36C10A19R0063-002.docx

ADDENDUM B

Solicitation 36C10A19R0063 Addendum B

Performance Work Statement

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology and National Center for Ethics in Health Care

Cloud-Based Signature Informed Consent for Clinical Treatments and Procedures Enterprise Solution

Date: November 16, 2018 Version 1.0

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information and Technology (OI&T) is to develop and maintain Information Technology (IT) products and systems that serve our Veterans by supporting the work of the Veterans Health Administration (VHA), Veterans Benefits Administration, and the National Cemetery Administration.

VHA is the largest integrated health care system in the United States, consisting of 150 medical centers and nearly 1,400 community-based outpatient clinics, community living centers, Vet Centers and Domiciliaries. Together, these health care facilities and the more than 53,000 independently-licensed health care practitioners who work within them, provide comprehensive care to more than 8.3 million Veterans each year. VHA personnel practice all medical specialties and provide medical and rehabilitative treatment of all kinds, from acute to long term care to outpatient care.

Within VHA, the National Center for Ethics in Health Care (NCEHC) serves as the authoritative resource for addressing complex ethical issues relating to clinical ethics, organizational ethics, organizational policy, and research ethics. NCEHC works with OI&T to provide technology to empower patients and promote shared decision making through use of a cloud-based solution application that helps clinicians manage the informed consent process electronically.

VHA’s NCEHC is the business owner of the requirement for signature informed consent cloud-based solution that assists VA health care professionals in documenting patients’ signature and informed consent for over 2,000 treatments/procedures that require signature informed consent. The cloud-based solution will also document Veterans’ completion of VA Form 10-0137, “VA Advance Directive and Durable Power of Attorney for Health Care” (Advance Directive). All of these forms require the electronic capture and storage of the patient’s and provider’s handwritten signature on a specific VA form for storage in the Electronic Health Record (EHR) with an associated progress note. These signed forms are stored as electronic images in VA’s Veterans Health Information Systems and Technology Architecture (VistA) Imaging system.

VA requires functionality for electronic signature informed consent, and patient education documents for all medical specialties, stored in the VA electronic patient health record, with a single sign on capability through the use of a Personal Identification Verification (PIV) card.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following, VA Directives and Handbooks can be queried using http://www.va.gov/vapubs/:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002.”

2. Federal Information Security Modernization Act of 2014.

3. Federal Information Processing Standards (FIPS) Publication (Pub.) 140-2, “Security Requirements for Cryptographic Modules.”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016.

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013.

7. 10 U.S.C. § 2224, "Defense Information Assurance Program."

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010.

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974.”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964.”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010.

13. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016.

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008.

15. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003.

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016.

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS).”

18. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008.

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998.

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004.

21. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012.

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015.

23. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008.

24. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016.

25. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring of VA Information Systems,” February 3, 2014.

26. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010.

27. VA Handbook 6500.6, “Contract Security,” March 12, 2010.

28. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011.

29. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp.

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx).

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014.

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015.

33. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016.

34. VA Directive 6300, Records and Information Management, February 26, 2009.

35. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010.

36. NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 10, 2014.

37. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015.

38. OMB Memorandum, “Transition to IPv6”, September 28, 2010.

39. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015.

40. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006.

41. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003.

42. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005.

43. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011.

44. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008.

45. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011.

46. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification Credentials in Physical Access Control Systems, November 20, 2008.

47. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007.

48. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017.

49. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014.

50. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012.

51. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014.

52. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514).

53. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514).

54. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

55. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013. (reference https://www.doi.gov/sites/doi.gov/files/uploads/tic_ref_arch_v2-0_2013.pdf)

56. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007.

57. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008.

58. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007.

59. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade”, dated March 19, 2015.

60. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001.

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 .

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103.

63. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 .

64. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 .

65. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 .

66. “Veteran Focused Integration Process (VIP) Guide 2.0”, May 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 .

67. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411 .

68. “POLARIS User Guide”, Version 1.2, February 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412 .

69. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 .

70. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 .

