2-HSS-26-052 - AppB-Scope of Work.docx

RFP HSS 24 021 Appendix B RFP HSS 24 021 Appendix B

Appendix B

HSS 26-052

ELECTRONIC SURVEILLANCE SYSTEM FOR THE EARLY NOTIFICATION OF COMMUNITY EPIDEMICS

Scope of Work and Project Requirements

Project Overview

Background and Purpose This document addresses the need for a comprehensive solution to address the challenges faced by Office of Infectious Disease and Epidemiology (OIDE). The mission of the Division of Public Health (DPH) is to protect and enhance the health of the people of Delaware. The Division accomplishes its mission by:

1. working together with others;

1. addressing issues that affect the health of Delawareans;

2. keeping track of the state’s health;

3. promoting positive lifestyles;

4. responding to critical health issues and disasters;

5. promoting the availability of health services.

The accomplishment of this mission will facilitate the division in realizing its vision of creating an environment in which people in Delaware can reach their full potential for a healthy life.

To detect and combat public health threats and events through the use of advanced anomaly detection and syndromic surveillance capabilities.

Project Lifecycle The contractor shall organize and manage the project based on five distinct lifecycle phases: a Planning Phase, a Configuration and Customization Phase, a Testing and Deployment Phase, an Operations and Support Phase, and a Project Transition-Out Phase. Each phase is represented by a set of mandatory deliverables and activities required by the contractor.

Planning Phase The Planning Phase includes all the mandatory deliverables and activities required by the contractor to proceed to the Configuration and Customization Phase:

· Schedule and conduct meetings with the project team to discuss the requirements; and finalize the format and content for each deliverable

· Schedule and conduct meetings with the original vendor regarding legacy data conversion planning.

· Schedule and conduct meetings with Information Resource Management (IRM) regarding legacy data conversion planning.

· Finalize contractor and stakeholder staffing for all project phases

· Finalize subcontractor and/or vendor contracts, if applicable

· Provide deliverable: Project Schedule

· Provide deliverable: Change Management Plan

· Provide deliverable: Continuity of Operations Plan

· Provide deliverable: Data Conversion Plan

· Provide deliverable: Dried Bloodspot (DBS) Card Specifications

· Provide deliverable: Architecture Network Diagram Configuration and Customization Phase The Configuration and Customization Phase includes all the mandatory deliverables and activities required by the contractor to proceed to the Testing and Deployment Phase:

· Schedule and conduct meetings with the project team to review the project status and schedule, and to discuss the deliverables and activities associated with this phase

· Spin-up the cloud instance for the Software as a Service (SaaS) product

· Configure the product

· Customize the product, if applicable (e.g., interfaces, data conversion, etc.) • Implement the Data Conversion Plan

· Update the Project Schedule

· Provide deliverable: Interface Control Document for Vital Statistics

· Provide deliverable: Training Plan

· Provide deliverable: Test Plan

· Provide deliverable: Product Deployment Plan Testing and Deployment Phase The Testing and Deployment Phase includes all the mandatory deliverables and activities required by the contractor to proceed to the Operations and Support Phase:

· Schedule and conduct meetings with the project team to review the project status and schedule, and to discuss the deliverables and activities associated with this phase

· Implement the Test Plan

· Implement the Training Plan

· Implement the Product Deployment Plan

· Implement the Interface Control Document for Vital Statistics

· Update the Project Schedule

· Provide deliverable: User Guide

· Provide deliverable: Data Element Dictionary Operations and Support Phase The Operations and Support Phase includes all the mandatory deliverables and activities required by the contractor:

· Schedule and conduct meetings with the project team to review operations monitoring and quality control reports, issue tracking, and change control tracking

· Implement the Continuity of Operations Plan

· Implement Change Management Plan

· Initiate Help Desk operations and incident management

· Provide ongoing maintenance and support

· Securely maintain all data and facilities Project Transition-Out Phase Upon termination of the contract, the contractor will provide a finalized copy of the Data Element Dictionary, and a copy of the database based on an agreed format and delivery method.

