PERFORMANCE WORK STATEMENT (PWS) DEPARTMENT OF VETERANS AFFAIRS

Office of Information and Technology Office of Mental Health Services Office of Suicide Prevention Office of Specialty Care Veterans Integrated Service Network 4 Mental Illness Research and Education Clinical Center

Structured Self-Assessment Data Capture Software Maintenance and Technical Support

PWS Version Number: 1.0

1. BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Office of Mental Health (OMH), the Veteran Integrated Service Network (VISN) 4 Mental Illness Research Education and Clinical Center (MIRECC), Office of Specialty Care, and the Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program (SSG Fox SPGP), part of the Office of Suicide Prevention (OSP) have requirements for software that supports VA’s clinical priority of using measurement-based care and screening in the treatment of mental illness and other health conditions (i.e., complex chronic conditions). OMH also requires software for the collection of program evaluation data mandated by OMH policy. Measurement-based care encompasses the use of standardized patient reported outcomes (PROs) to inform clinical decision making and/or to screen for symptoms and other health concerns. PROs are standardized questionnaires with items that ask about a range of health symptoms and treatment outcomes. To satisfy this requirement, VHA shall require software configuration, maintenance and technical support to accomplish these goals.

The overarching need for the VA is to have a software solution that allows staff to send patient reported outcome measures (PROs) to Veterans by text or email as well as on properly configured tablet and for those responses to be returned and populated in the Electronic Medical Record or other properly authorized data repositories. This software solution should also support provider and Veteran direct entry of program evaluation data with an option to circumvent the Electronic Medical Record and supply data directly to OMH.

2. APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12,

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. Review And Use Of Patient-Generated Health Data Under The Office Of Connected Care, VHA Directive 6506

71. Guideline for the Collection, Monitoring and Use of Asynchronous Veteran Self- Reported Health Data Office of Mental Health SharePoint https://dvagov.sharepoint.com/sites/VACOMentalHealth/SitePages/Async_Comms- Data.aspx.

3. SCOPE OF WORK

The Contractor shall provide enterprise software licenses, maintenance, training, and updates for software solution. This effort shall include program management, software configuration, software maintenance, testing, helpdesk, and training for software features. The software shall interface with VA electronic medical record (EMR), currently including Oracle/Millennium and Veterans Health Information System Technology Architecture (VistA) / Computerized Patient Record System (CPRS) systems.

4. PERFORMANCE DETAILS

4.1. PERFORMANCE PERIOD

The Period of Performance (PoP) for this contract is a 12-month Base Period with 4 option years and with optional tasks that can be exercised throughout the life of the contract. The overall Period of Performance shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows: Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

4.2. PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3. TRAVEL

The Government does not anticipate travel under this effort and shall not reimburse travel costs unless approved in advance and in writing by VA.

5. SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the tasks outlined in paragraphs 5.1 to 5.6 below. This contract covers the use of a software solution for all VHA users and OMH program evaluation.

5.1. PROJECT MANAGEMENT

5.1.1. CONTRACTOR PROJECT MANAGEMENT PLAN

a. The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

b. Deliverable:

Contractor Project Management Plan

5.1.2. REPORTING REQUIREMENTS

a. The Contractor shall provide the Contracting Officer’s Representative (COR) with Monthly Progress Reports in electronic form. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

b. The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations.

c. The Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

d. Deliverable:

Monthly Progress Report

5.1.3. WEEKLY, BI-MONTHLY AND AD-HOC TELECONFERENCES

a. The Contractor shall participate in monthly teleconferences with representatives of the VISN 4 MIRECC for ongoing project management review and discussions of priorities for upgrades and enhancements. There will also be monthly calls with each work stream (e.g. SSG Fox, Specialty Care, OMH Program Evaluation, etc.). Ad-hoc calls may be necessary for urgent issues such as a system failure, deadlines that are urgent for the Government Accountability Office, Inspector General or Congressional inquiries, or an unforeseen problem. For Specialty Care and OMH Program Evaluation, there will be Standing Weekly and Bi- weekly (every other week) meetings to include but not be limited to maintaining Office Hours support for clinician end users, clinician meetings, program management coordination, all meetings associated with supporting Agile approach with backlog reviews, sprint planning, Risks, Assumptions, Issues, and Dependencies (RAIDs), and data science meetings. Ad hoc calls and meetings may be necessary for urgent issues and to support active quality improvement/quality assurance (QI/QA) activities.

