6640--554 (LAB) | NEW | RTPCR GI and Respiratory Testing

Form / Attachment / Pricing Sheet

This document is the Manufacturer Disclosure Statement for Medical Device Security (MDS2) form. It is designed to collect detailed information about the cybersecurity features and capabilities of medical devices. Bidders are expected to complete this form to disclose the security posture of any medical devices proposed as part of their solution.

The form is structured into several sections, each addressing specific security domains:

• Manufacturer Disclosure Statement (DOC): Basic manufacturer and device identification.
• Personally Identifiable Information (MPII): How the device handles, stores, and transmits PII/ePHI.
• Automatic Logoff (ALOF): Device's ability to prevent unauthorized access after inactivity.
• Audit Controls (AUDT): Capabilities for logging and auditing device activities.
• Authorization (AUTH): Mechanisms for user authentication and authorization.
• Cyber Security Product Upgrades (CSUP): Processes for updating security patches and software.
• Health Data De-Identification (DIDT): Capabilities for removing identifying information from health data.
• Data Backup and Disaster Recovery (DTBK): Procedures for data backup and recovery.
• Emergency Access (EMRG): Features for accessing data in emergency situations.
• Health Data Integrity and Authenticity (IGAU): Mechanisms to ensure data integrity.
• Malware Detection/Protection (MLDP): Capabilities for preventing, detecting, and removing malware.
• Node Authentication (NAUT): Device's ability to authenticate communication partners.
• Connectivity Capabilities (CONN): Information on hardware and network connections.
• Person Authentication (PAUT): Device's ability to authenticate users.
• Physical Locks (PLOK): Physical security measures for the device.
• Roadmap for Third Party Components (RDMP): Manufacturer's plans for supporting third-party components.
• Software Bill of Materials (SBOM): Listing of software components within the device.
• System and Application Hardening (SAHD): Device's resistance to cyber attacks.
• Security Guidance (SGUD): Availability of security documentation.
• Health Data Storage Confidentiality (STCF): Encryption and protection of data at rest.
• Transmission Confidentiality (TXCF): Ensuring the confidentiality of transmitted data.
• Transmission Integrity (TXIG): Ensuring the integrity of transmitted data.
• Remote Service (RMOT): Capabilities and security of remote maintenance.

Completion of this form is crucial for bidders to demonstrate compliance with cybersecurity requirements for medical devices. It allows the government to assess the security risks associated with proposed devices and ensure they meet necessary standards. Bidders must accurately fill out all relevant sections, indicating 'Yes', 'No', or 'N/A' and providing notes where necessary.

Statement of Work (SOW) / Performance Work Statement (PWS)

To procure firm-fixed price contract for Reverse Transcription Polymerase Chain Reaction (RT-PCR) GI and Respiratory Testing services for the Department of Veterans Affairs, Rocky Mountain VA Medical Center (RMRVAMC).

• Provide all equipment, reagents, standards, controls, supplies, and consumables for contractor-owned real-time PCR testing instruments.

• Offer RT-PCR testing for Gastrointestinal Panel (including specific bacteria and parasites) and Respiratory Panel (including SARS-CoV-2 and other common respiratory pathogens).

• Equipment must be FDA-Approved for specified assays, capable of producing accurate and reproducible results, and meet specific performance metrics (e.g., test results within 70 minutes, ≤3% run failure).

• Provide a service component for maintenance, repairs, upgrades, training, and quality control.

• Ensure equipment conforms to existing space and structural parameters (120 V, counter model fitting 14x14 inches).

• Offer equipment in current production, not discontinued or remanufactured models.

• Provide operator's manuals and editable electronic copies of operating procedures in CLSI format.

• Equipment must have a fully established VA VistA computer system interface via Data Innovations Middleware.

• Real-time PCR to deliver comprehensive results in about an hour, final result not more than 70 minutes.

• ≤3% run failure due to reagent/instrument failure (based on quarterly data).

• Equipment uptime of 95% in each month.

• Emergency repairs on-site within 24 hours of notification.

• Daily/weekly maintenance not more than 1-5 minutes.

• Location: Rocky Mountain Regional VA Medical Center (RMRVAMC), 1700 N. Wheeling Street, Aurora, CO, 80045.

• Transition period for installation and training: 30 calendar days after award.

• Full transition completion (including validations): 60 calendar days after award.

• Contractor must provide delivery, installation, set-up, validation, and method comparison studies at no additional charge.

• Hard drives must be removed and handed over for destruction upon equipment removal.

• Provide current waste stream analysis and Safety Data Sheets (SDS).

• All upgrades to equipment hardware and software must be provided at no additional cost within 60 days of commercial market issuance.

• Maintain a continuously stocked inventory of necessary materials on Government-provided space.

• Provide 24/7 technical support and on-site emergency repair service.

• Offerors must provide a plan for equipment installation and training with estimated dates.

• Contractor must notify the Contracting Specialist 60 days prior to ceasing testing of any assays.