Project Team

Project Organization Chart

DHSS and Stakeholder Contact Information

DHSS

Tesha Quail DHSS Executive Sponsor Division of Public Health Shonetesha.Quail@delaware.gov 302-424-7126

Enter name DHSS Project Manager Division of Public Health [Enter email]

Chip Finch DHSS Technical Manager Information Resource Management Alfred.Finch@delaware.gov 302-255-9256

Kathy Jo Kuhns DHSS Program Manager Division of Public Health KathyJo.Kuhns@delaware.gov 302-223-2387

Mollee Dworkin DHSS Subject Matter Expert (SME) Division of Public Health Mollee.Dworkin@delaware.gov 302-223-2931

Michael Fioravanti DHSS Information Systems Support Specialist (ISSS) Division of Public Health Michael.Fioravanti@delaware.gov 302-744-4738

DHSS Roles Information Resource Management (IRM) In support of the DHSS and Office of the Secretary - Administration, the mission of Information Resource Management (IRM) is to provide quality, efficient and cost-effective support in the management of technology resources. IRM provides DHSS divisions with information technology planning and management, information technology purchasing, network telecommunications, and help desk services. IRM is represented on the project team as the DHSS Project Manager, DHSS Technical Manager and Master Client Index (MCI) Coordinator.

Department of Technology and Information (DTI) The Department of Technology and Information (DTI) is the state’s central information technology (IT) organization. DTI establishes and enforces the State’s IT policy and standards and provides enterprise technology services that enable other organizations to effectively fulfill their missions. DTI does not participate in the project directly but is available to the Project Manager as necessary.

DHSS Executive Sponsor The DHSS Executive Sponsor represents DPH senior management and is responsible for the success of a project and provides sustainability, strategic planning, guidance and resources to the project team and DHSS Project Manager as necessary. The DHSS Executive Sponsor does not typically attend project meetings.

DHSS Project Manager The DHSS Project Manager serves as primary coordinator for all project phases, attends all project meetings, works with the Contractor Project Manager to maintain the project plan and schedule, ensures all IRM, DPH and other stakeholder staff attend meetings as necessary, and manages work assignments as required (e.g., review deliverables, perform testing, etc.). The DHSS Project Manager will report to a Project Steering Committee made up of representative managers from the DPH, IRM and DTI. This Committee will meet monthly to review project status, progress, and issues. The Project Steering Committee will report to an Executive Sponsors group. The Executive Sponsors group will be made up of representatives from DHSS, DTI, Office of Management and Budget (OMB), and the Division. They will meet quarterly to discuss overall project status, progress and issues, risks, project management, funding, staffing, sponsor issues, stakeholder participation and tasks planned for the upcoming quarter.

DHSS Technical Manager The DHSS Technical Manager serves as primary coordinator for all project phases on behalf of IRM, attends all project meetings, works with the project team to maintain the project plan and schedule, and provides DPH and the contractor with consulting support, facilitates any configuration and/or customization required within the state network (e.g., interfacing with the Master Client Index, firewall rules, etc.), and manages the work assignments of IRM and DTI staff as required (e.g., review deliverables, perform testing, etc.).

DHSS Program Manager The DHSS Program Manager serves as primary business lead for all project phases on behalf of DPH, attends all project meetings, works with the project team to maintain the project plan and schedule, disseminates program information to the contractor as needed (e.g., business requirements, processes, workflows, forms, reports, etc.), and manages work assignments of program staff as required (e.g., review deliverables, perform testing, etc.).

DHSS Subject Matter Expert (SME) The DHSS Subject Matter Expert (SME) contributes program knowledge and information in all project phases, attends project meetings as required, and reports to the DHSS Program Manager.

DHSS Information Systems Support Specialist (ISSS) The DHSS Information Systems Support Specialist (ISSS) serves as the DPH liaison between program staff and IRM, and between program staff and contractor IT staff. The ISSS participates in all project phases, attends all project meetings, and ensures the business requirements are properly communicated to the contractor and that program staff understand DTI policies and standards, and contractor information system processes and data. The ISSS reports to both the DHSS Technical Manager and DHSS Program Manager.

Contractor Roles Contractor Project Manager The Contract Project Manager serves as the chief liaison to the DHSS Project Manager for all project phases, has authority to make day-to-day decisions, facilitates all contractor activities (e.g., application, database, financial, legal, training, laboratory operations, follow-up services, etc.); facilitates all deliverables; maintains the project schedule; schedules, hosts and leads all project meetings; authors and distributes agendas, meeting notes and weekly status reports; and ensures contractor staff attend project meetings as necessary. The Contractor Project Manager reports to the Contractor Project Director.

