1.0 GENERAL
The Defense Health Agency (DHA)
Records Management (RM) Office requires the contractor to manage Government
records in electronic format (reference this Addendum).
1.1 The contractor shall use the
acceptable storage media for any transfer of electronic records.
The acceptable storage media for electronic transfers are Compact
Disc-Read Only Memory (CD-ROM), Digital Versatile Disk-Recordable
(DVD-R), or on external terabyte drives. If there
is a need for other storage media not identified The contractor
shall use the DoD SAFE, or shall contact
the DHA Records Management Officer (RMO) if there is
a need for other storage media not identified.
1.2 The contractor shall use the
existing Standard Form 135 (SF-135) (Records Transmittal and Receipt)
to communicate specific transfer information for electronic records.
The SF-135 is specific to paper records; however, with specific
electronic record details in the same form (reference
Figure 9.B-1 for
more details) it may be used to initiate a request to transfer electronic
records.
1.3 The DHA RMO will receive the
SF-135 Portable Document Format (PDF) via email from the contractor. Once
the transfer is approved, the DHA RMO will send the annotated SF-135
PDF via email to the contractor.
1.4 The contractor
shall include the e-copy of the SF-135 PDF in the transfer package.
2.0 VALIDATOR UTILITY2.1 Validator utility
deployment package and documentation will be provided by the DHA
RMO to the contractor. The purpose of the Validator utility is to
provide the quality assurance necessary to ensure trustworthy electronic
records by performing low-level validation, analyzing a sample of
the records, identifying the possible errors or omissions, and conducting
a Validation Survey for 20 randomly selected record objects.
2.2 The Validator
will produce an audit log to document the success of the transfer
package validation and this log is required as part of the final
transfer package.
2.3 The contractor
shall run the validator tool prior to shipping the transfer package
to DHA.
2.4 DHA
will run the Validator upon receiving the transfer package to perform
the quality assurance process.
2.5 DHA will send
the errors to the contractor for resolution. Updates to the Validator
tool will be provided by DHA to contractors as necessary.
2.0 TRANSFER PACKAGE PREPARATION
AND LABELING OF ELECTRONIC RECORDS
DHA accepts electronic record
transfers. An important aspect of preparing electronic records for
transfer is proper preparation. Improper preparation of the transfer
package may result in the transfer package being rejected by the DHA
RMO. The transfer package consists of the following files:
2.1 SF-135 (PDF Format)
The SF-135 provides details
of the transfer package. An e-copy of SF-135 shall be retained by
the contractor so that documents needed for future reference can
be identified clearly by requesting officials.
2.2 eXtensible Markup
Language (XML) Transfer Specification FileThis file displays,
in XML format, the information that the contractor provided on the
SF-135 and the transfer number. It describes how to locate the Record
Object Metadata File (ROMF). DHA provides the XML file to the contractor.
2.2 Record Object Metadata
File (ROMF
)A character-delimited
text fileAn excel spreadsheet in comma
separated values (csv) file format that contains the metadata
field values from each of the record objects that is included in
the transfer package. The metadata fields are identified
in the XML transfer specification file. In addition
to the identified metadata elements by the contractor, the Validator DHA also
requires the following metadata fields:
2.2.1 Frozen
Record. This field contains Yes or No.
2.2.2 The Record Object
File Type is Image, Text, or NoneFreeze
Numbers. This field contains Null or one
or more associated freeze numbers with an agreed upon delimiter
between the freeze numbers.
2.2.3 The Record
Object File Name.
2.2.4 The Record
Object File Format. The acceptable Record Object File Formats are
TIF, TIFF, PDF (image based), JPEG,
JPG, GIF, TXT, RTF, HTML, DOC, DOCX,
PDF (text based), XML, XLS, XLSX, CSV,
MSG, PPT, PPTX, VSD,
or VSDX.
2.2.5 The Record
Object File Format Version.
2.2.6 The
View Type tag is specific to check record objects to indicate the
front or back of the check image. The values are FBW, BBW.Note: The View Type tag is required in
the ROMF when a check image is broken down into two separate record objects
to indicate the front or back of the check. This is not required
when a check image is not separated into two record objects. If
View Type tag is available in the ROMF, the Validator will display
the front of the check image for the validation survey.