5.2. SOFTWARE REQUIREMENTS

A. Software configuration and sustainment efforts shall include Human Centered Design (HCD) and Software Application Performance Monitoring (APM). VA Digital Service has developed two (HCD and APM) Digital Service PWS Language guides to assist. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=27

B. The software solution shall allow Veteran completion of Patient Reported Outcomes (PROs) on the Veteran’s phone or computer; as well as by tablet device in the office.

C. The solution shall allow staff to send assessments to Veterans by text and/or email and for Veteran data to be sent back to the VA. The solution shall allow staff to send one or multiple PRO’s in each request.

D. The software shall allow for the creation and maintenance of a library of PROs with VA’s input on the selection. The current library of PROs is over 150. The software library shall support all existing PRO’s plus include the ability to add new PRO’s in each contract year. A full list of existing PROs will be made available upon request. The VA is responsible for all licensure and copyright requirements for any PROs. In addition, the software must support all existing PROs, forms, and surveys used by OMH for program evaluation, as well as allow for new program evaluation forms/surveys to be built to support new OMH evaluation priorities.

E. Critical features in sending requests to Veterans include the ability to: send batches of assessments automatically triggered by upcoming scheduled appointments; send single requests which may include multiple different PRO’s; the ability to specify multiple recipients; and send to a specific population of patients (e.g. an established panel or curated list of patients).

F. It shall allow Veterans and staff to complete PROs/enter data on Government furnished equipment (GFE) (e.g., tablet device or computer kiosk workstation).

G. Additionally, the solution shall be available at all facilities and for all staff with access controlled by Single Sign On (SSO) authentication.

H. The solution shall allow staff to send one or multiple PRO’s, in each request. In an easy-to-read format and with an interface that makes it easy to respond to questions. There should be consistency and compatibility across device types (e.g. phone, tablet, desktop, etc.) and across different browsers.

I. The software solution must allow creation of a panel of patients for each VA staff member to follow.

J. The PRO data shall have the ability to be used as part of program evaluation and for direct patient care.

K. This software shall provide clinical program informatics support that allows for tracking patients over time and user-friendly data visualizations (e.g., graphs, tables, etc.) based on user-centered design that support monitoring PROM and other clinical assessment results over time.

L. Self-reported clinical data collected through the software shall populate the Electronic Medical Record (EMR) as the system of records as required by the VA for each PRO. Patient response placed in the EMR shall reflect the same wording as presented to the patient. In instances in which VA maintains a data repository of item line responses, the software shall populate those responses including date and time stamps (e.g. ORACLE smart forms (if available), VISTA Mental Health file). All clinical assessments (e.g., PROs, etc.) not available in a VA EMR repository, shall be made available to the VA Clinical Data Warehouse (CDW). Data from program evaluation will be separately stored for VA use on VA systems.

M. The software will have the ability to send PROs that allow view only access by the VA staff member and may not have a requirement to populate the EMR (e.g. psychotherapy homework). These assignments should be viewable by the Veteran over time rather than be limited to access only while completing the work.

N. Critical features in populating the EMR include the ability for Veteran responses to populate the EMR with or without review by a VA staff member. The populated data shall have the ability to be signed by a system account and/or require a VA staff member signature for documentation.

O. Any proposed software solution must support the existing infrastructure of administration of all existing assessments (e.g., PROs, Patient Experience Measurements (PREMs), program evaluation, etc.) until a smooth transition to a new solution can be realized. VHA staff and Veterans should not have any gaps in their ability to use these clinical and program evaluation tools, view results, collect evaluation data, etc., nor experience a significant learning curve with any new proposed software solution.

P. In addition, the software shall:

1. Be easily used by VA staff regardless of setting

2. Provide reminders to clinicians to complete tasks after a designated period of time (e.g., reminders to review of responses returned by patients via text or email and to upload PRO data to the EMR).

3. Be easily used by Veterans

4. Provide reminders to Veterans to respond to incomplete PRO assignments.

5. Support measurement-based care throughout all VHA healthcare settings.

6. Allow Veterans to partially complete responses to PROs, save their progress, and return to complete at another time.

7. Include decision support including scoring of PROs and flagging for high-risk responses as directed by VHA. Scoring of assessments varies by PRO but must include the ability to conduct simple addition, rescoring based on defined algorithms, averaging, multiplying, and other simple math.