Contractor Application Manager The Contract Application Manager facilitates all SaaS product configuration, documents, and communicates systems-related issues and downtime, coordinates with the contractor’s Help Desk as necessary, attends all project meetings as required, and contributes knowledge and information to inform the authoring of deliverables (e.g., Project Plan and Schedule, Architecture Network Diagram, Test Plan, etc.). The Contractor Application Manager reports to the Contractor Project Manager.

Contractor Database Manager The Contract Database Manager develops and maintains the contractor’s databases, maintains data storage and retrieval systems, troubleshoots database issues, implements database recovery procedures and safety protocols, attends all project meetings as required, and contributes knowledge and information to inform the authoring of deliverables (e.g., Project Plan and Schedule, Data Conversion Plan, Interface Control Documents, Data Element Dictionary, etc.). The Contractor Database Manager reports to the Contractor Project Manager.

Contractor Training Manager The Contractor Training Manager develops and maintains training materials; schedules and conducts training sessions; communicates with users; attends all project meetings as required; and contributes knowledge and information to inform the authoring of deliverables (e.g., Project Plan and Schedule, Training Plan, etc.). The Contractor Training Manager reports to the Contractor Project Manager.

Project Deliverables

The following subsections define the requirements and minimum data content for each deliverable. Section 1.0, Project Overview, stipulates which project phase the contractor will provide each deliverable. During the project phases, each deliverable is formalized and submitted to DHSS separately as a standalone document and is updated throughout the project per the contractor’s Change Management Plan. The Project Schedule, and Test Plan, are submitted to DHSS in Microsoft Excel format. All other deliverables are submitted in Portable Document Format (PDF) format.

Project Schedule The contractor shall provide the Project Schedule in Microsoft Excel format and include task number, task description, assigned staff, task dependencies, task start and end dates, task duration, percentage completed, task completion date, and a project calendar depicting all tasks. For the duration of the project, the contractor will deliver to DHSS weekly an updated Project Schedule. The contractor will define tasks at a sufficient level to track the work assignments of contractor, DHSS, and stakeholder staff, which at a minimum includes deliverables, configuration, customization, data conversion, training, testing and deployment. During the Operations and Support Phase, the Project Schedule will include issue resolution, change management, system downtime, or any other event or activity that requires tracking.

Change Management Plan The Contractor shall provide their Change Management Plan in PDF format and describe the change management process, both in terms of configuration and customization, define the method to request change, the process to rank and prioritize change requests (via a Configuration Control Board or equivalent), define the role of DPH, include a sample of any forms and artifacts used in the change management process (e.g., change request form, approval form, User Acceptance Testing (UAT), etc.), and list the project deliverables that will be updated (e.g., project schedule, test plan, approval form, user documentation, etc.).

Continuity of Operations Plan The contractor shall provide their Continuity of Operations Plan in PDF format and describe their backup and recovery process of applications and data; and describe their methods to ensure all essential operations and follow-up services are continued following a natural disaster, power outage, or any other event that impacts facilities, staffing, systems, or data. The contractor shall identify any associated vendors, provide documentation of recovery procedures and testing, define the communication method for alerting DPH of a disaster or event requiring the execution of the Continuity of Operations Plan, and define the Service Level Agreement (SLA) time to return to operations following notification to DPH.

Data Conversion Plan The contractor shall be responsible for all aspects of the data conversion process including data assessment and planning, data mapping, data extraction, data transformation and cleaning, data loading, data testing and validation, and data reconciliation. The contractor shall provide their Data Conversion Plan in PDF format and describe their method to transform and import legacy data from the current database that covers Syndromic Surveillance data. The contractor shall describe the approach to ensure data quality before and after the data conversion process, describe the manual and/or automated controls and methods to validate the conversion, and describe the process for data error detection and correction. The contractor shall include in their plan a data conversion specifications table that lists all source tables and fields, the target table and field for each source field, a data value mapping and/or rules for data transformation.

Architecture Network Diagram The contractor shall provide an Architectural Network Diagram in PDF format and depict the application and database servers, and other contractor facilities if applicable, interfaces, DHSS users, and providers. The diagram will clearly document the location of all servers, the laboratory and contractor facilities; and the diagram will clearly document the IP and port specifications.