71. VHA Handbook 1907.01 “Health Information Management and Health Records,” July 22, 2014.

72. VA Handbook 1004.01, “Informed Consent for Clinical Treatments and Procedures,” August 14, 2009.

73. VA Handbook 1004.02, “Advance Care Planning and Management of Advance Directives”, December 24, 2013.

74. VA Handbook 1004.05, “iMedConsent™”, December 10, 2014.

75. VA Enterprise Cloud (VAEC) Technical Reference Guide Attachment A, Version 1.3 July 2018.

76. VA Directive 6517- VA Cloud-First Policy, January 16, 2018. (reference https://www.va.gov/DIGITALSTRATEGY/docs/VADirective6517_RiskManagementFrameworkForCloudComputing.pdf)

77. VA Memorandum Use of Software as a Service, Managed Services, and Cloud-Based Native Technologies and Approaches, April 10 2018, Deputy Assistant Secretary Bill James, Enterprise Program Management Office (EPMO), Office of Information and Technology (OIT) (Reference https://www.oit.va.gov/library/files/edp/mvf/MVFAEDP_Development_v1.pdf)

78. VA Directive 6066, “Protected Health Information (PHI) And Business Associate Agreements Management”, September 2, 2014

79. VA Directive 0006 Talent Management System (TMS) E-Learning Section 508, September 18, 2012.

SCOPE OF WORK

The contractor shall provide and maintain a Signature Informed Consent (SIC) solution capable of documenting signature informed consent for treatments and procedures, advance directives, and other VA Forms, for all clinical specialties at all VHA’s 150 medical facilities located in all 50 states, Puerto Rico, Guam, and the Philippines. All references to “SIC” in this document are defined as a cloud-based, load balanced, electronic signature informed consent web application in a clustered high availability database environment.

The contractor shall provide updates to new and existing form content and provide technical maintenance and support for the SIC solution.

The contractor shall provide a cloud-based web application with high availability (as described in section 5.3 of this PWS) clustered enterprise database version of its electronic signature informed consent software that is compatible with the VA’s enterprise architecture. The contractor shall ensure the SIC solution has PIV card and Single Sign-On (SSO) user identity and access management capability.

The contractor shall use an agile methodology and follow the VIP program management process. The contractor shall provide Operations and Maintenance (O&M) support for the SIC solution as a result of this PWS.

The contractor shall use the VA Enterprise Cloud (VAEC) as the hosting environment for this SIC solution, in accordance with VA’s Cloud First Policy.

The contractor shall provide information assurance and cybersecurity subject matter expertise to ensure the solution is designed, developed, integrated, tested, implemented, and sustained in compliance with VA’s Enterprise Cloud and Enterprise Security compliance requirements and standards.

The contractor shall use cloud native approaches in accordance with VA’s Use of Cloud-Based Native Technologies and Approaches Policy.

The contractor shall provide computer-based training of the SIC solution for user and administrative user roles, as set forth in the optional tasks.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (POP) shall be 12 months from date of award with four 12-month option periods, and the following optional tasks:

Option for Training Packages: The POP shall be four months from the date the option is exercised.

Option for Temporary Alternate Paper-Based SIC Form Creation: The POP shall be four months from the date the option is exercised.

Option to Integrate and Interface with VA’s Cerner EHR Platform: The POP shall be six months from the date the option is exercised.

Option for Updated Training Package: The POP shall be one month from the date the option is exercised.

Option for SIC Clinical Database Content: The POP shall be one month from the date the option is exercised.

The total POP of the contract, inclusive of options, shall not exceed five years.

PLACE OF PERFORMANCE

Tasks under this PWS shall primarily be performed at the contractor’s facilities. Work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO) or the Contracting Officer’s Representative (COR).

There are ten (10) Federal holidays, set by law (USC Title 5 Section 6103), that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

TRAVEL

The Government encourages the contractor to maximize its use of teleconferencing and video conferencing for meetings.

The Government anticipates travel to perform the tasks associated with the effort. Travel shall be in accordance with the Federal Travel Regulations and requires advanced concurrence by the COR.