8. Allow for scoring of PROs that have subscales and result in multiple subscores.

9. Allow VA to specify which PROs must be completed fully by users and which PROs can be submitted and scored with only partial completion (i.e., when Veterans can elect to selectively skip questions and still get a score).

10. When used for clinical support, the software solution should be launched from the EMR and should default to opening to the Veteran that was being viewed in the EMR.

11. Allow sending of assessments by a surrogate such as the clinical support staff.

12. Creates progress notes and patient facing summary materials (Patient Handout) that include graphs of progress.

13. Provide clinical program informatics support that allows for tracking patients over time, monitoring patients’ outcomes over time, and accessing patient and program level data.

14. Provide the ability to send standardized informational sheets (e.g. PDFs) to Veterans based on specified criteria such as responses to PRO’s.

15. Meet all VA Office of Information Technology, privacy, security and technical requirements for enterprise-wide use.

16. Comply with and utilize VA text service and email service.

17. Be capable of building and testing new/existing program evaluation forms (to be counted in the “new assessment” counts) and assisting with deployment of forms to field sites into the existing program services.

18. Support of user account configuration (multi-site), single sign-on and Oracle/Millennium and Vista/CPRS transmission (tasks enabling PRO’s to transfer to Oracle/Millennium)

19. Capable of building data feeds of form data to OMH/ Northeast Program Evaluation Center (NEPEC) servers and workspaces.

20. Maintain interoperability between VA Enterprise Cloud (VAEC) environment and the software solution for the OSC programing.

21. Continue advanced analytical approaches and maintain data products in VAEC environment for the OSC programing.

22. All outgoing engagements with Veterans via email and/or text will be from a va.gov source.

23. Mature features informed by advanced analytical approaches that may enhance the clinician and/or Veteran experience, streamline workflows, as well as provide value proposition to VA.

24. Collaborate with VA partners and SMEs to help validate findings from advanced analytical approaches.

25. Capture lessons learned and best practices from existing use case/s and explore expansion to other clinical use cases (e.g., cancer care, etc.) through proof-of-concept work.

Q. Government Rights in Data

a. License rights in any Commercial Computer Software shall be governed by FAR 52.227-19, Commercial Computer Software License (DEC 2007). Any data delivered shall be submitted and protected IAW VA handbook 6500.

b. Data Rights Clauses: Clause 52.227-19 is the primary governing clause for this action. However for section F1 and F2 of this contract Clause 52.227-14 will be the governing clause.

5.2.1. NEW ASSESSMENTS

a. The Contractor shall provide the software that will allow the VA Business Owner to add up to 10 new assessments (~10 questions in length) to the software solution in each contract year. This would be for either program evaluation or clinical PROs.

b. New assessments added to the software solution shall be approved by VA. For mental health related assessments, this shall be in cooperation with the OMH Strategic Technology Enhancement Committee (STEC) or the Northeast Program Evaluation Center for program evaluation assessments. VA is responsible for all issues related to assessment copyright and licensing when applicable.

c. Any assessments collected solely for the purposes of program evaluation shall not be entered into the EMR and the data shall be partitioned in the software from the clinical data. Program evaluation data shall also be partitioned in separate files in VA data storage (e.g. CDW).

d. The Contractor shall comply with recommendations by the Digital Health Office, Office of Mental Health, and Specialty Care Office on the collection of asynchronous clinical data. This includes flagging any high-risk responses as directed.

5.2.2. MAINTENANCE

a. This agreement shall cover the licensing, maintenance, technical support, and enhancement of the software solution.

b. The Contractor shall provide licensing and maintenance support for the availability of the software at all facilities with the potential for all authenticated electronic health record users to have access. This shall consist of all updates, patches, fixes, and security resolutions developed by the software provider.

c. The Contractor shall provide maintenance and technical support for all software across the enterprise to ensure the software remains operational. This shall include troubleshooting and software defect fixes for the software applications and related databases. In the event that troubleshooting identifies deficiencies attributable to the Department of Veterans Affairs (VA), including but not limited to limitations in infrastructure resources, the VA shall ensure that appropriate and timely mechanisms are furnished to remedy such deficiencies as identified by the Contractor. The Contractor shall upgrade any defect fixes for the software to all the other installation sites. The Contractor shall also provide technical support for site audit, site inspection, backup issues and security issues to be handled through a help desk service operating Monday through Friday, 9:00AM until 5:00PM Eastern Standard Time. In the monthly report, the Contractor shall provide a listing of any downtime, offline or unavailability incidents. The software shall be operational at least 99% of time, not inclusive of VA outages (i.e. SSOi, EMR, VA Network, etc.). The Contractor shall maintain a list of bugs with anticipated time to fix.