Training Plan The contractor shall provide a Training Plan in PDF format that describes their approach to training, includes a curriculum to demonstrate all core system functionality (e.g., user login; application use and navigation; application configuration; user screens, and reports), includes a curriculum to summarize all business workflows, and includes a copy of all training materials. Training to be available to no less than 100 users.

Test Plan The contractor shall provide a Test Plan in Excel format and document the test cases associated with unit and integrated testing. The contractor is required to work with the DHSS Project Manager to identify the staff for testing, review the Test Plan with staff before testing begins, and facilitate one or more meetings with staff to execute the Test plan together. The contractor shall include in the Test Plan test cases for all core systems functionality associated with the baseline product (e.g., user login; application use and navigation; application configuration; user screens, and reports) and include DPH-specific configuration where applicable and include test cases for all customization work (e.g. interfaces). The contractor will include a summary for each test case, and a series of test steps for each test case; each test step will include a test step summary, user instructions for executing the test step, the expected outcome, the actual outcome, and testing notes.

Product Deployment Plan The contractor shall provide a Product Deployment Plan in PDF format and describe their approach to deployment, describe the method to communicate with DHSS and other stakeholders, include communication templates, and include a readiness checklist for facilities, environments, applications, databases, operations, and the Help Desk. The contractor shall describe their method to monitor operations and quality control and include sample reports associated with operational monitoring and quality control.

Interface Control Document The contractor shall provide a separate Interface Control Document in PDF format for each required interface Electronic Medical Records (EMR), Delaware Health Information Network (DHIN), Delaware EpiLab Insight (DELI), and National Syndromic Surveillance Program (NSSP) and include an overview and purpose of the interface, the technical requirements (e.g., interface method, ports, protocols), the data processing steps executed, the control report(s) for managing the interfaces, communication method, communication template, and communication SLA to advise DHSS staff and/or stakeholders regarding a processing outcome, and the message/file format and specifications. The specifications will include a listing of field names, field descriptions, field attributes, field sizes, and valid values.

User Guide The contractor shall provide a User Guide in PDF format and include instructions and screen samples to navigate and use all core system functionality (e.g., user login; application use and navigation; application configuration; user screens, and reports). The contractor will include a table of contents, organize, and group the content by core functionality, and provide instructions for contacting the Help Desk. The contractor shall provide a guide for both administrative and non-administrative audience.

Data Element Dictionary (DED) The contractor shall provide a DED in PDF format and document all the table names, table descriptions, field names, field descriptions, field attributes, field positions, field sizes, valid values and primary keys associated with the application database and indicate whether each field is available in the Decision Support System. The contractor shall organize the DED with each table presented alphabetically as a separate section, order the fields for each table by position in the database, and depict the field information in a spreadsheet-like format.

Project Requirements

Contractor Knowledge and Experience The contractors shall have the following knowledge and experience:

1. Detailed knowledge of the program’s processes, including the distribution, receipt, processing, testing, etc.

2. Experience with the successful implementation of technical solution in two or more sites like the solution being proposed for DHSS

3. Experience with hosting systems as a SaaS solution for a state or equivalent jurisdiction or similar or larger size

4. Experience with hosting a decision support system for state staff to query and report on systems data

5. Experience with converting and importing legacy systems data

6. Experience with configuring and processing standard Health Level Seven (HL7) messages and non-standard message formats for various data sets such as emergency department visit data, public health case data, school data, etc.

7. Experience with interfacing other systems

8. Experience with operating a Help Desk for state staff, providers and/or patients

9. Experience with providing comprehensive training to users Offshore Prohibitions Offshore is defined as not being within the United States or its territories. Offshore storage and transmission of DHSS data is prohibited. Onshore project data and project artifacts including backup and recovery files in any form shall not be accessed by offshore staff and shall not be copied, processed, transmitted, or moved offshore. Contractor is permitted to engage offshore resources including sub-contractors as specified in section 6.3.6 for development and lower level (unit & integration) testing only. Contractor is prohibited from using State data in any form even if masked or obfuscated for offshore testing. All aspects of User Acceptance Testing and production operations will take place onshore.