2.3 Record Objects
Electronic files that contain
a group of related information. The information can be formatted
as either text or images, and the computer file-type indicates the
format of the information. For example, scanned images are typically
stored in Tagged Image File Format (TIFF) or PDF files.
2.4 ReadMe FileReadMe file in word
format that describes the metadata identified for the transfer package
including all the file formats, possible special characters used
in the data, and a high- level overview of the records transfer.
2.5
Audit Log ofManual Validation
2.5.1 The Validator
generates an audit log file that provides detailed information about
any ROMF data errors, data entry errors that occurred during the
validation process and the final validation result.
2.5.1 When The
contractor shall manually validate the transfer package when preparing
to transfer files for validation and the eventual
transfer to the media device, the user creates a folder on their
computer and transfers the XML Transfer Specification file, SF-135,
ROMF, Audit Log file, and Record Objects in a sub-folder to that
folder to ensure the metadata in the ROMF
matches to the record objects and there are no data entry errors. Contact
the DHA RMO for specific instructions for using the Validator utility.
2.5.2 The media device shall be encrypted
with password protection. After the electronic records are stored on
the media device, include the following information on the label:
• Contractor, region, and information.
• For Official Use
Only (FOUO)Controlled Unclassified Information
(CUI).
• Identify the sequential order
of the media set, if applicable (e.g., 1 of 10, 2 of 10, 3 of 10,
etc.).
• Include the date media was
created.
• File Numbers, transfer number(s),
and file formats.
2.5.3 For more specific instruction
on labeling of storage media, contact the DHA RMO.
2.5.4 The contractor shall
encrypt records the Government approves for DoD SAFE transfer with
password protection.
2.6 Required/Visible MetadataThe contractor shall
include a list of the metadata elements included in the metadata
file with required and visible indicators in the electronic SF-135.
The required indicator denotes the metadata contains a value. The
values are True (T) or False (F). The visible indicator denotes
the metadata is visible on the record object. The values are True (T)
or False (F). An electronic copy shall be retained by the contractor
so that documents needed for future reference can be identified
clearly by requesting officials.
3.0 PREPARING TRANSMITTAL DOCUMENT
AND LOADING PACKAGE PROCESS
3.1 The contractor shall obtain
permission from DHA to transfer a group of records.
3.2 DHA will verify that the repository
has adequate storage space for the records and that the records
are structured in the manner to meet the DHA Electronic Records
Transfer requirements.
3.3 The DHA has defined a process
for transferring a group of records and it is described in the following paragraphs.
The process helps ensure that the records meet the quality requirements
and specifications.
Figure 9.B-1 illustrates the SF-135 form described
in
paragraphs 4.4
paragraphs 3.4 through
4.9
3.9 for
transferring electronic records to the DHA RM Office.
3.4 The contractor shall prepare
and email the SF-135 to the DHA RMO prior to shipping the electronic transfer
package when transferring electronic records to the DHA RM Office.
3.5 The contractor shall contact
the DHA recipient office for the office address to enter the
following: Defense Health Agency, ATTN: Records Management Office,
16401 East Centretech Parkway, Aurora, Colorado 80011-9066 in the
SF-135 “To” block (Block 1).
3.6 The contractor shall enter
the records liaison details in the “Transferring Agency Liaison
Official” (Block 3).
3.7 The contractor shall enter the
contractor’s name, address, date, phone,
email, and date in the “From” block (Block
5).
3.8 The contractor shall state
the storage size, and total number of rows in the metadata file
in the “Volume” (Block 6d) and the media details in the “Agency
Box Numbers” (Block 6e).
3.9 The contractor shall state the
contract number, region, file number, the
description of the records, closed date, specific metadata elements
with indicators for required and visible, and delimiter to create
the metadata file of the transfer package in the “Series Description”
(Block 6f). Instructions for completing the remainder of the form are
printed on the reverse side of the SF-135.