5.2.3. TECHNICAL SUPPORT

a. The Contractor shall work with the enterprise service desk to manage user first queries. For items escalated to the contractor, the contractor shall have 48 hours to resolve any user access or account issues once deemed a defect of the software solution. If not within 48 hours, the VA shall be notified with a remediation plan.

b. The Contractor shall maintain a helpdesk presence by email. Users may email suggestions, complaints, outage issues, etc.

c. The Contractor shall provide technical support to site users for the software, to include User account configuration (multi-site), SSO and Oracle/Millennium transmission (tasks enabling clinical assessments (PROs, PREMs, etc.) to transfer to Oracle/Millennium when available).

d. The Contractor shall provide virtual remote technical support to manage user calls, create trouble tickets, and provide responses within four hours of a request during helpdesk hours, see below.

e. The Contractor shall provide technical support to site users for the software solution, to include User account configuration (multi-site), single sign-on and Oracle/Millennium and Vista/CPRS transmission.

f. The support required ranges from normal to high priority to include log in issues, clinical set ups, platform crashes, and server downtime. The frequency of tickets is on average 104 tickets and calls per month, 1-8 tickets a day, Monday through Friday. Support services shall be provided Monday through Friday from 9:00 AM until 5:00 PM Eastern Standard Time (EST). The Contractor shall provide virtual remote technical support to manage user calls, create trouble tickets, and provide responses within four hours of a request.

g. The Contractor shall provide all technical support information performed in the Monthly Technical Support Report to track all assistance support provided and the time it took to resolve issues.

h. In collaboration the VISN 4 MIRECC all configuration schedules, plan deployment dateswill be coordinated with each workgroup.

i. The Contractor shall maintain the existing data architecture within their server environment to receive, store, and transmit data received from the forms. This data architecture and server environment shall comply with all data security regulations and requirements. The Contractor shall provide maintenance and support for any mutually agreed upon form updates and server configuration needs. For the avoidance of doubt, this Contract refers to maintenance and sustainment of the SSG Fox SPGP software solution, and does not include grantee training and education, maintenance of the SSG Fox SPGP Onboarding platform, or data analytics.

j. The Contractor shall support the Specialty Care Program and its current effort in the VA Enterprise Cloud (VAEC) environment leveraging cloud-based capabilities with all VA authoritative data sources (i.e., CDW, CXI, etc.) to enhance actionable clinical intelligence for VA clinicians to engage with at-risk Veterans. This may also include results from advanced analytical approaches. Current Azure platform connects to BHL through Power BI export and Power Apps triggering Power Automate to extract patients lists to BHL.

k.

1. Services to be provided for the Office of Specialty Care: Scrum team to support maintaining the digital solution with key features to support greater interoperability with the software solution and the EMRs. This includes providing insights from analytical efforts to clinicians to support automation of workflows, scale clinical activities, as well as to optimize engagements with Veterans and transitioning Service Members. This team will support an operational clinician-facing dashboard while also continuing to support work to maintain features as well as to support operability at least ten VA sites.

l. Deliverable:

Monthly Technical Support Report.

5.2.4. EMR INTEGRATION

a. EMR integration: The Contractor shall also manage ad-hoc meetings with Oracle and the Behavioral Health council to identify assessment priority, define Oracle and the proposed software implementation assessment tasks, configure assessment mapping information, identify deployment dates.