Associated Link:

Offshore IT Staffing Policy Data Classification Policy The contractor shall abide by the terms and conditions established in the Delaware Data Classification Policy, which defines the roles and responsibilities of a Data Steward based on the data classification. The data classification for this procurement is State of Delaware Secret.

Associated Link:

Data Classification Policy Terms and Conditions Governing Cloud Services and Data Usage The contractor shall abide by the terms and conditions established in Terms and Conditions Governing Cloud Services and Data Usage Policy, which govern remote hosting/cloud systems and accessing/storing State data outside of the State network. The Terms and Conditions Governing Cloud Services and Data Usage Agreement has columns identifying which provisions are mandatory depending on whether the data is Public or Non-Public. The data classification for this procurement is Non-Public. The mandatory clauses are identified by the checkmark in the appropriate Public/Non-Public column in each agreement.

Associated Links:

Terms and Conditions Governing Cloud Services and Data Usage Agreement Terms and Conditions Governing Cloud Services and Data Usage Policy

The contractor has the option to conditionally accept, or reject, any clause in the agreement. In such cases, the contractor will list the agreement clause number, state whether the clause is “accepted conditionally” or “rejected” and describe the reasoning and/or controls that are present to provide the same or similar compliance. Any exception identified by the contractor will be vetted by Delaware Department of Technology and Information (DTI) and the Delaware Deputy Attorney General (DAG). Individual clauses may be negotiated and updated by the DTI and DAG and the negotiated agreement version will be attached to the final contract.

During the Operations and Support Phase, the contractor will renew the Terms and Conditions Governing Cloud Services and Data Usage Agreement every 12 months.

Criminal Background Check All Contractor staff working on this project will be subject to a Criminal Background Check (CBC). The contractor will be solely responsible for the cost the CBC. DHSS will review the CBC results. DHSS at their sole discretion may request that a contractor staff be replaced if their CBC result is unsatisfactory.

Cyber Liability Insurance All data in transit must be encrypted whether transmitted over a public or private network. If the Contractor cannot comply with the requirement to encrypt data at rest, then Contractor must purchase adequate Cyber Liability Insurance to protect the contractor and the State from data breaches and other cyber security issues. The selected Contractor will present a valid certificate of cyber liability insurance for attachment to the contract prior to contract signature.

HIPAA Regulations and Standards The contractor shall certify compliance with Health Insurance Portability and Accountability Act (HIPAA) regulations and requirements as described in Department of Health and Human Services, Office of the Secretary, 45 CFR Parts 160, 162 and 164 along with the updated American Recovery and Reinvestment (ARRA) Act and Health Information Technology for Economic and Clinical Health (HITECH) Act provisions, as well as all HIPAA requirements related to privacy, security, transaction and code sets, and provider enumeration. The proposed solution must meet these cited requirements.

Business Associate Agreement Because the data includes Protected Health Information (PII), which is covered by HIPAA regulations, a Business Associate Agreement (BAA) must be signed by the contractor to acknowledge agreement with federal and state policies and standards. This agreement/contract must be in force prior to testing or production implementation of this data exchange. During the Operations and Support Phase, the contractor will renew the BAA every 12 months.

DHSS Data Rights All DHSS data (Public and Non-Public) related to services provided under this contract will remain the sole property of DHSS. De-identified or derived/aggregated DHSS data is not exempted from this requirement. This provision shall survive the life of the contract. Contractor does not acquire any right, title, or interest in DHSS data under this contract. Except as otherwise required by law or authorized by DHSS in writing, no DHSS data shall be retained by the Contractor for more than 90 days following the date of contract termination. After the 90-day timeframe the following provisions will remain in effect: contractor will immediately delete or destroy this data in accordance with NIST standards and provide written confirmation to DHSS; contractor is expressly prohibited from retaining, transferring, repurposing, or reselling DHSS data except as otherwise authorized by DHSS in writing; contractor retains no ongoing rights to this data except as expressly agreed to by DHSS in the contract.

User Acceptance Testing (UAT) and Training Environments The UAT and Training environments must be secured at a level equivalent to the security in place for the production environment. It must be sized and architected such that production-sized files can be copied over into UAT. The architecture must be equivalently configured so that performance and load testing will essentially produce the same results and expectations as testing in the production environment. Depending on the type of data (i.e., top secret/highly confidential, behavioral health) and specific security requirements around this data, there may or may not be an expectation to mask field values in the UAT and Training environments. Copying production data into lower environments may be prohibited especially for role-based training. Lower environments with production data that are secured in the same manner may be exempt from masking requirements as well however this may be subject to DHSS or Federal policies and regulations that override this potential exemption or explicitly disallow production data being copied into lower environments. The division Deputy Attorney General will be consulted on what is allowed/disallowed in non-production environments.