The following table is the Government’s estimated long-distance travel:

SPECIFIC TASKS AND DELIVERVABLES

CONTRACTOR PROJECT MANAGEMENT

The contractor shall designate a contractor Project Manager (PjM) as its main point of contact (POC) between the VA Project Manager (PM) and the contractor’s organization. The PjM shall oversee and manage the schedule and all tasks associated with this PWS.

The contractor shall:

1. Provide a contractor staff roster in accordance with section 6.2.2 of this PWS.

2. Maintain a Contractor Project Management Plan (CPMP) that describes the technical approach, organizational resources, and management controls to be employed to meet the schedule and performance requirements of all deliverables, as defined in this PWS. The CPMP shall include a risk management plan and a communication plan and be updated by the contractor when changes are required. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

3. Develop and maintain deliverables and perform the tasks specified herein.

4. Identify, prioritize, bound, resource, and assess course of actions related to program risks. The contractor shall inform the VA PM of relevant deliberations and contractor recommendations.

5. Recommend mitigation and resolution strategies for project risks as they are identified.

6. Provide a Monthly Progress Report (MPR). The MPR shall report activities completed in the prior month and activities planned for the next month. The MPR shall include a project status summary, change request status (new, open, and closed since last report), issue/action item status (new, open, and closed since last report), risk items and their disposition.

7. Create meeting minutes for all contractor-facilitated conference calls and meetings held with the VA PM.

8. The contractor shall notify the VA PM, COR, and CO, in writing, immediately if the contractor is aware of anything that adversely impacts the contractor’s performance under this PWS.

9. The contractor shall deliver necessary onboarding documentation to the COR including IBM Rational Tools and Privacy and Information Awareness training certificates, rules of behavior, and HIPPA certificate of completion, in accordance with PWS Section 6.0 and Addendum A and B.

Deliverables:

A. Contractor Staff Roster.

B. TMS Certificates for IBM Rational Tools Courses.

C. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate.

D. Signed Contractor Rules of Behavior.

E. VA HIPAA Certificate of Completion.

F. CPMP.

G. MPR.

TECHNICAL KICK-OFF MEETING

The contractor shall hold a technical kick-off meeting within ten (10) days after award, via telephone or in person. The contractor shall present the details of its intended approach, work plan, and project schedule. The contractor shall specify the date and provide all attendees with an electronic copy of the agenda at least five (5) calendar days before the meeting. The contractor shall invite the CO, Contract Specialist, COR, the VA PM, and the VA Business Owner. The contractor shall provide meeting minutes to all attendees within three (3) calendar days after the meeting.

Deliverable:

Kick-off meeting, agenda, and meeting minutes.

SOFTWARE REQUIREMENTS

The contractor shall provide a SIC solution with high availability (as described in section 5.3 of this PWS) in a clustered enterprise database capable of 150 concurrent users producing approximately 13,000 consent forms a day. The SIC shall support documentation of signature informed consent for all treatments and procedures conducted by VHA facilities that require signature informed consent. The SIC shall be in accordance with VHA Handbook 1004.01, “Informed Consent for Clinical Treatments and Procedures.” The SIC solution shall electronically capture patient, patient surrogate, practitioner, and witness handwritten signatures as images on documents, with date and time stamps for the handwritten signatures. The SIC solution and content libraries shall allow VA professionals to accurately and consistently (i.e. each episode of care) document signature informed consent for all treatments/procedures requiring signature informed consent, as well as complete multiple VA Forms.

The contractor shall provide an Enterprise-wide license for an unlimited number of users. The SIC solution shall provide a real-time interface with VA’s VistA Imaging solution. The interface to VistA Imaging shall interact with the VistA Text Integration Utility and VistA Imaging Background Processor, using either VistA Remote Procedure Calls (RPC) and/or the VA’s HealthShare Messaging Platform Enterprise (HMPE) for all VistA data reads/writes. HMPE is the preferred approach as VA intends to deprecate/replace the VA’s legacy RPC Broker solution in the near future and migrate all VA VistA EHR data read/write to HMPE which offers better security and message orchestration/transformation (e.g. transform RPC’s to HL7 v2.x) reducing lifecycle interface sustainment costs and eliminating point to point interface connections.

