001 - VA EHRM IDIQ PWS Modification P00008.pdf

Performance Work Statement (PWS) for the

VA Electronic Health Record Modernization System

ORIGINAL DATE: April 17, 2017 Version 3.0

AMENDMENT 01 DATE: November 7, 2017

AMENDMENT 02 DATE: November 20, 2017

AMENDMENT 03 DATE: February 16, 2018

AMENDMENT 04 DATE: May 7, 2018

Modification P00001: PWS 2.2, October 23, 2018

Modification P00002: PWS 3.0, 4.2, 4.4, 5.0, 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 5.7, 5.9, 5.11, 5.14, 8.1, 8.3, 8.6, 8.10, 9.2, and 9.6 (to include all applicable sub-paragraphs), April 17, 2023

Modification P00003: PWS 9.6.1.6, August 3, 2023

Modification P00004: PWS 4.2, May 15, 2024

Modification P00008: PWS 4.2, July 16, 2026

Department of Veterans Affairs

VA Electronic Health Record Modernization System Basic PWS

Contents

1.0 Background

2.0 Scope

3.0 Applicable Documents

4.0 Performance Details

4.1 Contract Type

4.2 Ordering Period

4.3 Hours Of Work

4.4 Place Of Performance

4.5 Travel

5.0 EHRM Function Areas

5.1 Project Management

Project Management Support VIP Reporting Strategy and Planning Standards, Policy, Procedure and Process Development, and Implementation

Support Requirements Development and Analysis Support Technology Refresh and Configuration Reviews Data Management Data Migration Planning Implementation Planning

Configuration Management Value and Performance Management Reporting

5.2 EHRM System

Electronic Health Record Application

5.2.1.1 Software Requirements

5.2.1.2 Hardware Requirements

Additional EHRM Functionality Software Maintenance

5.3 EHRM Hosting and Managed Services

Non-Production Environments / Domains Continuity of Operations (COOP), Disaster Recovery (DR), and Business

Continuity Planning Services System Quality and Performance Measures and Monitoring Virtual Training Environment Scalable to reflect the concurrent VTE users throughout the PoP. Solution-specific Hardware and Hardware Maintenance Hosting of Legacy Data

5.3.6.1 Image Hosting

5.3.6.2 Legacy System Hosting

5.4 Information System Authorization, Testing And Continuous Monitoring

5.5 VA Enterprise EHRM Baseline Preparation

Workflow Development and Normalization Identity and Access Management

EHRM and VA System Integration Data Exchange - Application Program Interface (API) Gateway Inventory Management Training Plans and Materials Change Management Test and Evaluation

5.5.8.1 Software Code Quality Checking / Software Assurance

5.6 Wave Planning And Deployment

Executive Brief VA Current State Review Future State Review/Workflow Adoption Future state validation Maintenance training Integration validation VA Site Kick-Off Value workshop Training

Go live Readiness Assessment (GLRA) Test and Evaluation - Deployment Pre-deployment Training Post-deployment Support

5.7 Sustainment

Technical Sustainment

5.7.1.1 Operations and Maintenance

5.7.1.2 Help Desk Support

5.7.1.3 Sustainment Testing

5.7.1.4 Technical Post Go-live Training

5.7.1.5 Upgrade Services

End-User Post Go-Live Support Sustainment

5.7.2.1 End-User Post Go-Live Support Training

5.7.2.2 Workflow Analysis and Optimization

5.8 Business Intelligence, Data Analytics, And Point of Care Decision Support

5.9 Analysis And Migration Of Legacy Data

5.10 Innovation and Enhancements

Innovation Process Innovation Categories Other Development Activities Seamless Interoperability / Joint Industry Outreach

5.11 VA innovative technology advancement lab (vital)

5.12 EHRM Technical Support

5.13 Transition Support

Transition Services for Revenue Cycle

5.14 Standards and Certifications

6.0 Deliverables

6.1 Products

6.2 Data

7.0 Information Security, Privacy And Records Management

7.1 VA Information And Information System Security / Privacy Language

General Access To VA Information And VA Information Systems VA Information Custodial Language Security Incident Investigation Security Controls Compliance Testing Training

7.2 Privacy / Systems of Record

Systems of Record Confidentiality and Non-Disclosure Liquidated Damages For Data Breach

7.3 Records Management

Flowdown Of Requirements To Subcontractors

8.0 General Requirements

8.1 Materials, Equipment And Locations

Government-Furnished and Connectivity Contractor-Acquired Property Non-Developmental Items and Commercial Processes Facilities

8.1.4.1 Government Facilities

8.1.4.2 Non-Government Facilities

Warranty Marking, Handling, Storage, Preservation, Packaging, Tracking & Shipping ... 82 Export Control

8.2 Safety And Environmental

8.3 Enterprise And IT Framework

8.4 Development Methodologies

8.5 Integrated Product Teams

8.6 Quality Assurance

8.7 Personnel Security Requirements

8.8 Badges, Physical Security, and Safety Requirements

8.9 Notice of the Federal Accessibility Law Affecting All Information and Communication Technology Procurements (Section 508)