Data Masking in Non-Production Environments While securing of production data is of critical importance, migration of that data to lower environments presents its own set of challenges as lower environments typically are not as secure as the production environment. Masking of production data in lower environments usually involves deletion or obfuscation of actual PII-related field values such that they have no meaning as plain text and there is no identifiable method of translation back to the original values. If there are plans to copy production data to a less secure environment, Contractor will describe in detail their proposed masking strategy. If there is no expectation that production data will be copied into less secure environments, Contractor will describe their proposed test data generation plans and state clearly in this section that masking of production data is not required under this proposal.

Data Element Dictionary (DED) The contractor shall provide a DED and document all the table names, table descriptions, field names, field descriptions, field attributes, field positions, field sizes, valid values and primary keys associated with the application database and indicate whether each field is available in the Decision Support System. The contractor shall organize the DED with each table presented alphabetically as a separate section, order the fields for each table by position in the database, and depict the field information in a spreadsheet-like format.

Help Desk The contractor shall provide help desk services to all users by phone and email, and optionally through the internet using a secured online chat session. The help desk will field questions and issues on all aspects of the contract, including but not limited to the use and navigation of the application, login ID and password issues, data processing, website downtime, and reports.

The contractor shall operate the Help Desk 24/7/365. The contractor will acknowledge receipt of all help desk inquiries submitted by email within 5 minutes of receipt and resolve emailed inquiries within two hours of receipt. All help desk inquiries initiated by phone or online chat will be resolved during the exchange with the user, with the option to follow-up by phone or email if the exchange exceeds 10 minutes.

Change Management Summary The contractor shall describe their approach and methodology to change management. The contractor shall summarize their change management process, both in terms of configuration and customization, summarize the method to request change, summarize the process to rank and prioritize change requests (via a Configuration Control Board or equivalent), summarize the associated artifacts (e.g., change request form, approval form, UAT, etc.) and deliverables (e.g., project schedule, test plan, approval form, user documentation, etc.), and summarize the role of DPH.

Continuity of Operations Summary The contractor shall describe their approach and methodology to ensure all systems and data are securely and routinely backed up; and recovered timely following a natural disaster, power outage, cyber security attack, or any other event that impacts systems or data. The contractor shall identify any associated vendors, summarize backup and recovery procedures, summarize the testing and certification process, summarize the communication method for alerting DPH of a disaster or event requiring the execution of the Continuity of Operations Plan, and reference the Service Level Agreement (SLA) time to return to operations following notification to DPH.

Software as a Service (SaaS) Product The contractor will host a Software as a Service (SaaS) product to manage the inventory, distribution, information and laboratory testing associated with [the program’s system]:

· Referenced in “Electronic Surveillance System for the Early Notification of Community-based Epidemics Attachment 1_June 2025” spreadsheet. Also Referenced on pages 18-23.

Core Functionality Summary The contractor shall provide an itemized a list of the SaaS product core functionalities (e.g., user login; application use and navigation; application configuration; user screens, and reports) and for each functionality provide a description and include user interface screen samples. The contractor has the option to provide the equivalent information in the form of a User Guide.

Core Reports Summary The contractor shall provide an itemized a list of core reports that are deemed critical to managing monthly ticketing report, training details report, and monthly meeting follow up report and for each report provide a description of the purpose and include a sample report using test data.

Data Conversion Summary The contractor shall describe their approach and methodology to transform and import legacy data from the current database hosted. The contractor shall describe the approach to ensure data quality before and after the data conversion process, describe the manual and/or automated controls and methods to validate the conversion, and describe the process for data error detection and correction.

Mandatory Requirements for All Modules:

The contractor shall provide the following:

· Total hospitals reporting

· How many hospitals are reporting by county and state The following menu options:

· Home

· Alert List

· myAlerts

· myESSENCE

· VoI Status

· Event List

· Overview Portal

· Query Portal

· Stat Table

· Map Portal

· Bookmarks

· Query Manager

· Data Quality

· Report Manager

· Admin Portal

· More

· Edit Profile

· Logout [User First and Last Name]

· Bookmark Page

Technical Environment Requirements This is where the program can list out the “must-haves” for the technical requirements.