In addition, the SIC solution shall include a real-time interface with the VA Computerized Patient Record System (CPRS)/VistA. The VistA interface for transfer of consent form data must be functional at the time of deployment.

The contractor shall provide a SIC solution developed and maintained to remain in compliance with VHA informed consent policy (Handbook 1004.01 Handbook 1004.05, and VHA Directive 1005) and VHA advance care planning policy (Handbook 1004.02). The contractor shall detail policy compliance by the following:

1. The contractor shall provide a SIC solution that manages patient context/patient selection according to Clinical Context Object Workgroup (CCOW) context management and single sign-on (SSO): Patient selection shall be made by selecting the patient in the associated CPRS and launching the application as an option from within VA’s EHR.

2. The contractor shall provide a SIC solution that allows VA SIC Administrators to build unique and standardized content for general and specific treatment.

3. The contractor shall provide an automated SIC solution that ensures consent forms include a process that allow logic for documenting a patient's decision on whether a "Do Not Resuscitate" order will remain in place during high-risk procedures or when an anesthesia provider will be present during the procedure.

4. The contractor shall provide a SIC solution with consent forms that are logic based and include a description of the specific treatment/procedure, its risks, benefits, alternatives, and a patient and practitioner attestation statement. The treatment/procedure specific information shall populate onto a standardized electronic presentation of a VA form and include demographic data needed to complete the form (e.g., VA Form 10-0431a, “Consent for Clinical Treatment/Procedure”, VA Form 10-0431b, “Consent for Transfusion of Blood Products”; VA Form 10-0431c, “Consent for Long-Term Opioid Therapy for Pain”).

5. The contractor shall provide a SIC solution with processes that document patient decision-making capacity as part of consent form completion.

Users are required to select whether the patient has Decision-Making Capacity (DMC). Depending on the answer, the SIC solution shall offer options. If the patient has DMC, the consent documentation process begins. If the patient lacks DMC, the user is queried on the reason for this determination (e.g., clinical evaluation used to make determination, patient is a minor, or patient has been ruled incompetent by a court). The SIC solution shall provide an option for surrogate designation/documentation that applies to all consent forms for treatments and procedures, and applies to non-consent forms on a case-by-case basis. If the patient lacks DMC, the SIC solution shall allow documentation of the patient's surrogate by name and relationship. Should the surrogate be physically available, signature fields and attestation statements shall allow for documenting that the signature was obtained from the surrogate. Should the surrogate not be physically available, the SIC solution shall allow for documenting the informed consent process being conducted telephonically between the provider and the surrogate. Documentation that the surrogate’s consent was obtained telephonically shall require signature of the provider obtaining informed consent. The SIC solution shall require the provider to annotate whether the required witness is co-located with the provider and can sign the form, as well as document witnessing the conversation in a progress note within the EHR. The witness shall be able to sign the document if co-located with the provider.

6. The contractor shall provide knowledge transfer throughout the duration of development, testing, acceptance, installation, and implementation sufficient to allow VA to provide training on the new SIC system.

7. The SIC solution shall be fully deployable with an approved Authority To Operate (ATO), all Test and Evaluation (T&E) complete [zero (0) unresolved Severity 1’s, 2’s, nor clusters of Severity 3’s] and user acceptance obtained and delivered to the VA production environment for use by users by August 2019.

