except for uses and disclosures of
k. Notwithstanding the provision above, the contractor/subcontractor shall not release
l. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with
The options are:
(1) Vendor must accept the system without the drive;
(2)
(3)
(4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the
(a) The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact;
(b) Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using
(c) A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed.
The ISO needs to maintain the documentation.
4. SECURITY INCIDENT INVESTIGATION
a. The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to
b. To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to
c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.
d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with
5. LIQUIDATED DAMAGES FOR DATA BREACH
a. Consistent with the requirements of 38 U.S.C. --5725, a contract may require access to sensitive personal information. If so, the contractor is liable to
b. The contractor/subcontractor shall provide notice to
c. Each risk analysis shall address all relevant information concerning the data breach, including the following:
(1) Nature of the event (loss, theft, unauthorized access);
(2) Description of the event, including:
(a) Date of occurrence;
(b) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;
(3) Number of individuals affected or potentially affected;
(4) Names of individuals or groups affected or potentially affected;
(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;
(6) Amount of time the data has been out of
(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);
(8) Known misuses of data containing sensitive personal information, if any;
(9) Assessment of the potential harm to the affected individuals;
(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and
Privacy Incidents, as appropriate; and
(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.
d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the
consisting of the following:
(1) Notification;
(2) One year of credit monitoring services consisting of automatic daily monitoring of at least
3 relevant credit bureau reports;
(3) Data breach analysis;
(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;
(5) One year of identity theft insurance with
(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.
6. CONFIDENTIALITY AND NONDISCLOSURE
It is agreed that:
a. The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by the
b. The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to this task order presented to the contractor shall be submitted to the CO for response.
c. Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the CO.
7. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE
g. All electronic storage media used on non-
that is used to store, process, or access
Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the
contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any
person acting on behalf of the contractor/subcontractor, whichever is earlier. Media (hard
drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/subcontractors that
contain
contractor/subcontractor must self-certify that the media has been disposed of per 6500.1
requirements. This must be completed within 30 days of termination of the contract.
h. Bio-Medical devices and other equipment or systems containing media (hard drives,
optical disks, etc.) with
of lease, for trade-in, or other purposes. The options are:
(1) Vendor must accept the system without the drive;
(2)
place of the original drive at time of turn-in; or
(3)
cost at time of purchase.
(4) Due to the highly specialized and sometimes proprietary hardware and software
associated with medical equipment/systems, if it is not possible for the
drive, then;
(a) The equipment vendor must have an existing BAA if the device being traded in has
sensitive information stored on it and hard drive(s) from the system are being returned
physically intact; and
(b) Any fixed hard drive on the device must be non-destructively sanitized to the greatest
extent possible without negatively impacting system operation. Selective clearing down to
patient data folder level is recommended using
technologies/methods/tools. Applicable media sanitization specifications need to be preapproved
and described in the purchase order or contract.
(c) A statement needs to be signed by the Director (System Owner) that states that the
drive could not be removed and that (a) and (b) controls above are in place and completed.
The ISO needs to maintain the documentation.
8. TRAINING
a. All Contractor employees and Subcontractor employees requiring access to
a. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix D relating to access to
b. Successfully complete the VA Privacy and Information Security Awareness and Rules of Behavior training and annually complete required security training;
c. Successfully complete VHA Privacy Policy Training if Contractor will have access to PHI;
d. Successfully complete the appropriate
e. Successfully complete any additional cyber security or privacy training, as required for
a. The Contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.
b. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.
a.
There is only one course the contractor needs to complete and print the certificate at the end. A copy of the completed certificate must be submitted before work begins (within 5 business days of contract award).
Instructions to get to the Courses in TMS
Log onto the site (www.tms.va.gov) and create a new user account; if you already don't have one. Search for your course entitled VA Privacy and Information Security Awareness and Rules of Behavior. Complete course, print certificate (s), and sign/print contractor rules of behavior.
Help Desk: 1-866-496-0463
Examples:
VA Privacy and Information Security Awareness and Rules of Behavior
9. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS
a. The following security requirement must be addressed regarding Contractor supplied equipment: Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a)
b. All contractor employees who require access to the
c. The investigative history for contractor personnel working under this contract must be maintained in the databases of either the
10. REFERENCE (S):
1. VA Affairs Handbook 6500, Risk Management Framework for VA Information Systems - Tier 3: VA Information Security Program,
2. Veterans Health Administration Procurement Manual (VHA PM) - 11/3/2014.
3. VA Handbook 1901.01, Health Information Management and Health Records -
4. VHA Handbook 1605.5, Business Associate Agreements -
5. Memo: VA Maintenance/Installation (Warranty) Contracts (VAIQ 7058822),
6. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, dated
7. Veterans Affairs Handbook 6500.6 Contract Security,
8. Health Insurance Portability & Accountability Act (HIPAA) Privacy Rule (See 45 CRF 164, 502(a)(1).
9. VA Directive 0710, Personnel Security and Suitability Program, dated
10. VA Directive 6066, Protected Health Information.
11. Privacy Act of 1974 (5 U.S.C. 552a).
12. Homeland Security Presidential Directive (HSPD-12),
13. Federal Information Processing Standards Publication (FIPS) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, dated
14. Social Security Act (42 U.S.C. '' 1395x(u)): Health care and other related services, as mentioned in HIPAA regulations, are defined in detail under Section 1861(s) http://www.ssa.gov/OP_Home/ssact/title18/1861.htm.
15. VA Directive 6512, Secure Wireless Technology, dated
Link/URL: https://www.fbo.gov/spg/VA/ShVAMC/VAMCLAOBrooks/VA25616Q0445/listing.html
Combine Solicitation – 65– Radiopharmaceuticals Nuclear Medicine and PET/CT IMAGING FSS RFQ
Payment for Physician and Other Health Care Professional Services Purchased by Indian Health Programs and Medical Charges Associated With…
Advisor News
- Flourish brings private-bank-like cash solution to MassMutual’s network
- Majority of Americans concerned recent market highs are unsustainable
- GLP-1 users choose between medication and retirement saving
- Gen X and millennials seek new retirement model
- Are families ready for the costs of aging at home?
More Advisor NewsAnnuity News
- Corebridge Financial Introduces Progressive Trigger, a First-of-Its-Kind Index Annuity Strategy Designed to Turn Missed Years into Future Opportunity
- Insurer proposes $1.1M deal to resolve CA teachers’ annuity fee lawsuit
- IMOs get frustrated with slow carrier adoption of faster technology
- New class-action lawsuit targets Delaware Life over annuity disclosures
- A client remarried: Does their annuity still fit?
More Annuity NewsHealth/Employee Benefits News
Life Insurance News