8.10 Section 508 – Information and Communication Technology (ICT) Standards .. 88

Compatibility With Assistive Technology Equivalent Facilitation Representation Of Conformance Acceptance And Acceptance Testing

9.0 Contract Management

9.1 Contractor Program Management

Work Control

9.2 Government Support

Program Manager (PM) Contracting Officer’s Representative (COR)

9.3 Pre-Award Procedures

Request for RTEP Process Task Execution Plan (TEP) TEP Evaluation

9.4 Issuance Of TOs

9.5 Post Award Procedures

Request for Post Award Action Revised TEP for Post Award Actions Post Award Action Approval

9.6 Reporting And Meeting Requirements

Reporting Requirements

9.6.1.1 Monthly Progress Report

9.6.1.2 Status of Government Furnished Equipment (GFE) Report

9.6.1.3 Personnel Contractor Manpower Report

9.6.1.4 Small Business Participation Report

9.6.1.5 Major Subcontractors

9.6.1.6 Service Level Agreement /Service Level Objectives Reporting

9.7 Meetings And Reviews

EHRM IDIQ Contract Kickoff TO Kickoff Meetings Program Reviews

9.8 Communications

1.0 BACKGROUND

This Performance Work Statement (PWS) establishes the requirements for Contractor-provided solutions in support of an enterprise-wide Department of Veterans Affairs (VA) Electronic Health Record (EHR). VA is replacing its current EHR, Veterans Information Systems and Technology Architecture (VistA) with a commercial EHR to modernize VA EHR processing and to promote interoperability of medical data between the Department of Defense (DoD), VA and community providers. When implemented, the EHR System will provide access to authoritative clinical data sources, and over time become the authoritative source of clinical data to support improved population health, patient safety, and quality of care provided by VA.

This contract was awarded after a determination by the Secretary of Veterans Affairs to be in the public interest under FAR 6.302-7. The goal of the accelerated award is to deliver a modernized system in the best interests of Veterans, their healthcare, and the providers that care for them both inside the VA and in commercial care settings.

This award contemplates the provision of services by Cerner Government Services, Inc.

(Cerner), and accordingly the documents reference Cerner and its software and services. The VA, in its sole discretion, may determine a different source of software and/or services will best serve the interests of Veterans for such services including quality of care, patient engagement, operational efficiency or interoperability to fulfill the goals of Electronic Health Record Modernization, the Veterans’ Choice program, or other areas as the VA may decide. The VA may then follow the Federal Acquisition Regulations to seek other sources for the services.

The Contractor shall provide a total EHR solution including the following: program management, an enterprise-wide EHR system, change management, training, testing, deployment services, sustainment and other solutions encompassing the entire range of EHR requirements, to include but not be limited to hosting, software, and hardware incidental to the solution. Accordingly, Task Orders (TOs) may include acquisitions of software and information technology (IT) products as well as the services required to implement the EHR solution across VA. For purposes of this PWS, the VA EHR solution will be referred to as the VA Electronic Health Record Modernization system (EHRM). The EHRM solution shall focus priorities on the Veteran and clinician experiences.

EHRM is based on the electronic health record acquired by the Department of Defense known as the MHS GENESIS system, which is at its core, Cerner Millennium. The adoption of a single joint system between VA and DoD will allow all patient data to reside in a common system to have a seamless link between the DoD and VA. The DoD authorized system will be augmented to include additional functionality to meet VA requirements. Over time, the goal is the creation of an integrated inpatient and outpatient solution with software components that have been designed, integrated, maintained, and deployed with a design architecture that allows for access to and sharing of common data, common user interface, common workflows, common business rules, and common security framework that supports end-to-end healthcare related clinical and business operations.

EHRM is not intended as a mechanism to solely purchase IT products. Such products may be purchased to the extent that those products are necessary to deliver the solution required. These services, as well as related IT products, may encompass the entire life-cycle of EHRM. Moreover, services and related products covered under this contract shall be global in reach and the Contractor must be prepared to provide services and deliverables worldwide.

This PWS provides general requirements. Specific requirements shall be defined in individual TOs. Functional and non-functional requirements are described in Section

5.0 and are not mutually exclusive for TO requirements. Requirements may fall within one specific functional or non-functional area but in many cases, the requirements will encompass and apply across and within multiple areas to provide the total life cycle solution.

In addition, VA and Contractor intend to collaborate to create innovations designed to strengthen and improve healthcare for all veterans and active service members, and to improve the productivity and user experience for VA system users.

2.0 Scope

The Contractor shall provide, host and deploy EHRM across the VA enterprise including the following areas: project management, change management, training, testing, deployment services, sustainment and other solutions encompassing the entire range of EHR requirements, to include hosting, software, and hardware incidental to the solution.