SIC CLINICAL DATABASE CONTENT

The contractor shall provide a SIC solution that includes a library of consent forms for all treatments/procedures conducted by VHA for inpatient and outpatient care. The current list of specialties includes: Anesthesia, Pain Management, Bariatric Medicine, Cardiac Surgery, Cardiology, Dentistry, Dermatology, Emergency Medicine, Gastroenterology, General Surgery, Hematology/Oncology, Interventional Radiology, Mental Health, Nephrology, Neurology, Neurosurgery, Nuclear Medicine, Obstetrics/Gynecology, Ophthalmology, Orthopedic Surgery, Otolaryngology, Physical Medicine/ Rehabilitation, Plastic/Reconstructive Surgery, Podiatry, Pulmonary Medicine, Radiation Oncology, Radiology (Diagnostic), Rheumatology, Thoracic Surgery, Urology, and Vascular Surgery for at least 2,400 different procedures. See Exhibit A for the full list of procedures. The contractor shall provide a SIC solution with a document library that will provide consent forms in English and Spanish, written to a 6th - 8th grade reading level. The content shall include a description of the specific treatment/procedure, its risks, benefits, alternatives, and a patient and practitioner attestation statement. The content library descriptions shall comply with the standards outlined in VHA Handbook 1004 and subsequent integer versions. See Exhibits B, C, D, and E for sample forms. The contractor shall content deliver based on the schedule outlined in the CPMP. The VA will review and approve all content prior to accepting the content for production use. The contractor shall update the content based on VA comments within 10 days after receipt.

SIGNATURE CAPTURE

The contractor shall provide a SIC solution that incorporates processes to capture full and partial electronically captured, handwritten signatures (asynchronous consent/signatures), as allowed for by VA policy as stated in VHA Handbook 1004.01. The SIC solution shall fully support signature-capture on VA approved mobile and end user devices currently in use by VA. The application shall have the ability to present and print consent forms for signature and save those documents to a patient’s record within VistA Imaging as an Adobe Postscript Data Format (PDF) image, linked to a progress note in VistA CPRS. Individual VHA medical facilities are not restricted in the purchase of signature devices. Some examples of signature devices currently in use include:

· Interlink ePad

· Topaz Clipboard Signature Pad

· Topaz SignatureGem 1x5

· Topaz SignatureGem 4x5

· Topaz SignatureGem LCD 1x5

· Topaz SignatureGem LCD 4x3

· Topaz SigLite

DOCUMENT PROCESSING

The contractor shall provide a SIC solution that has the ability to process documents and populate them into the patient's individual EHR as a PDF image format with an associated progress note, though individual documents may be designated by administrators for image storage only with no progress note associated.

Population of these signature images into the EHR imaging and artifact repository (e.g. VistA Imaging) shall include associated link to provider notes and SIC form data to allow for user query functionality within the associated EHR system. Partially signed and deleted documents will be stored in VistA Imaging without a progress note. Partially signed, deleted documents shall be stored in VistA Imaging and the word “Deleted” shall be appended to the front of the document’s name (e.g., Deleted-Release of Information; Deleted-Consent for Long-Term Opioid Therapy for Pain.) In addition, partially signed, deleted documents shall be watermarked in Red with the text “Deleted form: Incomplete Signatures” diagonally placed across each page, e.g., image indexing within VA’s VistA Imaging, designating saving of the image without an associated progress note, watermarks on partially signed and deleted forms.

The SIC solution shall have the ability to automatically populate a locally customizable, associated progress note into the EHR. The ability to require a progress note for a document can be changed at the local level for local forms and at the local or national level for national forms. The automatically populated progress note shall not require signature by the user and shall be an administrative note pointing to the existence of the associated image in the imaging system.

Documents shall have an editable interface to allow for defining the electronic processes associated with each document, including: which progress note title the progress note will be given; an option for building business rules that establish logic for activating or inactivating wizard panels in the document's wizard; which wizard shall be associated with the document; setting/editing keywords for document searching; identifying which "category/specialty" shall be available in within the document library; providing reminder screen text; selecting whether the document shall have an associated progress note; and whether the image generated can be stored.

USER EXPERIENCE

The contractor shall provide a SIC solution with the ability to include the following ease of use features.

The SIC solution shall be fully Section 508 compliant in accordance with PWS 5.2.8 and Addenda A and B. Documents within the SIC solution shall provide users with a selectable, dual English/Spanish language documentation and presentation capability. “Help” support shall be provided within the software as a context sensitive functionality. Help shall include an administrator's guide that provides examples of all administrative functions by topic.

The contractor shall provide a SIC solution with the ability for administrators to build "packages" of documents to ease access (e.g., build a package of documents associated with "Cardiac Catheterization", including consent forms, education documents, and discharge instructions).