Example:

· Must be web-based and accessible by internal users.

· Must maintain appropriate security measures to control access authorized by personnel.

· Must follow the standards and requirements of the State of Delaware Department of Technology and Information (DTI) policy located at the following URL: (http://dti.delaware.gov/information/standards-policies.shtml)

· Must agree to and sign DTI Non-Public Data Owned by the State of Delaware Terms and Conditions (T&Cs) document located at the following URL: Terms and Conditions Governing Cloud Services and Data Usage Agreement

· Must provide and maintain a Production and Staging/Testing hosted environment for the Syndromic Surveillance Platform and supporting sub-systems, utilizing computer hardware exceeding application minimum specifications, hosted in a Tier 3 data center with multiple internet backbone links.

· Must provide 24/7/365 online support via a web portal. Upon submission, the user will receive an email confirmation and will automatically be notified of the submission via email.

· Must provide system performance tuning to ensure fast user interface, database, reports, and ETL performance.

· Must provide support and maintenance for existing SFTP connections and utilize Engage, Connect, Validate, Operate Methodology to onboard/re-onboard additional facilities as requested by the public health agency.

· Must provide off-site daily system backups and a target disaster recovery time objective of 24 hours.

· Must provide system support services include software upgrades, hotfixes, and patch deployment.

· Must secure the system using FISMA-Moderate and HIPAA-compliant security controls, verified by independent security scanning and auditing. This includes 256-bit SSL connections, end-user authentication for logging into the system, data encryption, updated virus protection, and multi-factor authentication, among other security controls.

· Must provide 99.5 percent uptime of the Client’s production environment exclusive of any scheduled maintenance and support.

· Standard Maintenance Window is from 10pm Friday – 4 am ET Saturday. Any system or Application maintenance will occur during this window.

· Must provide ESSENCE-related support for API calls (e.g., creating queries).

· Must manage the configuration management and release control process for the Syndromic Surveillance and supporting systems.

· Must provide new feature releases for ESSENCE application (e.g., UX refresh).

Security Requirements

· The Vendor will provide unique user IDs for each user.

· User accounts will include multi-factor authentication (MFA) using soft token access through phone, smartphone push, and / or SMS Text.

· The vendor shall encrypt all data in transit and at rest.

· Hardware security must maintain the preservation of unauthorized access to the Admin Section software and data. All electronic transfers of data must maintain HIPAA compliance.

· The vendor shall abide by the State of Delaware’s information security policy Delaware Information Security Policy

Data Exchange Requirements

· The vendor shall maintain base data sources including Emergency Department/Urgent Care, Air Quality, Weather, School Absentee Data, and Public Health Case Data.

· The vendor shall have the ability to add (develop, map, and integrate) additional data sources beyond the aforementioned data sources. Additional sources include Inpatient, Death, Poison Control, EMS, School Absenteeism, OTC, Prescriptions, etc. The State of Delaware understands the contract may be amended and a separate estimation and costing may be required.

4.14.8 Additional Functionality

· The vendor shall provide query builder capability, HL7, API compatible with SAS and R programming, graph visualization and stratification by various demographics, update category queries as they become available from CDC.

Required Data Elements:

ModeOfArrival

Time (Visit)

PIN (Medical Record Number)

Date

EssenceID

Zipcode

Patient Region

AgeOrig

AgeCalculated

Age

Age_Units

Age_Years

Sex

ChiefComplaintOrig

ChiefComplaintParsed

Category_flat

SubCategory_flat

Reportable Disease/Condition

Discharge Diagnosis

DischargeDisposition

MedRecNo

VisitNumber

Hospital

HalfHour

ProviderDiagnosis

MessageControlID

OnsetDate

PatientClass

ClinicalImpression

DiagnosisType

DispositionDateTime

InitTemp

InitTemp_Calc

Initial_Temperature_Units

InitPulseOximetry

InitialPulseOximetryUnits

InitPulseOximetry_Calc

InsuranceCoverage

Required Data Elements(cont.):