The Contractor shall develop and maintain interfaces as required to meet EHRM solution requirements. The Contractor shall deploy EHRM to all VA Medical Centers (VAMCs), Outpatient Clinics and other approved users of VA EHR functionality. The Consolidated Mail Outpatient Pharmacies (CMOPs) will have access to the EHRM. The Contractor shall support the Veterans Health Administration (VHA) revenue cycle reporting, business intelligence, data analysis and new employee/continuing education training activities and system optimization. EHRM capabilities will also be deployed to Veteran Benefits Administration (VBA) facilities and/or to support other VA use cases as required.

3.0 Applicable Documents

The Contractor shall comply with the following applicable documents. Additional applicable documents may be listed in individual TOs. The Contractor shall comply with VA security, privacy and records management policies, directives, handbooks, and guidelines except where there is a conflict with DoD security, privacy and records management policies, directives, handbooks, and guidelines implemented in the MHS

Genesis environment, in which case, joint governance will provide guidance to the Contractor.

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

3. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

4. FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Publication 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

7. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, title IX Information Security Matters

8. 10 U.S.C. § 2224, "Defense Information Assurance Program"

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010

11. VA Handbook 6102 (Internet/Intranet Services), July 15, 2008 Health Insurance

Portability and Accountability Act (HIPAA); 45 CFR Part 160, 162, and 164;

Health Insurance Reform: Security Standards; Final Rule dated February 20,

12. VHA Handbook 1605.05, Business Associate Agreements, July 22, 2014(http://www.va.gov/vhapublications/)

13. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

14. NIST SP 800-161, Supply Chain Risk Management Practices for Federal Information systems and Organizations

15. Office of Management and Budget Circular A-130, “Managing Federal Information as a Strategic Resource”, July 28, 2016

16. Title 32 CFR 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST Special Publication 800-66 Revision 1: An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

20. VA Handbook 6500, “Risk Management Framework for VA Information Systems

– Tier 3: VA Information Security Program,” March 10, 2015 (

21. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

22. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014 http://www.va.gov/vhapublications/

23. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011 (https://www.va.gov/vapubs)

24. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

25. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, “Recommended Security Controls for Federal Information Systems and Organizations”

26. One-VA Technical Reference Model (TRM) (http://www.va.gov/trm/TRMHomePage.aspx)

27. Federal Segment Architecture Methodology (FSAM) v1.0, December 2008

28. VA Directive 6508, Implementation of Privacy Threshold Analysis and Privacy

Impact Assessment, October 15, 2014

29. VA Directive 6300, Records and Information Management, February 26, 2009

30. OMB Memorandum, “Transition to IPv6”, ”, September 28, 2010

31. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, October 26, 2015)

32. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, March 24, 2014

33. OMB Memorandum M-06-18, Acquisition of Products and Services for

Implementation of HSPD-12, June 30, 2006

34. OMB Memorandum 05-24, Implementation of Homeland Security Presidential

Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

35. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

36. NIST SP 800-116 Rev 1, Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, June 2018

37. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

38. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

39. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices

(Draft), October 2012

40. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

41. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12), April 29, 2011

42. VA Memorandum, VAIQ # 7011145, VA Identity Management Policy, June 28,

43. IAM Identity Management Business Requirements Guidance document, May

2013,

44. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections

(TIC), November 20, 2007

45. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name

System Infrastructure, August 22, 2008 https://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp http://www.va.gov/trm/TRMHomePage.aspx

46. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section,

47. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014,

48. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

49. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV)

Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015,

50. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ#7613595), June30, 2015,

51. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ#7613597), June30, 2015; (VAIQ#7613597), June30, 2015;

52. “Veteran Focused Integration Process (VIP) Guide 4.0”, March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

53. “VIP Release Process Guide”, Version 2.0, October 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

54. “POLARIS User Guide”, Version 1.9, March 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

55. 38 U.S.C. 7301 (b): Functions of Veterans Health Administration

56. VHA Handbook 1907.01: Health Information Management and Health Records

57. Office of Management and Budget Circular A-123: Management responsibilities for internal controls in Federal Agencies

58. VA Memorandum, “Proper Use of Email and Other Messaging Services”, January

2, 2018

59. Health Data Interoperability Management Plan v 3.0: DoD/VA Interagency

Program Office, September 14, 2016

60. Healthcare Information Interoperability Technical Package (I2TP) v 6.0: DoD/VA

Interagency Program Office, March 15, 2017

61. Joint Interoperability Strategic Plan (JISP) v1.0: DoD/VA Interagency Program

Office, September 30 2017

62. 2015 Edition Health Information Technology (Health IT) Certification Criteria, 2015

Edition Base Electronic Health Record (EHR) Definition, and ONC Health IT Certification Program Modifications: Final Rule - October 6, 2015

63. (http://docs.smarthealthit.org/)

64. (http://docs.smarthealthit.org/authorization/)

65. HL7.org Standards as delineated on www.hl7.org

66. VA Directive 6066, Protected Health Information (PHI) and Business Associate

Agreements Management, dated September 2, 2014

67. 2015 Edition Health Information Technology (Health IT) Cures Update

Certification Criteria, 2015 Edition Health Information Technology (Health IT) Certification Criteria, 2015 Edition Cures Update Base Electronic Health Record (EHR) definition, and 85 FR 25642 of the 21st Century Cures Act:

Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule as published in the Federal Register on May 1, 2020 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412 http://docs.smarthealthit.org/ http://docs.smarthealthit.org/authorization/ http://www.hl7.org/

68. Fast Healthcare Interoperability Resources (FHIR) Implementation Guide 5.0.1 published on 6-22-2022)

69. Argonaut Data Query Implementation Guide Version 1.0.0

70. Argonaut Data Query Implementation Guide Server

71. SMART App Authorization Guide : http://docs.smarthealthit.org/authorization/

72. OpenID Connect Core 1.0 incorporating errata set 1

73. Consent2Share (C2S) FHIR Consent Profile Designed for C2S application and associated access control solutions

74. CDS Services v1.0 Draft

75. HL7.org Standards : www.hl7.org

76. Web Services Registry Web Service Interface Specification V3.1

77. Patient Discovery Web Service Interface Specification V2.0

78. Messaging Platform Specification V 3.0

79. Authorization Framework Specification V 3.0

80. Query for Documents Web Service Interface Specification V 3.0

81. Retrieve Documents Web Service Interface Specification V 3.0

82. Document Submission Production Web Service Interface Specification V 2.0

83. Query-Based Document Exchange Implementation Guide V 1.1

84. Technical Trust Policy V2.0 (https://cegproject.s3.amazonaws.com/wp-content/uploads/2018/09/30162038/Carequality-Technical-Trust-Policy-v2- FINAL-7-31-18.pdf)

85. CommonWell Health Alliance Services Specification Version 2.9.1

86. Health Data Interoperability Management Plan v 3.0: DoD/VA Interagency

Program Office, September 14, 2016.

87. Healthcare Information Interoperability Technical Package (I2TP) v 8.0: Federal

Electronic Health resord Modernization (FEHRM)

88. “Federal Information Security Modernization Act of 2014”

89. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

90. VA Memorandum “Proper Use of Email and Other Messaging Services (VAIQ

#7850460)”, January 2, 2018

91. ISO 9241-11, section 3 and 9241-210 section 3 https://www.iso.org/obp/ui/#iso:std:iso:9241:-210:ed-1:v1:en

92. VA Office of Information & Technology Interoperability Framework

4.0 Performance Details

The Contractor shall provide and/or acquire the services, hardware, and software required by individual TOs pursuant to the general requirements specified below. TOs may be executed up to, and may extend no further than five years beyond, the last day of the ordering period.

http://docs.smarthealthit.org/authorization/ http://www.hl7.org/ https://www.iso.org/obp/ui/#iso:std:iso:9241:-210:ed-1:v1:en

4.1 Contract Type

This is an Indefinite Delivery/Indefinite Quantity (IDIQ) Single Award TO contract.

Individual TOs shall be issued on a performance-based Firm Fixed Price basis.

4.2 Ordering Period

The total potential ordering period for this effort is ten (10) thirteen (13) years, consisting of a five (5)-year base ordering period, one (1) thirteen (13)-month optional ordering period, one (1) eleven (11)-month optional ordering period, and three (3) six (6), one (1)-year optional ordering periods.

The Period of Performance shall be as follows:

Base Ordering Period – May 17, 2008 through May 16, 2023 Optional Ordering Period 1 – May 17, 2023 through June 16, 2024 Optional Ordering Period 2 – June 17, 2024 through May 16, 2025 Optional Ordering Period 3 – May 17, 2025 through May 16, 2026 Optional Ordering Period 4 – May 17, 2026 through May 16, 2027 Optional Ordering Period 5 – May 17, 2027 through May 16, 2028

Modification P00008 extends the ordering period for this effort by three (3) years, consisting of three (3) one (1)-year optional ordering periods. The extended Period of Performance shall be as follows:

Optional Ordering Period 6 – May 17, 2028 through May 16, 2029 Optional Ordering Period 7 – May 17, 2029 through May 16, 2030 Optional Ordering Period 8 – May 17, 2030 through May 16, 2031

4.3 Hours Of Work

Hours of work shall be in accordance with (IAW) individual TO requirements.

4.4 Place Of Performance

The place of performance shall be identified in individual TOs. Locations in the Enterprise will be Government or non-Government sites within the continental United States (CONUS) and/or outside the continental United States (OCONUS) and set forth on Section D Attachment 005: List of Enterprise Sites. Locations may include but are not limited to Federal, State, or VA, data centers, facilities, regional offices, benefits delivery centers, medical treatment facilities, health clinics and community care facilities as defined in individual TOs.

4.5 Travel

Travel shall be IAW individual TO requirements. All travel shall be IAW the Federal Travel Regulations (FTR).