The contractor shall provide a SIC solution with the ability for users to create and maintain a “Favorites” list. Users shall have the ability to have any documents they use be automatically added to their "Favorites" and an option to manually add documents.

The contractor shall provide a SIC solution that has the ability to generate documents for completing informed consent and non-consent forms via a Browser User Interface (BUI), compatible with VA standardized web browsers. The SIC solution shall provide users the option to view and select available documents within the library based upon a specialty hierarchy (with options for consent documents, education documents, images, patient instructions, discharge instructions, and locally customizable specialties and categories). When generating a consent or administrative form, users shall be presented with options that allow for patient verification; automatic selection (or fill-in) of the provider completing the form; selection of providers who are expected to participate in the procedure, surrogate selection options and "reminder screens.” When generating a consent form, users shall be presented with an option that allows for documentation and editing of patient's decision-making capacity, reason for treatment/procedure, description of the treatment/procedure, anatomical location, anesthesia/moderate sedation, consent to use of blood products (including patient's reasons for declining if appropriate), benefits, risks, alternatives, facility-specific field for treatments/procedures, and comments. The SIC solution shall provide users the option to select one to many procedures to generate a single consent form.

The contractor shall provide a SIC solution with the capability within each consent document for users to bypass text that usually does not change (e.g., description of procedure, risks, and benefits) and an option to present all consent information to the user. The final document shall be editable by returning to the document development flow and editing sections of the form prior to signature. The SIC solution shall have the ability to temporarily “hold” a patient-specific document for a specified period with either no signatures or partial signatures. Users shall be able to retrieve and complete documents held temporarily for signature.

CLINICAL RESOURCES

The contractor shall provide a SIC solution that incorporates a library of patient educational documents to support instruction/training for the majority of the treatments/procedures provided within VA. The educational document library shall have the ability to add locally developed educational documents and associate them with consent forms, as well as be able to document a patient’s comprehension of the education document in accordance with Joint Commission requirements. These forms shall have the ability to be saved to the patient-specific record with or without an associated progress note, as determined nationally or locally. The SIC solution shall have the ability to identify, view, and save education documents related/associated with specific procedure or treatment consent forms, e.g., when selecting a consent form for a procedure, the user shall be provided with a list of educational documents associated with that procedure.

PROGRAM ADMINISTRATION TOOLS

The contractor shall provide a SIC solution with the ability to: create and maintain a “Favorites” list of documents for individual users; save documents into alternative, compiled formats, that include the verbiage from the document‘s standardized text (e.g., MS Word, Excel, .pdf); lock documents for editing at the local level or partially lock them, as determined by policy, e.g., national consent forms currently do not allow for local editing of the description of the treatment/procedure, risks, benefits, alternatives, but do allow for editing a field for "facility-specific treatment preferences" and "Additional Comments"; and copy and rename documents. The SIC solution shall allow for the local administrators to build local consent and administrative documents with all associated fields available in contractor-provided forms (local administrators as well as higher-level administrators). Locally developed forms shall only be available at local sites, while nationally developed forms shall be built and maintained by the contractor. The SIC solution shall allow for the import/export of locally developed forms for sharing with other sites through “read-only” permissions only after that original local form has been approved for use and proliferation at the national level by the NCEHC. The SIC solution shall provide users and administrators with the capability to submit on-line content requests to the contractor. The contractor shall address content request submissions in accordance with PWS Section 5.3.1. VA SIC solution administrators shall be able to maintain the SIC solution application as defined in VHA Handbook 1004.05. Administrative users shall have the ability to create, edit, and remove documents at the local level within the SIC solution library.

The SIC solution shall provide an approach to standardize and provide multitenancy to the content and forms database using a Parent-Child hierarchy type Enterprise database schema. Sites shall be able to share documents and allow for cross-site reporting with multifacility settings for all peer review processes.

