1.0 GENERAL
The Defense Health Agency (DHA)
Records Management (RM) Office requires the contractor to manage Government
records in electronic format (reference this Addendum).
1.1 The contractor shall use the
acceptable storage media for any transfer of electronic records.
The acceptable storage media for electronic transfers are Compact
Disc-Read Only Memory (CD-ROM), Digital Versatile Disk-Recordable
(DVD-R), or on external terabyte drives. If there is a need for
other storage media not identified, contact the DHA Records Management
Officer (RMO).
1.2 The contractor
shall use the existing Standard Form 135 (SF-135) (Records Transmittal
and Receipt) to communicate specific transfer information for electronic
records. The SF-135 is specific to paper records; however, with
specific electronic record details in the same form (reference
Figure 9.B-1 for
more details) it may be used to initiate a request to transfer electronic
records.
1.3 The DHA RMO will receive the
SF-135 Portable Document Format (PDF) via email from the contractor. Once
the transfer is approved, the DHA RMO will send the annotated SF-135
PDF via email to the contractor.
1.4 The contractor
shall include the e-copy of the SF-135 PDF in the transfer package.
2.0 VALIDATOR UTILITY
2.1 Validator utility deployment
package and documentation will be provided by the DHA RMO to the contractor.
The purpose of the Validator utility is to provide the quality assurance
necessary to ensure trustworthy electronic records by performing
low-level validation, analyzing a sample of the records, identifying
the possible errors or omissions, and conducting a Validation Survey
for 20 randomly selected record objects.
2.2 The Validator
will produce an audit log to document the success of the transfer
package validation and this log is required as part of the final
transfer package.
2.3 The contractor
shall run the validator tool prior to shipping the transfer package
to DHA.
2.4 DHA will run the Validator
upon receiving the transfer package to perform the quality assurance
process.
2.5 DHA will send the errors to
the contractor for resolution. Updates to the Validator tool will
be provided by DHA to contractors as necessary.
3.0 TRANSFER
PACKAGE PREPARATION AND LABELING OF ELECTRONIC RECORDS
DHA accepts electronic record
transfers. An important aspect of preparing electronic records for
transfer is proper preparation. Improper preparation of the transfer
package may result in the transfer package being rejected by the DHA
RMO. The transfer package consists of the following files:
3.1 SF-135
(PDF Format)
The SF-135
provides details of the transfer package. An e-copy of SF-135 shall
be retained by the contractor so that documents needed for future
reference can be identified clearly by requesting officials.
3.2 eXtensible Markup Language
(XML) Transfer Specification File
This file displays, in XML
format, the information that the contractor provided on the SF-135
and the transfer number. It describes how to locate the Record Object
Metadata File (ROMF). DHA provides the XML file to the contractor.
3.3 ROMF
A character-delimited text
file that contains the metadata field values from each of the record
objects that is included in the transfer package. The metadata fields
are identified in the XML transfer specification file. In addition to
the identified metadata elements by the contractor, the Validator
also requires the following metadata fields:
3.3.1 The Record
Object File Type is Image, Text, or None.
3.3.2 The Record
Object File Name.
3.3.3 The Record
Object File Format. The acceptable Record Object File Formats are
TIF, TIFF, PDF (image based), JPEG, JPG, GIF, TXT, RTF, HTML, DOC,
DOCX, PDF (text based), XML, XLS, XLSX, CSV, MSG, PPT, PPTX, VSD,
or VSDX.
3.3.4 The Record Object File Format
Version.
3.3.5 The View Type tag is specific
to check record objects to indicate the front or back of the check
image. The values are FBW, BBW.
Note: The View Type tag is required
in the ROMF when a check image is broken down into two separate
record objects to indicate the front or back of the check. This
is not required when a check image is not separated into two record
objects. If View Type tag is available in the ROMF, the Validator
will display the front of the check image for the validation survey.
3.4 Record Objects
Electronic files that contain
a group of related information. The information can be formatted
as either text or images, and the computer file-type indicates the
format of the information. For example, scanned images are typically
stored in Tagged Image File Format (TIFF) or PDF files.
3.5 Audit Log of Validation
3.5.1 The Validator generates an
audit log file that provides detailed information about any ROMF
data errors, data entry errors that occurred during the validation
process and the final validation result.
3.5.2 When preparing
to transfer files for validation and the eventual transfer to the
media device, the user creates a folder on their computer and transfers
the XML Transfer Specification file, SF-135, ROMF, Audit Log file, and
Record Objects in a sub-folder to that folder. Contact the DHA RMO
for specific instructions for using the Validator utility.
3.5.3 The media device shall be encrypted
with password protection. After the electronic records are stored on
the media device, include the following information on the label:
• Contractor, region, and information.
• For Official Use Only (FOUO).
• Identify the sequential order
of the media set, if applicable (e.g., 1 of 10, 2 of 10, 3 of 10,
etc.).
• Include the date media was
created.
• File Numbers, transfer number(s),
and file formats.
3.5.4 For more
specific instruction on labeling of storage media, contact the DHA
RMO.
4.0 PREPARING TRANSMITTAL DOCUMENT
AND LOADING PACKAGE PROCESS
4.1 The contractor
shall obtain permission from DHA to transfer a group of records.