5.2.5. VA ATO COMPLIANCE

a. Authority to Operate (ATO): Contractor shall comply with all VA regulations governing managing clinical data. Moreover, the Contractor shall work with the Office of Information Technology, the Digital Health office, and Office of Mental Health to assure appropriate security reviews, data storage requirements, and an ATO for the software solution. The Contractor shall work with VA Notify to maintain compliance with all Veteran messaging.

b. If the solution is not FedRAMP authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements <<Insert Impact Level from the Data Security Categorization. This should be done by DTC.>> as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a SaaS product as defined by the following criteria: Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for minor in-app customizations. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

· On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

· Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

· Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

· Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

4. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor The Cloud Service Provider for a FedRAMP Authorization. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application at the impact level required by VA to utilize the product. For this solution the required impact level is: <<Insert Impact Level from the Data Security Categorization. This should be done by DTC.>>

6. The Contractor shall comply with FedRAMP requirements surrounding data location within the Continental United States. FedRAMP specifies data location requirements in the High Baseline as part of control SA-9 (5); however, FedRAMP does not provide or specify data location requirements for other baselines.

7. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation including required attachments within 75 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 94 calendar days after contract award.)

8. The Contractor shall work with a VA DTC Subject Matter Expert to develop a specific system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at VA. The Contractor shall complete this deliverable with VA within 10 calendar days of contract award.

9. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due after 113 calendar days after contract award.)

10. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 calendar days after the SSP is accepted by VA. (If Data Security Categorization is High Impact, this will be due 113 calendar days after the SSP is accepted by VA.)

11. The Contractor shall work with VA Subject Matter Experts to test the validity of the Incident Response Plan (IRP) and ensure proper troubleshooting of issues that may arise. This should be completed within 30 calendar days of the SSP being delivered.

12. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

13. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information, and Information System Security/Privacy Language.

14. The Contractor shall comply with data management requirements.

15. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

16. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP website.

17. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

18. The Contractor shall provide continuous monitoring activities including, but not limited to scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by VA and FedRAMP requirements.

19. The Contractor shall provide a monthly inventory report of VA sites currently utilizing the cloud product post ATO award. The inventory report will include the number of licenses being utilized and the specific VA site.

Deliverables:

A. FedRAMP System Security Plan (SSP) and required Attachments B. VA Implementation Diagram C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. Plan of Action and Milestones Monthly Reports.

F. Monthly Inventory Report

c. If the solution is FedRAMP Authorized but not VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA)

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

3. The system must be FedRAMP Authorized at no less than the <<Insert Impact Level from the Data Security Categorization. This should be done by DTC.>>

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall provide confirmation of their FedRAMP System Security Plan (SSP) and supporting documentation completion via their repository ID number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

6. The Contractor shall work with a VA DTC Subject Matter Expert to develop a specific system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at VA. The Contractor shall complete this deliverable with VA within 10 calendar days of contract award.

7. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 10 calendar days of contract award.

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 10 calendar days after the SSP is accepted by VA.

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. The Contractor shall work with VA Subject Matter Experts to test the validity of the Incident Response Plane (IRP) and ensure proper troubleshooting of issues that may arise. This should be completed within 30 calendar days of the SSP being delivered.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

13. The Contractor shall comply with data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

15. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy.

16. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

17. The Contractor shall provide continuous monitoring activities including, but not limited to scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by VA and FedRAMP requirements.

18. The Contractor shall provide a monthly inventory report of VA sites currently utilizing the cloud product post ATO award. The inventory report will include the number of licenses being utilized and the specific VA site.

Deliverables:

A. FedRAMP System Security Plan (SSP) and required Attachments B. VA Implementation Diagram C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. Plan of Action and Milestones Monthly Reports.

F. Monthly Inventory Report

d. If the solution is FedRAMP Authorized and VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as <<Insert Impact Level from the Data Security Categorization. This should be done by DTC.>>

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

6. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

7. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language. VA Privacy and Security deliverables as directed by the VA System owner.

8. The Contractor shall comply with data management requirements.

9. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

10. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP Website.

11. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

12. The Contractor shall provide a monthly inventory report of VA sites currently utilizing the cloud product post ATO award. The inventory report will include the number of licenses being utilized and the specific VA site.

Deliverables:

A. 3PAO Security Assessment Report (SAR) B. Continuous Monitoring Monthly Scans C. Plan of Action and Milestones Monthly Reports.