3.10 When records are transferred,
they must be scheduled for disposal using the applicable disposition schedule
referenced in DHA Records Disposition Schedule (RDS). When the disposal
authority is not cited, the SF-135 will be returned for completion.
3.11 Upon receipt of the SF-135,
the DHA staff will review the SF-135 for completeness for transfer.
If approved, the DHA RMO will annotate the official transfer number
on the SF-135 and return the SF-135 to the contractor for continued
processing.
3.12 The original SF-135 is retained
by the DHA; one copy of the annotated SF-135, showing transfer number(s)
will be emailed to the contractor, indicating the approval of the
transfer.
3.13 The contractor shall prepare
the transfer package as referenced in
paragraph 3.0
paragraph 2.0 and
the encrypted media shall be shipped
, or the encrypted
files be transferred to the DHA
RMO in
accordance with Protected Health Information (PHI)/Personally Identifiable
Information (PII) guidance recipient office
as referenced in paragraph 4.0 after receiving
the copy of the approved SF-135 PDF document.
3.14 The shipment
of the transfer package of electronic records shall be accomplished
as soon as the contractor has successfully run the Validator utility.
The contractor will receive the Validator Deployment package and
the installation instruction from the DHA RMO.
3.15 The contractor
shall send the transfer package to the DHA RMO after successful
validation.
3.14 The DHA RMO recipient
office uses the Validator utility to ROMF
to search, locate, and access the records and verify
that the transfer package meets the DHA Electronic Records Transfer
requirements and specifications.
3.15 If the Validator
identifies no errors, the DHA RMO proceeds to next step.
3.15 If the Validator DHA
recipient office identifies one or more errors, the
DHA RMO recipient office communicates
errors and returns the transfer package to the contractor
for corrections.
3.17 The
DHA RMO adds the successful Validator audit log file to the transfer
package.
4.0 SHIPPING RECORDS
4.1 The contractor shall follow the
sensitive data (Protected Health Information (PHI)/Personally
Identifiable Information (PII)/PHI)
transfer protocol instructions available from the DHA RMO.
4.2 The contractor shall ensure
that all sensitive data that includes PII or PHI be encrypted on
the media device prior to shipping the transfer package to DHA.
4.3 The contractor shall contact
the DHA RM Office for guidance on the use for sensitive data.
4.4 The contractor shall comply
with the following instructions:
4.4.1 Double wrapping shall be used
for shipment.
4.4.2 Recommended shipment methods
are United States Postal Service (USPS), FedEx, and UPS along with the
tracking number and delivery signature confirmation.
4.4.3 Use opaque envelopes or containers.
4.4.4 Complete Chain of Custody template
along with the paper copy of the SF-135.
4.4.5 Inner envelope or container has
classification and handling markings (i.e., unclassified, FOUO CUI).
4.4.6 Outer envelope or container has
full address for DHA RMO recipient
office.
4.4.7 Outer envelope or container
has no classification markings.
4.4.8 For hard drive media encryption
guidance contact the DHA RMO.
4.5 The contractor shall ship non-sensitive
data to DHA RMO recipient
office using normal shipment methods and sensitive data
transfer protocol is not necessary.
4.6 The contractor shall
transfer records to the DHA recipient office using DoD SAFE if approved
by the DHA recipient office. The contractor shall encrypt all the
record transfers using DoD SAFE.
5.0 RETRIEVING RECORDS
5.1 DHA provides reference services
which include search, retrieval, and providing authorized requesters with
a copy of the electronic records stored in the repository.
5.2 The contractor shall manage
the copy of an electronic record as a convenience copy and destroy
when no longer needed. Recall of an electronic record from DHA does
not include a permanent recall. If the content of the recalled record
is re-utilized for other business purposes, it becomes a new record
and shall be managed and maintained as such.
5.3 The best method to recall records
from DHA is with the use of the Optional Form 11 (OF-11) (Reference Request-Federal
Records Center). Use the electronic form OF-11 per request and email
it to the DHA RMO.
5.4 The contractor shall provide
the following information when preparing a reference request:
• Transfer Number
• Metadata elements used for
Search Criteria
• File Number
• Description of Records or Information
Requested
• Name, Address, and Telephone
Number of Requester