The SIC solution shall provide Administrators the ability to identify which progress note title shall be associated with each document saved into the EHR, using current processes for populating notes into the patient record (e.g., VA uses the VistA Text Integration Utility with specific Internal File Number (IFN) numbers to designate progress note titles). The SIC solution shall provide Administrators the ability to prepopulate document header data with locally customizable headers and the ability to remove or add documents from/to the view of users (nationally and/or locally as appropriate, based upon defined administrative roles).

The SIC solution shall provide the capability to generate a coordinated, quarterly (based on the Federal fiscal year) data collection report for use by the VHA Program Manager at the VA NCEHC Program Office. Quarterly SIC solution usage reports shall provide the following detail: consent forms saved by facility and specialty; locally created document activity by facility and document title; consent forms saved by facility; activity total and percent change from previous quarter (include past quarters for trending purposes); and non-consent forms printed (include past quarters for trending purposes). The SIC solution shall provide Administrators the ability to generate local reports with and without Personally Identifiable Information (PII) and Protected Health Information (PHI), down to the document level, including: document usage; library content; use of specific features (e.g., surrogate consent by telephone); documents on hold for signature; note number (associated with documents being processed into the EHR) and content update data; and the ability to run specific reports based upon a user's and/or administrator's defined role and level of responsibility.

The contractor shall provide identity and access management controls compatible with all VA standard identity, access, authentication and authorization services currently in use by VA’s Identity and Access Management (IAM) Enterprise solutions. The SIC solution shall be PIV compliant for all users and administrators upon deployment into production.

INTERFACE TOOLS

The contractor’s SIC solution shall integrate and interface with VA’s CPRS, VistA TIU, VistA Imaging, Vergence CCOW context management, IAM SSO and all other industry standard associated interfaces. The contractor’s SIC solution shall use VistA Remote Procedure Calls (RPC) and/or the VA’s HealthShare Messaging Platform Enterprise (HMPE) for all VistA data reads/writes. HMPE is the preferred approach as VA intends to deprecate/replace the VA’s legacy RPC Broker solution and migrate all VA VistA EHR data read/write to HMPE which offers better security and message orchestration/transformation (e.g. transform RPC’s to HL7 v2.x) reducing lifecycle interface sustainment costs and eliminating point to point interface connections.

SECTION 508 COMPLIANCE CERTIFICATION

The contractor shall ensure the SIC solution is VA Section 508 compliant. The contractor shall coordinate and complete VA 508 compliance certification in accordance with Addendum B.

Deliverables:

A. PIV compliant SIC software solution (Including license).

B. SIC Clinical Database Content for VA Review and Approval.

C. Quarterly Update Usage Reports.

D. Quarterly Consent Form Updates.

E. Final Section 508 Compliance Test Results.

F. 508 Compliance Certification.

SOFTWARE MAINTENANCE AND SUPPORT

The contractor shall provide SIC software with high availability, with operational availability at 99.9 percent. The contractor shall provide 24 hours per day, seven days per week, 365 days per year (24x7x365) software maintenance and technical support for the SIC solution.

The contractor shall provide software maintenance and technical support services, including quarterly updates, enhancements, and corrections to the SIC solution, all of which are customarily provided by the contractor to its customers, so as to cause the SIC solution to perform according to its specifications, documentation, and demonstrated claims.

The contractor shall provide quarterly application updates and releases that include corrections to reported defects, application updates, and associated services. The contractor shall:

1. Maintain a quality assurance effort, including Alpha testing on VA-specific system configurations and Beta testing at selected VA locations prior to general release.

2. Provide technical and end-user documentation for each program release.

The contractor shall provide toll-free telephone customer service and technical support for the SIC solution each business day between the hours of 8:00 am and 6:00 pm Eastern Time. After hours support shall be provided by contractor personnel and shall be addressed within two hours of initial contact. In addition, the contractor shall provide web-based technical support 24x7x365.

Software Corrections: The contractor shall correct all software errors reported to the contractor by VA. Software error corrections shall be made available via download or delivered via some other media. If the contractor is unable to correct a software error remotely, the contractor shall perform on-site support in an attempt to correct the software error. The contractor shall provide a history of error correction services and/or operations rendered to VA. The VA will classify the severity level of documented errors as follows:

SEVERITY 1: System inoperable. The contractor shall respond and provide a mitigation strategy that includes a timeframe for addressing the issue to any error that has a severity level of one within two hours. The contractor shall resolve such errors within twenty-four (24) hours after VA provides the contractor with written notice thereof.

