Questions and Responses for NIST Solicitiation 1333ND21QNB150041 1-5-21.pdf

Questions for National Institute of Standards and Technology (NIST) Solicitation 1333ND21QNB150041 – Electronic Medical Records Storage System

Thank you for the opportunity to submit questions for National Institutes of Standards and Technology (NIST) solicitation 1333ND21QNB150041 – Electronic Medical Records Storage System. B.

1) In addition to supporting pre-employment physical examinations, annual physical examinations, allergic shots services, and urgent care services for employees, is NIST interested in any of the following capabilities typically associated with an occupational health program? Please check or indicate all that apply.

Answer - NIST does provide a flu shot to staff.

� Worksite injury/illness case management � Flu program/immunization program management � Leave management (FMLA, medical leave) � Travel management � Restrictions & accommodations management � Workers’ compensation management � Drug screening � Asset management � Radiology/DICOM � Reporting

2) Please describe the types and quantities of clinical, as well as administrative users, that will be using the electronic health record (EHR) functionality of the system (e.g. physicians, physician assistants, nurse practitioners, nurses, medical assistants, schedulers, clinic administrators, etc.).

Answer:

Occupational clinic. Average 2500 visits a year.

NIST will have eight users the base year and seven users for each option year. Knowing the type of NIST staff is not relevant to the EHR system.

3) Does NIST require a portal for supervisors to manage and view employee clearance status information, scheduling, restrictions, or other associated information?

Answer - No

4) Does NIST require a portal for employees to schedule exams, or other services, access clearance documentation, complete health surveillance/exam questionnaires, view work restrictions, look-up lab results, or any other related activities?

Answer - No

5) In addition to paper records, are there any other data migration requirements? In particular for electronic legacy occupational health information, electronic human resources (HR) information, or other digital sources? If so, please identify the legacy application/data vendor(s), the application(s) under use, and available modality of data transfer.

Answer - None.

6) Please check and describe any EHR interface requirements applicable for NIST including:

Answer - � HR system interface

• HR application: _____________N/A____________ � Lab interface

• Lab vendor(s): ________Labcorp and Quest diagnostic________ � Email application interface

• Email application: ___nist.gov________________ � Audiometry device interface

• Make/model: Benson CCA 20 mini (audiometer)______________ � Vision device interface

• Make/model: Titmus V4_______________________ � EKG device interface

• Make/model: ____LifePak15_______________ � Spirometry device interface

• Make/model: Easy one connect [3.5.1.7], PC sensor 1.3.2.0 (Medizin TechNik)

� Vitals monitor interface

• Make/model: Spot Vital signs 420 Welch Allyn; Suretemp plus (welch allyn thermometer) � Other interface requirements

• Please describe: _________________________

7) The standard approach to single sign-on (SSO) is to use SAML 2.0 where the client acts as the identity provider. If NIST is unable to support SAML 2.0, please Indicate what SSO technology NIST can support.

Answer - NIST can support SAML 2.0

8) Are there any NIST-specific configuration needs or custom development requirements anticipated for successful deployment of the EHR system?

Answer - Yes, the NIST-specific configuration requirements are identified in the Statement of Work.

9) Please describe NISTS’s hosting requirements for the EHR system. For example, will it be on premise, software-as-as-service (SaaS), etc.?

Answer - The EHR system will be hosted off premises. As stated int SOW, “The contractor shall provide a cloud based customizable occupational medicine Electronic Medical Records (EMR) system.”

10) Please describe allowable costs that may be recorded under the CLIN entitled “Electronic

Health Records Platform”? For example, enterprise licensing for system environments (e.g.

staging, disaster recovery, production, testing), initial system configuration, annual operations and maintenance costs, interface maintenance costs, cost for maintaining security documentation and patching, etc.

Answer:

CLIN 0001, 0004, 0006, 0008 and 0010 - Electronic Health Records Platform – Data storage CLIN 0002, 00055, 0007, 0009 and 0011 - Electronic Health Records Authorized Users – Software licenses for the users.

CLIN 0003 - Authorization to Operate Electronic Medical Record System at NIST – initial system configuration and documentation to achieve NIST’s authorization to operate

11) For the technical approach and its evaluation, would NIST consider accepting evidence of an EHR system’s ATO issued by another Federal Agency even if the ATO was not awarded as part of a FedRAMP authorization process?

Answer:

As stated in the SOW, “The Contractor shall have FedRAMP authorization or an Authorization to Operate (ATO) letter issued by a Federal Government agency as evidence that they have been assessed and authorized. If using an ATO letter, that letter shall clearly state the impact level (e.g., moderate or high) at which the Contractor has been assessed and authorized. If subcontractors are involved, each party shall have the above stated FedRAMP authorization or Federal agency-issued ATO letter stating the authorization. While FedRAMP authorization or ATO is preferred, in lieu of the above the Contractor, and/or its subcontractors, may demonstrate that they have passed an independent security audit (e.g. Statement on Standards for Attestation Engagements (SSAE), PCI Data Security Standard (PCI DSS)) and/or compliant with the Global Data Protection Regulation (GDPR). Within 5 days of contract award, the Contractor shall provide to NIST, as a deliverable, evidence of the audit or instructions on how to obtain evidence of the above, if the Contractor has had any audits described above or other security audit.

In lieu of FedRAMP authorization, the contractor must undergo an Assessment and Authorization of security and privacy controls and receive an Authority to Operate from NIST and DOC.

Post contract award, the Government will perform a review for a local ATO decision, required for go-live, and ongoing security and privacy assessments for continuous monitoring thereafter. The Government will determine the risk rating of identified vulnerabilities. The Contractor shall respond to the Government with an action plan and schedule to mitigate security or privacy risks found within 10 business days of notification of security or privacy risks. The Government will notify the Contractor of whether or not the action plan and schedule are acceptable. The Contractor shall implement the action plan according to the agreed-upon schedule.

Anticipated impact rating levels based on NIST use cases (by security objective) are Integrity = Moderate, Availability = Low, and Confidentiality = Moderate.”