4.2 DHA will verify that the repository
has adequate storage space for the records and that the records
are structured in the manner to meet the DHA Electronic Records
Transfer requirements.
4.3 The DHA
has defined a process for transferring a group of records and it
is described in the following paragraphs. The process helps ensure
that the records meet the quality requirements and specifications.
Figure 9.B-1 illustrates
the SF-135 form described in
paragraphs 4.4 through
4.9 for
transferring electronic records to the DHA RM Office.
4.4 The contractor shall prepare
and email the SF-135 to the DHA RMO prior to shipping the electronic transfer
package when transferring electronic records to the DHA RM Office.
4.5 The contractor shall enter
the following: Defense Health Agency, ATTN: Records Management Office, 16401
East Centretech Parkway, Aurora, Colorado 80011-9066 in the SF-135
“To” block (Block 1).
4.6 The contractor
shall enter the records liaison details in the “Transferring Agency
Liaison Official” (Block 3).
4.7 The contractor
shall enter the contractor address, date, phone, email in the “From”
block (Block 5).
4.8 The contractor
shall state the storage size, and total number of rows in the metadata
file in the “Volume” (Block 6d) and the media details in the “Agency
Box Numbers” (Block 6e).
4.9 The contractor
shall state the contract number, file number, the description of
the records, closed date, specific metadata elements with indicators
for required and visible, and delimiter to create the metadata file
of the transfer package in the “Series Description” (Block 6f).
Instructions for completing the remainder of the form are printed
on the reverse side of the SF-135.
4.10 When records
are transferred, they must be scheduled for disposal using the applicable
disposition schedule referenced in DHA Records Disposition Schedule
(RDS). When the disposal authority is not cited, the SF-135 will
be returned for completion.
4.11 Upon receipt
of the SF-135, the DHA staff will review the SF-135 for completeness
for transfer. If approved, the DHA RMO will annotate the official
transfer number on the SF-135 and return the SF-135 to the contractor
for continued processing.
4.12 The original
SF-135 is retained by the DHA; one copy of the annotated SF-135,
showing transfer number(s) will be emailed to the contractor, indicating
the approval of the transfer.
4.13 The contractor
shall prepare the transfer package as referenced in
paragraph 3.0 and
the encrypted media shall be shipped to the DHA RMO in accordance
with Protected Health Information (PHI)/Personally Identifiable
Information (PII) guidance after receiving the copy of the approved
SF-135 PDF document.
4.14 The shipment
of the transfer package of electronic records shall be accomplished
as soon as the contractor has successfully run the Validator utility.
The contractor will receive the Validator Deployment package and
the installation instruction from the DHA RMO.
4.15 The contractor shall send the
transfer package to the DHA RMO after successful validation.
4.16 The DHA RMO uses the Validator
utility to verify that the transfer package meets the DHA Electronic Records
Transfer requirements and specifications.
4.17 If the
Validator identifies no errors, the DHA RMO proceeds to next step.
4.18 If the Validator identifies
one or more errors, the DHA RMO returns the transfer package to
the contractor for corrections.
4.19 The DHA
RMO adds the successful Validator audit log file to the transfer
package.
5.0 SHIPPING RECORDS
5.1 The contractor shall follow
the sensitive data (PII/PHI) transfer protocol instructions available
from the DHA RMO.
5.2 The contractor
shall ensure that all sensitive data that includes PII or PHI be
encrypted on the media device prior to shipping the transfer package
to DHA.
5.3 The contractor shall contact
the DHA RM Office for guidance on the use for sensitive data.
5.4 The contractor shall comply
with the following instructions:
5.4.1 Double
wrapping shall be used for shipment.
5.4.2 Recommended
shipment methods are United States Postal Service (USPS), FedEx,
and UPS along with the tracking number and delivery signature confirmation.
5.4.3 Use opaque envelopes or containers.
5.4.4 Complete Chain of Custody template
along with the paper copy of the SF-135.
5.4.5 Inner
envelope or container has classification and handling markings (i.e.,
unclassified, FOUO).
5.4.6 Outer
envelope or container has full address for DHA RMO.
5.4.7 Outer envelope or container
has no classification markings.
5.4.8 For hard
drive media encryption guidance contact the DHA RMO.
5.5 The contractor shall ship
non-sensitive data to DHA RMO using normal shipment methods and
sensitive data transfer protocol is not necessary.
6.0 RETRIEVING RECORDS
6.1 DHA provides reference services
which include search, retrieval, and providing authorized requesters with
a copy of the electronic records stored in the repository.
6.2 The contractor shall manage
the copy of an electronic record as a convenience copy and destroy
when no longer needed. Recall of an electronic record from DHA does
not include a permanent recall. If the content of the recalled record
is re-utilized for other business purposes, it becomes a new record
and shall be managed and maintained as such.
6.3 The best method to recall records
from DHA is with the use of the Optional Form 11 (OF-11) (Reference Request-Federal
Records Center). Use the electronic form OF-11 per request and email
it to the DHA RMO.
6.4 The contractor
shall provide the following information when preparing a reference
request:
• Transfer Number
• Metadata elements used for
Search Criteria
• File Number
• Description of Records or Information
Requested
• Name, Address, and Telephone
Number of Requester