5.0 EHRM Function Areas

Individual TOs may encompass more than one task area listed below. Further task details are described to provide greater insight into the complexity and uniqueness of some potential TO requirements covered by this PWS. Task area requirements are not mutually exclusive and may apply across multiple functional areas and multiple task orders. Efforts to be performed by the Contractor under this contract are of such a nature that they may create a potential organizational conflict of interest as contemplated by Subpart 9.5 of the Federal Acquisition Regulation (FAR). Contractor personnel may be required to sign a non-disclosure agreement.

DoD and VA have established joint governance over the shared environment containing MHS GENESIS and EHRM. Under joint governance, decisions pertaining to the shared environment will be reviewed and concurred by the joint governance entity.

5.1 Project Management

The Contractor shall provide EHRM Project Management, monitoring and analysis, strategy, enterprise architecture and planning support on an enterprise or individual task order level.

Project Management Support

The Contractor shall provide project management support to accomplish the administrative, managerial, logistical, integration and financial aspects specified in the overall program as well as in individual TOs. The Contractor shall identify an individual as the primary contact point for all project issues/concerns/status. The primary POC shall be empowered to make decisions and manage issue resolution across all supporting legal entities comprising the EHRM solution. The Contractor shall support project management functions and reporting which include, but are not limited to:

a) Project Planning

b) Schedule Management

c) Site Deployment Tracking

d) Financial Management

e) Quality Management

f) Resource Management

g) Requirements Management

h) Communications Management

i) Project Change Management

j) Organizational Change Management

k) Risk Management

l) Configuration Management

m) Performance Management

n) Value Management

o) Knowledge Management

p) Governance

q) Security

VIP Reporting

In accordance with Major Program VIP Development Deployment Processes, the Contractor shall provide program development and deployment status and reporting to VA for VA documentation and support of VIP requirements.

Strategy and Planning

The Contractor shall provide services that facilitate strategic decisions for VA’s implementation of EHRM. This includes conducting a systematic assessment of the enterprise VistA installation and supporting systems and processes in order to provide strategic recommendations on such key considerations as:

a) EHRM enterprise architecture and hosting

b) Deployment strategy

c) Site preparation requirements

d) Interface requirements

e) Compliance with applicable security requirements

f) Compliance with applicable Identity Access Management requirements

g) Network requirements

h) Additional hardware and software requirements

i) Data and workflows

j) Legacy systems and legacy data

k) Training and change management

l) Configuration management

m) Risk management

n) Performance metrics

o) Applicable governance requirements

p) Synchronization with DoD

q) Innovation strategy

r) Usability

s) Biomedical Devices

t) Interoperability: Health Information Exchange and Community Care

Standards, Policy, Procedure and Process Development, and Implementation Support

The Contractor shall provide support in the development and/or evaluation of new Standards, Policy Directives, Operating Procedures, Processes and/or assessments on their impacts when implemented.

Requirements Development and Analysis Support

The Contractor shall provide requirements development support as required by individual TOs. While the Contractor shall provide such support, the VA reserves the right to take the lead on coordinating input from the user and provider communities. VA may, at its discretion, incorporate analytics from other entities, and include them in its future Digital Veterans Platform, with which the EHR must interoperate using standards based APIs. Requirements support may include, but is not limited to:

a) Business and Application architecture

b) Business Process Reengineering

c) Requirements planning and management

d) Requirements gathering

e) Use Case development

f) Requirements analysis

g) Change management

h) Business Process Modeling

i) Workflow management

j) Identification of site-specific requirements

k) Analytics and Business Intelligence

l) Innovation

Technology Refresh and Configuration Reviews

The Contractor shall perform technology refresh and configuration reviews to include any structure or process for realizing innovations that provides for business or technical changes. Technology refresh ensures new innovations are reviewed and adopted as required throughout the period of performance (PoP) of this contract.

Data Management

The Contractor shall support data aggregation, normalization, standardization and syndication.

The Contractor shall:

a) Perform an analysis of all data stored in VistA including historical data, interfaces, and paper records to determine data management requirements

b) Actively participate in joint governance for planning, strategy and tools for master-data management of VA data in the Contractor-provided solutions based on community and VA coordinated analytic algorithms.

c) Perform an analysis of data stored in other legacy systems in order to determine data migration approach and interface requirements if any.

d) Propose approaches for legacy data management and archiving

e) Propose a methodology for ingestion and syndication of data with other government agencies and affiliates.

f) Plan an approach to ensure operational integrity for CDW based enterprise solutions

g) Establish an analytic and reporting strategy that includes an analytic and reporting environment provisioned with data and reporting tools

h) Perform an analysis and propose terminology standards for DoD/VA data synchronization based on industry standards recognized by National Institutes of Health (NIH), Office of the National Coordinator for Health Information Technology (ONC), and others.

i) Conduct exploratory analytics to support policy development, knowledge discovery, and model creation.

j) Maintain backward compatibility of the EHRM solution in such way as to maintain the quality of the data, to ensure that, once captured, the VA has access to and computational use of the data regardless of the evolution of the EHRM or age of the data.

k) Identify data quality issues found in data sourced from systems beyond its operational remit, applying the same validations and quality standards to incoming external data that it performs for data originated natively within the EHRM solution. Where the principle of seamless care requires that EHRM accept data that does not meet its internal data quality standards, Contractor shall implement the solution so that any incoming data that does not meet EHRM data quality standards shall be clearly flagged as such, and provide both process and user interface to allow incorrect or missing data to be remedied if possible.