SEVERITY 2: Data files inaccurate or inaccessible, or an error that substantially interferes with VA’s use of the SIC solution. The contractor shall respond and provide a mitigation strategy that includes a timeframe for addressing the issue to any error that has a severity level of two within four hours. The contractor shall resolve such errors within twenty-four (24) hours after VA provides the contractor with written notice thereof.

SEVERITY 3: Output inaccurate or inaccessible. The contractor shall resolve any error that has a severity level of three within ten (10) days after VA provides the contractor with written notice thereof.

SEVERITY 4: Informational or minimal impact. The contractor shall resolve any error that has a severity level of four within thirty (30) days after VA provides the contractor with written notice thereof.

The contractor shall use a service desk incident ticket management system to track all VA incident tickets and deliver incident ticket support call logs, listing facilities requesting support, issue summary, issue status, and issue resolution summaries.

Deliverable:

Quarterly Support Call Logs.

CONTENT LIBRARY MAINTENANCE

The contractor shall sustain and maintain an operational and current content library. The contractor shall provide a method for VHA personnel to propose changes and additions to the content library. The contractor shall forward VHA proposed draft changes and draft additions to the content library to a designated VHA email address for processing by the VHA Content Management Group (CMG). The VHA CMG shall approve, disapprove, or edit the draft change and send them back to the contractor via email. The contractor shall update the content library on a quarterly basis using approved content from the VHA CMG.

The contractor shall add and update VHA CMG approved, VA-specific administrative forms to the standard library at no additional cost to the Government, unless the proposed forms require one or more of the following:

1. Document level security (per document in the Access Control List (ACL))

2. Changes to the EHR data interface

3. Programmable coding changes

The contractor shall maintain the content library to comprehensively cover all the treatments and procedures performed in VA. The contractor shall ensure that all newly-developed content is submitted in accordance with the process described below. Changes to content that is already in use in VA shall be forwarded to the VHA CMG for review and approval before release to the content library.

The VHA CMG will review, coordinate, and forward approved development/change requests to the contractor. Unless otherwise agreed to by VHA CMG in advance, the contractor shall deliver the draft electronic informed consent software with new or updated content to VHA CMG for review and approval no later than 90 days from the date the VHA CMG forwards the request. The contractor shall receive VHA CMG approval for all new or updated content prior to release.

The contractor shall reply to the VHA CMG Approved Change Request email with the following information:

1. Specific origin of the request and date of request;

2. VA Subject Matter Expert identified in original request;

3. The contractor shall add the following text: “Changes made as submitted below.” if the contractor is not able to make the changes as requested by the VHA CMG, the contractor shall respond to the VHA CMG with the variance from the requested change and request VHA CMG approval to move forward with the revised change.

If the contractor determines that revisions to existing content library documents are warranted based upon an update of current evidence-based information related to any identified procedure, the contractor shall seek the approval of VHA CMG prior to making the suggested change. This query shall be accompanied by the evidence-based literature that supports the suggested change and the suggested change language (not the full revised consent). The contractor shall not automatically submit updates to existing content library documents. VHA CMG will respond to the request via email communication.

The contractor shall provide a quarterly content change log that documents all change requests, including the date the request was received, who input the request, status, actions and coordination completed to date, and completion date.

Deliverables:

A. Method for library content changes and additions.

B. Quarterly Change Logs.

C. New Clinical Content.

SIC SOLUTION VIP PROCESS

The contractor shall follow the VIP process per reference material outlined in this PWS (Paragraph 2. Applicable Documents) and in Addendum A below to coordinate SIC solution development, testing, acceptance, installation, and implementation for all sites currently using the legacy electronic informed consent software solution.

Deliverables:

A. Business User Stories.

B. Compliance Epic.

C. Compliance Sub-Epic.

D. Compliance User Stories.

E. User Guides.

F. Version Description Document.

G.