Form / Attachment / Pricing Sheet

This document, Appendix A of VA Directive 6550, is a form to be completed for all procurements of network-connected medical devices and non-network-connected medical devices that store sensitive information. It is used to gather critical information about the device's technical specifications, security features, and integration capabilities to ensure compliance with VA security standards.

• Device Identification: Manufacturer, model, NSI number, application name and version, requesting service, facility information.
• Connectivity & Networking: Wireless support, FIPS 140-2/140-3 certification, operating system details, VLAN, IP address requirements, IPv6 support.
• Security Features: Patching capabilities (automated/manual), hardening guides, logging mechanisms, antivirus support, two-factor authentication, encryption methods, data storage at rest and in transit, Enterprise Risk Analysis (ERA) status.
• Integration: Support for HL7 interfaces, Cerner/EHRM integration, connection to VA networks (e.g., S2S VPN, Citrix).
• System Architecture: Server-based vs. client, cloud platform approval, approved VA ATO.

Bidders must understand that this form is a critical part of the procurement process for medical devices. Information provided on this form will directly impact the device's eligibility for procurement and its ability to integrate with existing VA systems. Failure to meet the requirements outlined in this appendix, particularly regarding security and operating system support, can lead to disqualification. Bidders should be prepared to provide detailed answers to these questions as part of their proposal or technical documentation.

Form / Attachment / Pricing Sheet

This document is an Excel spreadsheet containing line-item details for the opportunity. It provides specific information about the items being procured, including their descriptions, contract line item numbers (CLINs), contract periods, quantities, units of measure, and pricing information.

• Sheet: Action Line Item Information: Lists action types (e.g., RFQ) and associated identifiers.
• Sheet: Items: Details individual line items with descriptions (e.g., 'Gastrointestinal Panel', 'Respiratory Panel'), reference CLINs, contract periods ('Base'), quantities, units of measure, and associated Product/Service Codes (e.g., 334516, 6640).
• Sheet: RefData: Provides reference data for discount types, options, receipt types, FOB points, and state codes.
• Sheet: UOMRef: Lists units of measure and their corresponding values.
• Sheet: NAICS: Contains North American Industry Classification System (NAICS) codes and their descriptions.
• Sheet: PROD_SVC_CODE: Lists Product/Service Codes (PSCs) and their descriptions.
• Sheet: SIC_CODE: Lists Standard Industrial Classification (SIC) codes and their descriptions.
• Sheet: CLINICAL_DISCIPLINE: Lists clinical disciplines and their corresponding values.
• Sheet: LI_BASE_OR_OPTION: Defines whether a line item is for the Base or Option period.
• Sheet: LI_ITEM_TYPE: Categorizes line items by type (e.g., Dental, Lab, Medical).

This spreadsheet is crucial for bidders to understand the specific items being requested, their quantities, and the contract periods. It is essential for preparing accurate pricing and ensuring that the offered products or services meet the specified requirements. Bidders should pay close attention to the 'Items' sheet for detailed product information and the associated codes (PSC, NAICS, SIC) to ensure compliance and accurate categorization.

Solicitation / RFP / RFQ

This is a Request for Quote (RFQ) for a new five-year Blanket Purchase Agreement (BPA) for Reverse Transcription Polymerase Chain Reaction (RT-PCR) GI and Respiratory Testing services. The services will be provided to the Department of Veterans Affairs, Rocky Mountain Regional VA Medical Center (RMRVAMC) Pathology and Laboratory Medicine department.

• Contractor shall provide all equipment, reagents, standards, controls, supplies, consumable/disposable items, parts, accessories, and any other item required for the proper operation of its contractor-owned real-time polymerase chain reaction (PCR) testing instrument and peripherals.

• Services include generation of reportable patient test results for GI and Respiratory Testing.

• Refer to the attached Statement of Work (SOW) for detailed requirements.

• Contract Type: Firm-fixed price.

• Period of Performance: Five years (BPA).

• Delivery: F.O.B Destination to Aurora, CO 80045.

• Response Date/Time: April 22, 2026, 8:00 AM Mountain Time, Denver, USA.

• Questions Deadline: April 08, 2026, 8:00 AM Mountain Time.

• Submission Method: Email quotes to Alejandra.Sierra@va.gov and NCO19Lab@va.gov. No hand-carried or faxed quotes accepted. Maximum email size is 4MB.

• Evaluation Factors: The award will be made to the responsible offeror whose offer is most advantageous, considering the following factors: Technical capability/quality, BioMed Forms, Past Performance, and Price.

• Award Basis: All or Nothing Basis.

• This solicitation is unrestricted.

• NAICS Code: 621511 (Medical Laboratories) with a business size standard of $41.5 Million.

• This is a combined synopsis/solicitation prepared in accordance with FAR Part 12.

• Offerors must submit quotes in four volumes: Technical Capability, BioMed Forms, Past Performance, and Price.

• Specific forms (VA Directive 6550 App A Fillable 2026, MDS2-Worksheet 2026) and a Past Performance Questionnaire (PPQ) are required.

• Refer to attached documents: P09 Final SOW, Line-Item Schedule, MDS2-Worksheet, VA Directive 6550.