Data Migration Planning

The Contractor shall support data migration planning to support seamless care and to ensure operational integrity.

The Contractor shall:

a) Develop a Data Migration Plan (DMP) that provides an understanding of the EHRM Solution implementation sequence and priorities, data quality, data volumes, and data extract, transformation and load strategy for both the EHRM and Population Health Management solutions.

i. The DMP shall describe the approach for data ingestion and extraction, storage, access, data conversion, and data security required retention and disposal strategies.

ii. The DMP shall account for key clinical, administrative and financial data in VistA along with other relevant systems and outline a strategy to make that viewable and actionable.

iii. The DMP shall also address data validation assessing the migration of VistA legacy data to HealtheIntent and Millennium.

iv. The DMP should address how to migrate data that is still actionable and to maintain actionability

v. The DMP shall identify, clarify, and propose approaches for the following:

1. Data Integration (Data flow from VA to Cerner )

2. Data Continuity (VA Legacy Data Integration)

3. Data Syndication (Data flow from Cerner to VA and partner applications and databases)

b) Plan and document the data ingestion mechanism and processes along with terminology mapping to standards associated with data migration and data synchronization/syndication.

c) Plan initial and incremental loading of data into HealtheIntent to include batch and streaming (i.e. near real-time) options

d) Analyze and propose way forward for the capability for external apps to use HealtheIntent as a data source

e) Organize and facilitate a Joint VA/DoD/Cerner Data Governance Board to develop strategy and priorities.

Contractor and VA to create a strategy to establish an archival instance of a VistA instance once the site has migrated to Milleniuum and the local VistA instance is no longer being updated. This instance will be accessible and can be used for high latency extraction.

Implementation Planning

The Contractor shall:

a) Deliver an Implementation Plan that defines the Contractor’s plan for deployment, training, change management, and sustainment of EHRM to the VA Enterprise

b) Brief VA EHRM management on, at a minimum, the following information:

i. Enterprise deployment strategy

ii. Change management approach

a. EHRM System User Role definitions

b. The availability of EHRM User Provisioning workflows

c. Level of Effort estimate to provision all EHRM users during migration

d. Level of Effort estimate to provision new users and maintain end user permissions post migration

iii. Training approach

iv. Sustainment and helpdesk approach

c) Propose recommended change management activities for the most efficient and effective change management support of EHRM in the Monthly Progress Report

i. Execute Cerner Change Management activities upon Government approval

d) Participate in VA EHRM business process reengineering discussions and advise or present industry leading practices, processes and workflow

e) Conduct a comparative analysis between the EHRM solution-inherent workflows and the “As-Is” organizational business processes and provide recommendations on process re-engineering, change management and product configuration

f) Provide Business Process Workflow Diagrams and Role Definitions that define business and clinical workflows and describe how improved functionality and efficiency has been achieved, and establish EHRM System user role definitions

g) Provide a Role Assignment Identification Document that maps user roles, rights and permissions to EHRM roles

Configuration Management

The Contractor shall draft a Configuration Management (CM) Plan for review and comment by the EHRM Program Management Office (PMO). After mutual agreement on the plan, the Contractor shall adhere to the CM policies and practices as described in the Plan. CM includes supporting the definition of Configuration Items (CIs) and relevant attributes and relationships to manage, establishing procedures for change and controlling request for change, providing the status of the CIs, and auditing the actual and authorized versions of each item. Maintaining a complete and accurate CM system ensures the integrity of system/software baselines and designated CIs required to provide services.

Value and Performance Management Reporting

The Contractor shall propose and monitor value objectives for improved outcomes and continuous performance improvement throughout the PoP of this contract. The Contractor shall:

a) assist with data analysis to identify possible optimization projects to further drive performance excellence after implementation at each site.

b) work with VA leadership to establish future value objectives through strategic planning sessions.

c) incorporate change management, workflow and process review and data analytics using the change management methodology agreed by Contractor and VA with consistent recognition and promotion of value achieved.

The Contractor shall use a value realization framework and tools to assist VA with creating value metrics aligned with VA, VHA and clinical strategic goals, and targeted to EHRM and specify goals and Critical Success Factors (CSFs). Value metrics will include Key Results Indicators (KRIs), Key Performance Indicators (KPIs), and traditional Performance Indicators (PIs). The Contractor shall develop and implement tracking mechanisms to measure and report EHRM progress against clinical and business goals.

