Attachment_B_Task_Order_001_-_Discovery_PWS_A0005_Track_Changes.docx

U.S. Department of State - Bureau of Medical Services SALVO 1.0DRAFT

U.S. Department of State Bureau of Medical Services Performance Work Statement for Task Order 001: Discovery Task

Introduction To modernize and improve its existing health records system, the U.S. Department of State (DOS) Bureau of Medical Services (MED) proposes to convert its mixed-method (paper-based) health record system to a quickly deployable, and multi-site-appropriate Electronic Health Record (EHR) system. The new EHR must serve MED’s Washington DC-based employees and the Department’s globally-deployed employees and their dependents.

DOS expects the new EHR to yield many improvements. To meet its needs and requirements, the new EHR shall standardize processes, capture clinicians’ entries and patient data, and improve information sharing between its central offices and its overseas clinical sites. Using a regulation and legislation-compliant systems approach, it shall link the central MED record repository with external medical service providers (e.g., laboratories, imaging services, medical specialists) and deploy EHR best practices to its DC and global clinical sites. The EHR should support MED special services such as Clearances adjudication, Medevacs logistics, and Quality Management Surveillance.

Background The selection, modification, testing, deployment, and sustainment of a Commercial Off-The –Shelf (COTS) EHR has repeatedly frustrated both the U.S. Department of State and other similar federal Departments and Agencies. This Task Order supports a comprehensive and deliberate development of best-fit model that incorporates both the COTS product and the level of effort necessary to integrate that COTS solution into a Federal Risk and Authorization Management Program (FedRAMP)- Authorized Amazon Web Services (AWS) operating environment.

3.0 Scope

The Contractor will conduct a Discovery Task to deliver a road map with recommendations to complete development of the EHR application. The key objective of this road map will be to provide the Government with necessary information to determine the path forward for EHR development. At a minimum, the deliverable must include analysis of potential approaches that leverage COTS EHR applications to meet the needs of the program. The key considerations must include but are not limited to:

1) Cost

a) Upfront –vs- enduring

2) Delivery

a) Initial release timeframe

b) Recommended approach and proposal to meet the Minimum Viable Product (MVP) using one of several COTS solutions available in the marketplace

c) An MVP for the EHR would enable globally distributed health care providers to access archived information on a defined health program beneficiary, incorporate that information into a current encounter, document findings and care provided in real time, and share those records in real time in a FedRAMP- compliant Amazon Web Services (AWS) operating environment.

d) An MVP for the EHR requires that all of the data currently archived in MED Information Technology (IT) Protected Health Information Management Services (PHIMS) systems be appropriately migrated to the upgraded solution.

3) Technical and Security Requirements

a) Integration and Communication among Products An MVP for the EHR system architecture shall demonstrate the capability to interoperate and interface with other systems using industry standard Electronic Data Interchange (EDI) protocols and standards e.g., HL7 and XML. At a minimum, the EHR system will need to interface via web services with the following external systems:

· The DOS Global Employment Management System (GEMS), an Oracle database management system (DBMS) into which all DOS employees and their dependents are registered. The database contains Personally Identifiable Information (PII) (e.g., SSNs and DOBs). MED extracts this information to register patients in its current medical records system, and pushes medical clearance determinations back to GEMS.

· Integrated Logistics Management System (ILMS) a SQL/PeopleSoft DBMS into which all DOS employees and their dependents are registered if they have traveled to DOS overseas locations at Government expense. The database contains Personally Identifiable Information (PII) (e.g., SSNs and DOBs). MED interacts with this information to manage patients’ and Post pharmaceutical and inventory data.

· Browser based DBMS products (e.g. ServiceNow)

b) Computing Environment The end-user client environment shall support Internet Explorer version 11 and Chrome 70.x browsers or the current Department baseline.

c) Network Constraints The system shall be accessible from the DOS intranet (OpenNET). It should be able to operate in a limited/degraded network environment. For example, a number of posts are limited to 8Mbps of total bandwidth and experience latency upwards of 400ms for Internet connections. The EHR system must have a lightweight interface in order to provide a quality user experience given the low bandwidth/high latency conditions. The system (vendor) shall address strategies for downtime mitigation.

d) Support Multi-Factor Authentication The EHR shall provide multi-factor authentication for patient and healthcare provider access. The DOS EHR shall support NIST Assurance Level 3 multifactor authentication for the clinical system and Assurance Level 2 for a patient portal system. (Reference: NIST Special Publication 800-63B)

e) Encryption The EHR shall provide data-at-rest (DAR) encryption protection and Data-in-Transit (DIT) following NIST encryption standards.

4) Operational Impact

a) Forecasted impact approach will have on ongoing Health Unit operations

b) Forecasted impact on the roles and responsibilities of Health Unit and Washington-based staff in delivering and documenting care

c) Forecasted changes to MED IT support infrastructure, especially as it relates to personnel, equipment, policies, and procedures

d) Forecasted impact on the Bureau’s security posture, with recommendations for adaptive evolution.

The roadmap shall also recommend changes to the list of deliverables to align with a fully agile methodology.

The Contractor shall recommend solutions for quality control of code based on accepted industry standards, FedRAMP requirements, and AWS operating environment constraints in developing approaches for agile development practices.

4.0 Key Personnel

This is a Performance-based Task Order. In developing the staffing plan within the proposal to meet this requirement, the Contractor shall use, to the greatest extent possible, the labor category descriptions and qualifications described in Attachment A of the base Request for Proposals, and include detailed resumes for each person supporting the task within the selected labor categories. Upon award, the proposed personnel shall not be changed or otherwise diverted from the task under final delivery of the final product is accepted by the Government, unless specifically agreed to in writing by the COR.

5.0 Schedule

This Discovery Task will be conducted in four phases based on an agile approach and structured as multiple sprints with the following expectations:

1) The Contractor will convene an initial planning meeting with the COR and A/COR within 3 business days of award

2) Each sprint will last no more than 10 business days in duration

3) The Discovery Task team will hold daily Stand ups

4) The PM will provide weekly progress updates to the COR and A/COR

5) The Discovery Task Team will convene monthly Progress Reviews with Government

6) First Draft of the roadmap for development of the EHR delivered 60 days after contract award

7) Final Draft of the roadmap for development of the EHR delivered 90 days after contract award

8) Government will require up to a 3025 day review period to finalize a decision

9) The Contractor will incorporate any Government comments to deliver the Final document.

Draft Roadmap Report Sixty days after award

6.0 Deliverables

The Contractor shall develop and deliver products, as outlined below, in a format determined by the COR. The Government may adapt report formats, add additional reporting requirements, or otherwise change the information required during the performance of the Discovery Task through the issuance of Technical Direction to the Contractor.