D. Monthly Inventory Report

5.3. SOFTWARE ENHANCEMENTS AND CHANGES

5.3.1. SOFTWARE UPGRADES

a. The Contractor shall upgrade the software solution and database platform to include any security, deployed mutually agreed upon user feedback, and VA Standards based functional enhancements for all users. This shall include new measures to specifically support VHA. This service encompasses changes requested by VA to be made to the software solution including:

1. Operational sustainment task support

· Helpdesk

· Backup & Restoration

· System Upgrades

2. Defect resolution and maintenance of:

· Assessment logic

· Reports

· Administrative functions

· Security

· Electronic Health Records interface modifications

· General Software functions

3. VA specific documentation for security, policy or other required documents

5.4. OPTION PERIODS

All tasks from the base year will carry over to Option Periods if added to the contract.

5.5. OPTIONAL TASKS

5.5.1. ADDITIONAL ASSESSMENTS OPTIONAL TASK

5.5.1.1. AGILE DEVELOPMENT

a. For each assigned analytics product/configuration project, the Contractor shall follow an Agile project management approach in the configuration, execution, and deployment of BI&A and data science products. The Contractor shall recommend and adopt, subject to Government approval, the most appropriate method or methods (or hybrids) to use in deployment of analytics products and solutions (e.g., Scrum, Scrumban, Kanban, and Extreme Scoping).

b. The Contractor shall:

1. Follow best practices in Agile solutions delivery

2. Ensure transparency into all build/product configuration activities

a. Maintain and make available all standard artifacts based on chosen Agile methodology (e.g. for Scrum – product/sprint backlog, burndown chart, velocity chart, product increment, retrospective)

b. Utilize a single Agile management tool to track execution (Confluence, Jira, or other Agile tool as required) as the authoritative data source

3. Maintain a backlog of requirements

a. Coordinate and conduct regular backlog refinement with participation of key stakeholders (business customers, DAPM leadership, COR, product owner, OIT and system subject matter experts, others as applicable) to capture and update requirements, which will be stored as a Requirements Packages in VA-approved tools (Confluence, Jira, etc.) at an interval agreed upon by key stakeholders

1. Requirements Packages shall include prototypes, proofs of concept, mock-ups, visual aids, and dynamic wireframes as required to demonstrate the navigation, taxonomy, menus and dependencies between features in the user interface (UI) and all aspects of the presentation layer that interact with the user

b. Score user stories in the backlog based upon a standardized story point sizing methodology, submitted to and approved by the product owner or other relevant key stakeholders

c. Implement a change control process to coordinate change request approval

d. Develop, update as necessary, and make available a ranked and prioritized Product Backlog Report

4. Build/Product Increment (PI) Planning

a. Coordinate and conduct PI planning with key stakeholders prior to beginning any increment

b. Coordinate and conduct Initial Design Review (as applicable) with key stakeholders to ensure design is technically acceptable

c. Develop Build plan/roadmaps, taking into account build complexity, resource availability, and resource capability and deliver to key stakeholders for review/approval

5. Build Test Plan (as applicable)

a. Provide a Build Test Plan to key stakeholders for review and approval prior to beginning any configuration activities

b. Demonstrably execute the Build Test Plan throughout configuration

6. Conduct regular Sprint Retrospectives

a. Identify and document pain points, gaps, risks, and opportunities for system enhancements for potential inclusion in the backlog

b. Review sprint activities to identify areas for improvement

c. The Contractor shall provide Sprint Burn Down Chart, a graphical representation of work left to do versus time for each Sprint

d. The Contractor shall provide a Scrum Velocity Chart, a visual tool, that tracks the amount of work a Scrum team completes during each sprint

e. Every quarter, meet with the COR and provide a general overview of work achieved during that quarter. This can be done along with a Sprint Retrospective. The COR will provide the schedule for these quarterly reviews.

7. Capture information shared in meetings as appropriate and upload to a central repository (e.g. Teams)

c. The Contractor shall adjust deliverables and repository tool updates to match the nature of the analytic process under configuration/operation.

d. Deliverables:

1. Build Plan/Roadmap

2. Build Test Plan

3. Product Backlog Report

4. Sprint Burndown Charts

5. Velocity Charts

5.5.1.2. ADDITIONAL SCRUM TEAM SUPPORT (OPTIONAL TASK ONE)

a. To meet VA priorities, VA may require completion of additional projects throughout the m of this contract. VA may exercise this optional task for additional scrum teams to support configuration, interfaces, testing and/or system enhancement projects following the software configuration lifecycle described in Section 5.3, including all subparagraphs, of this PWS. Each task may be of different level of effort.