Clinical and non-clinical goals may include:

a) Patient experience

b) Clinical staff experience

c) Clinical Efficiency

d) Operational Efficiency

e) Safety and Quality (Better Health, Better Care)

f) Patient Engagement

g) Best Practices Adoption

h) Financial Outcomes

i) Access to Care

j) Community Care

i. Health Plan Operations

ii. Seamless Care

iii. Access to Care

iv. Choice

k) Population Health

l) Non-Clinical Staff Experience

Business goals may include:

a) Cost

b) Scope

c) Schedule

d) Security

e) Quality

f) Technical Performance

g) Patient Access to Care

The Contractor shall develop standards for VA approval to be used as input for VA determination of successful site deployment. These standards may be related to the Clinical and business goals, including user adoption rates, process adherence, training competency test results, patient throughput or other similar indicators of success. For system performance (example: availability, accuracy, efficiency) the Contractor shall propose any deviation from or changes to the metrics jointly agreed with VA that will need to be approved as success criteria. The ability to measure these clinical and business requirements shall be documented in a monitoring and reporting plan and measured and reported to VA throughout the PoP. These tracking mechanisms will evolve over time throughout the PoP of this contract as deployments advance across the enterprise and the data available to support metrics expands.

5.2 EHRM SYSTEM

The Contractor shall provide an operational managed services solution for EHRM applications (software and subscriptions), application services and all supporting third party content required to deliver the functional and non-functional requirements set forth in the Requirements Traceability Matrix (RTM) included in Section D, Attachments 002 and 003 to this document.

Electronic Health Record Application

EHRM requirements are established at a strategic level and will guide the configuration and implementation of the system across VA. In addition to the requirements in the Government RTM, the Government may place orders for product enhancements or improvements to meet emerging needs, activate existing, but dormant capabilities in EHRM, or to address a need in the overall EHRM solution not explicitly extrapolated into the Government RTM.

EHRM is expected to unify and increase accessibility of integrated, evidenced-based healthcare delivery and decision-making. EHRM will support the availability of longitudinal medical records for the patients currently enrolled in the VA EHR and new patients as they transition into EHRM as set forth in the VA Enterprise as defined in section H1. EHRM will enable the application of standardized workflows, integrated healthcare delivery, and data standards for improved and secure electronic exchange of medical and patient data between the VA and its external partners, including the DoD, and other Federal and private sector healthcare providers. The workflows inherent to EHRM will be configured, adopted by and standardized throughout VA as applicable.

EHRM will leverage data exchange capabilities in alignment with the Federal Electronic Health Record Modernization (FEHRM) Program Office for standards-based health data interoperability and secure information sharing with external partners. Testing conducted under the Integrated Testing Program Plan may include specific workflows to inform a demonstration of end-to-end clinical use cases involving external stakeholders.

5.2.1.1 Software Requirements

a) Provide all applicable software licenses in accordance with all clauses, identifications and assertions, terms, and conditions related to commercial and non-commercial technical data, computer software, and computer software documentation to support the configuration, integration, custom development, test, software management, training, deployment, and end-user usage of EHRM

b) Manage and track all software licenses required to establish, operate, and maintain EHRM.

c) Provide initial limited licensing for Multum testing and integration with VistA

d) Maximize utilization of VA-provided enterprise licenses where available and appropriate.

e) Provide and update an EHRM Enterprise Release Schedule identifying:

i. Software release packages based on security and system incidents

ii. Planned Technology Refresh and Modernization activities

iii. New installations and service upgrades

f) Identify and report issues and risk associated with software and report risks/issues and status of any mitigation actions in the Monthly Progress Report and at Program Management Reviews (PMRs), technical reviews, program milestones and configuration audits.

g) Configure workflows inherent to HealtheIntent for adoption throughout VA as applicable

h) Provide the ability to segregate information (e.g. from users, from DoD, separate practices for military sexual trauma (MST), employee health, and others)

i) Provide the ability to exclude/segregate/de-identify data from specific practices from HealtheIntent, e.g., MST.

j) The EHRM solution shall support broad access via tablet or mobile devices and pursue technology to reduce the burden to the clinicians. Platform specifics shall be adjudicated by joint governance and incorporated by VA at a TO level.

k) The EHRM solution shall provide third-party provider access to information using light-weight portals and support for future generation mobile devices.

5.2.1.2 Hardware Requirements

The Contractor shall provide and maintain Cerner -specific hardware required for the EHRM solution. This hardware includes such items as connectivity engines and device adaptors.

Additional EHRM Functionality

VA’s requirements will evolve over the course of the IDIQ. To maximize meeting of government requirements while minimizing risk to the Contractor and VA, the parties will engage in periodic future-capability planning cycles. Future requirements may include such items as clinician access to EHRM via tablet.

The Contractor shall meet with the VA on an annual basis to provide visibility to Contractor’s entire roadmap of future capabilities related to the healthcare business. In addition, Contractor will provide VA with updates to review on a quarterly basis. The Contractor’s roadmap shall detail capabilities that the Contractor is anticipating to develop as part of its generally available (GA) product over one, two, and three years.

The VA may request such capabilities in a manner that corresponds with wave task orders As mutually agreed between the Contractor and VA, the Contractor may host an interim capability planning event upon request. These interim planning events are expected to focus on wave task orders in the subsequent 12 months or to make adjustment to future milestones based on unforeseen information or events.