AdmitDateTime

RecordedDateTime

ObservationDateTime

PregnancyStatus

AmbulatoryStatus

AdmitReasonCombo

SendingFacilityID

SendingFacilityIDType initialacuitycode

DiagnosisCombo

DiagnosisPriority

MedicationCode

MedicationDescription

MedicationCombo

DischargeInstructions

DiagnosisDatetime

HighestTemp

TriageNotesOrig

TriageNotesParsed

TNCategory_flat

TNSubCategory_flat

CCDDCategory_flat

Race

Ethnicity

CCDD

DateTimeAdded

ChiefComplaintUpdates

DischargeDiagnosisUpdates

SmokingStatus

DiastolicBP

DiastolicBloodPressureUnits

SystolicBP

SystolicBloodPressureUnits

DischargeDxDescription

ProviderDxDescription

Shift

HoursSpentInED

HospitalState

Required Data Elements (cont.):

FacilityType

HealthSystem

ChiefComplaintMDTUpdates

PatientClassList

PatientClassUpdates

PatientClassMDTUpdates

DischargeDiagnosisMDTUpdates

DischargeDispositionUpdates

DischargeDispositionMDTUpdates

MessageTrigger

MessageTrigger_Updates

MessageTrigger_MDT_Updates

MessageType

Problem

Travel

BMI

ProviderType

UniquePhysicianID

Region of the Hospital

HospitalName

DDConverted race_flat ethnicity_flat

HasBeenE

HasBeenI

HasBeenO

HasBeenAdmitted

HomeFacilityDistance

Hospital_Unit

Hospital_unit_code hospital_unit_description

DDAvailable

CCAvailable

DDInformative

CCInformative

InsurancePlanID

Ethnicity_Description

Ethnicity_Calc

Required Data Elements (cont.):

Race_Description

Race_Calc

Diagnosis_Text

Diagnosis_Coding_System

Problem_List

Medication_List

Medication_Prescribed

Insurance_Company_ID

Insurance_Company_Plan_Type

Facility_Name_Treating

Facility_ID_Type

Facility_Street

Facility_City

Facility_County

Facility_State

Facility_Type_Code

Facility_Type_Text

Facility_Type_Calc

Facility_Latitude

Facility_Longitude

Patient_City

Patient_County

Patient_State

Admit_Reason_Code

Admit_Reason_Description

Hospital_Service

Physician_ID

Height

Height_Units

Weight

Height_Calc

Weight_Units

Weight_Calc

Admission_Type

Admit_Source

Previous_Hospital_Unit

Initial_Acuity

DateProcessed

Required Data Elements (cont.):

Death_Date_Time

Death_Indicator

Facility_ID

Patient_Country

Patient_County_Calc

Patient_ID

StagingRowID

Procedure_Code

Procedure_Text

Procedure_Code_Naming_System

PRREGION

ICD_Chapter_Flat

ICD_Chapter_Desc_Flat

ICD_Section_Flat

ICD_Section_Desc_Flat

ICD_Diagnosis_Flat

ICD_Diagnosis_Desc_Flat

ICD_CCSR_Flat

ICD_CCSR_Desc_Flat

C_DiagnosisCode_ICD10_Flat

C_DiagnosisCode_ICD9_Flat

C_DiagnosisCode_SNOMED_Flat

DDParsed

CCDDParsed

NameOfFile

MessageDateTime

HL7 Message

WeekYear

MonthYear

QuarterYear

Year

Disposition Category

Age Group

VisitDate

C_Race

C_Ethnicity

CRace_CEth_Combined_Narrow

CRace_CEth_Combined_Broad

Required Data Elements (cont.):

Medications

MedicationList

Sending_Facility

Diagnosis_Date_Time_Min

Diagnosis_Date_Time_Max

HospitalZipCode

Patient_Street_Address

OpioidUse

CannabisUse

SmokingStatusSegment

InitialAcuitySegment

DateOfBirth

PatientFirstInitial

PatientLastInitial

Patient Name

PatientAddress

Patient_City

Patient_Country

Patient_County

Patient_County_Calc

Patient_ID

Patient_State

Patient_State_Calc

Patient Zipcode

DDProcessed arriveddatetime

FirstDateTimeAdded

ComboRegionName

AccountNumber

Ack_Code

Ack_ID image1.emf