The Contractor shall include VA in all user groups and other planning activities that other major clients participate in and that are used to inform the prioritization of the

Contractors development backlog. In addition, VA will provide input to applicable Cerner business units on capability prioritization.

The Contractor shall provide VA the right to acquire additional modules developed to support the evolving electronic health record commercial baseline throughout the PoP of this contract.

Software Maintenance

The Contractor shall provide its commercial support and maintenance services described in its End User License Agreement. Leveraging Contractor’s best practices and agreed upon upgrade schedule between DoD and VA, software maintenance includes all releases of the software such as major releases, minor releases, maintenance releases. Maintenance will be conducted in such a way to minimize impact to the user community.

Contractor shall:

a) Maintain EHRM software including any Off the Shelf software applications and tools included in the solution

i. Notify the Government of any software that is within two years of end of life, end of service, or end of Software maintenance release

ii. Ensure all software has continuous vendor support

b) Renew software licensing and maintenance agreements as required throughout the PoP of the TO.

c) Support other functional dependencies, such as device certificates and PKI, if applicable

5.3 EHRM HOSTING AND MANAGED SERVICES

The Contractor shall provide enterprise datacenter hosting and services consistent with the hosting requirements set forth in Contractor’s Hosting Agreement. If a cloud hosting environment becomes a more viable solution over the Period of Performance, Cerner may migrate the joint DoD/VA hosting environment to a Cerner private cloud or external third party cloud upon concurrence and security validation from the joint DoD/VA governance authority. The Contractor shall:

a) Provide hosting and managed services to support delivery of the EHRM

b) As a minimum, employ appropriately tailored security controls from the high baseline of security controls defined in NIST Special Publication 800-53 and must ensure that the minimum assurance requirements associated with the high baseline are satisfied. The hosting environment shall be compliant with FISMA- High or equivalent or higher controls. Any deviation from high impact controls must be approved by the Authorizing Official or designee.

c) Provide a primary and alternate data center to support continuity of operations and disaster recovery requirements

d) Support VA Network connectivity requirements

e) Provide all hardware, software, and services necessary to perform sustainment of EHRM in Contractor’s hosted environment

f) Provide continuous technical support and system monitoring to immediately react to a system event

g) Utilize established commercial and proprietary automated tools to monitor and managed vital datacenter infrastructure and EHRM systems.

h) Administer support access by contractor personnel to the EHRM environment using two factor authentication via RSA SecurID in lieu of CAC/PIV authentication for managing solutions within the accredited boundary

i. Access to the EHRM environment by administrative personnel external of the Cerner hosted network will be provided through a VDI and utilize appropriate CAC/PIV authentication

ii. Administrators shall use non-privileged accounts, or roles, when accessing other system functions such as email, and if feasible, audit any use of privileged accounts, or roles, for such functions.

i) Support VA troubleshooting for network latency and packet loss issues to assist in identification of sources of network transport response time issues.

j) Leveraging Contractor’s best practices and agreed upon upgrade schedule between DoD and VA, hosting maintenance includes patches, cybersecurity, and software assurance updates. Maintenance will be conducted in such a way to minimize impact to the user community.

Non-Production Environments / Domains

a) Host and operate all EHRM non-production environments/domains that are functionally equivalent to production environments/domain. The environment/domains will support the non-production requirements and needs across the lifecycle of the VA EHRM, including development, testing, training, certification (for upgrades), and sustainment. Development activities include the activities to develop/build the interfaces between the EHRM, VistA, other VA systems and non-VA systems within the EHRM program scope. Test activities will be executed in these non-production environment that represent architecturally, operationally and technically similar non-production environments so that test and training results are identical as if run in production.

b) Work closely with VA to identify the number and use of non-production environment/domains required to mitigate the risk of development/test events schedule collisions or usage issues/conflicts between Contractor, VA EHRM and DoD MHS GENESIS teams performing work in the same non-production environment/domain.

c) Work closely with VA EHRM and DoD MHS GENESIS teams to create/maintain a Non-Production Domain Integrated Master Tracking/Schedule of key activities taking place in non-production environments/domains to mitigate risks/issues impacting EHRM schedules. Risks/Issues may arise due to multiple teams sharing the domain environment.

d) Coordinate new requirements and modifications that impact the existing DoD-VA Joint Test Environments thru the DoD-VA Joint Test Environment workgroup.

e) Work jointly with VA and DoD MHS GENESIS teams as needed to establish network connectivity between non-production environments/domains and use established connectivity processes such as, VA ESCCB and DoD MHS GENESIS PEO change control for non-production environments.

f) Participate with VA in environment/domain network connectivity test to ensure the environments pass connectivity tests

g) Ensure EHRM system installed within the non-production environment/domain are functional

h) Participate with DoD MHS GENESIS/VA teams in environment/domain smoke tests as needed to ensure any DoD interfaces (like Joint Legacy Viewer or DoD DEERS) are functional (pass smoke…