36C10A19R0063-A00002000.docx

Solicitation 36C10A19R0063 Amendment A00002

The Offeror shall acknowledge receipt of this amendment on the submitted offer.

The purpose of this amendment is to post the questions and answers.

See Continuation Pages.

Kari L. Cozzens

X X X

11-26-2018 36C10A19R0063

To all Offerors/Bidders Austin TX 78744 1701 Directors Blvd, Suite 600 Technology Acquisition Center - Austin Office of Acquisition Operations Department of Veterans Affairs Austin TX 78744 1701 Directors Blvd, Suite 600 Technology Acquisition Center - Austin Office of Acquisition Operations Department of Veterans Affairs 12-04-2018 A00002 (Signature of Contracting Officer) (Signature of person authorized to sign)

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

ONE

CHECK

(X)

(SEE ITEM 13)

(SEE ITEM 11)

(If required) (such as changes in paying office, appropriation date, etc.)

(Specify type of modification and authority) (If other than Item 6) (Number, street, county, State and ZIP Code) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Type or print) (Type or print) Prescribed by GSA - FAR (48 CFR) 53.243

PREVIOUS EDITION NOT USABLE

STANDARD FORM 30

15B. CONTRACTOR/OFFEROR

16A. NAME AND TITLE OF CONTRACTING OFFICER

15A. NAME AND TITLE OF SIGNER

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

16B. UNITED STATES OF AMERICA

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16C. DATE SIGNED

Contractor

D. OTHER

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

the opening hour and date specified.

or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES

15C. DATE SIGNED

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

is not, is required to sign this document and return ___________ copies to the issuing office.

(REV. 11/2016)

12. ACCOUNTING AND APPROPRIATION DATA

is not extended.

ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the is extended, E. IMPORTANT:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

CODE

FACILITY CODE

1. CONTRACT ID CODE

BPA NO.

10B. DATED

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

PAGE OF PAGES

9B. DATED

9A. AMENDMENT OF SOLICITATION NUMBER

3. EFFECTIVE DATE

4. REQUISITION/PURCHASE REQ. NUMBER

8. NAME AND ADDRESS OF CONTRACTOR

6. ISSUED BY

CODE

2. AMENDMENT/MODIFICATION NUMBER

7. ADMINISTERED BY

CODE

5. PROJECT NUMBER (if applicable)

Cloud-based Signature Informed Consent for Clinical Treatments and Procedures Enterprise Solution

Questions and Government Responses

1. Question: What is the process and what is required for the 508 Compliant Certification?

Answer:

Reference PWS, Addendum A.3 and Section 5.2.8.

2. Question: What is the process and what is required for the FIPS 201 Evaluation Program?

Reference PWS Section 2 #6 and Section 6.1.2.

3. Question: Is the VA interested in solutions that offer patient educational components (such as video) in addition to educational documents?

The VA will review all proposals in accordance with Section E and the Governments requirements as outlined in the PWS.

4. Question: Is the VA interested in solutions that identify knowledge gaps in patient comprehension of provided educational documents?

The VA will review all proposals in accordance with Section E and the Governments requirements as outlined in the PWS.

5. Question: What is the process for obtaining an authority to operate for an application in the FedRAMP certified Azure VA partition? Who will handle this? Is there documentation available for this?

Reference PWS Section 2: #21 through #28, #76 through #78.

6. Question: What penetration testing / static code analysis is required to run in the government azure environment??

Penetration testing will be conducted by the Government. Static code analysis will need to be conducted by the contractor in coordination with the government as part of the VIP Test and Evaluation requirements. Reference PWS Section 2 #21 through #28, #66, #67, and PWS Section 5.4.

7. Question: What is the process and what is required for the Privacy Impact Assessment (PIA)?

Reference PWS Section 2 #26, #31, #32, #37, Addendum B.4, and Addendum B.5.

8. Question: Please confirm: We (the contractor) will not be storing any patient DB for reference, just for temporary storage. We will rely on the RPC Broker and/or HMPE for all patient and provider data.

PHI will not permanently persist in the SIC solution. Reference PWS Section 2 #31 and #32.

9. Question: Will you allow file share writes over WAN?

Yes. Reference PWS Section 2 #55.

10. Question: Can we have access to HealthShare technical documentation in relation to the VA's implementation of same as part of the RFP. No information appears publicly available for this interface mechanism?

Yes. Non-public information available is sensitive and after contract award will provided by the VA to the contractor when the Government determines the information is required.

11. Question: How are we verifying the patient/patient's surrogate or is that done by the user?

The patient’s data is available in VistA, patient surrogate data is not available in VistA. The software solution may pull in patient data and offer it for verification to the user. This information is needed to complete the VA form 10-0431a as outlined in the PWS Section 2, #72 and #73.

12. Question: Can we get the latest VA Enterprise Cloud (VAEC) Technical Reference Guide?

Reference PWS Section 2 #75.

13. Question: Are we required to quote the Government Azure hosting costs or simply provide guidance on the required infrastructure? If we are required to quote hosting, what other services need to be provided (backups, monitoring, support, log monitoring, etc.)?

No. The government will provide cloud services. Reference PWS Section 2 #77.

14. Question: Does the RFP submission need to include pricing estimates for the hosting of the solution?

No. The government will provide cloud services. Reference PWS Section 2 #77.

15. Question: Is the information below still valid from the earlier RFI: "The contractor solution shall use the VAEC for all cloud hosting as government furnished equipment. The VAEC includes a secure dedicated Wide Area Network connection between VA and the VAEC Cloud Service Provider (CSP). The Contractor shall not be responsible for buying cloud credits for this contract. VA will furnish all VAEC capacity through CSP credits. VA will provide sufficient credits required for all VAEC cloud development, testing, and production environment. Specifications for the VAEC, including access requirements, will be provided at the project kick off meeting and in Attachment A - VA Enterprise Cloud (VAEC) Technical Reference to this document.

The VAEC is currently supported by two Federal Risk and Authorization Management Program (FedRAMP) High Certified CSPs with VA Authority to Operate (ATOs). Both VAEC environments provide access to each CSP's FedRAMP Authorized Services in their respective cloud to implement the proposed solution. In addition, each VAEC CSP provides a set of common shared services such as security scanning; Active Directory, and single-sign on (SSO) that includes PIV integration; and performance monitoring to facilitate solution implementation. Specifications for the VAEC, including access requirements, will be provided at the project kick off meeting and in Attachment A - VA Enterprise Cloud (VAEC) Technical Reference Guide.

The RFI is not an authoritative source for the requirements of this acquisition; the solicitation has an attached PWS that is the authorities source.

16. Question: Does this RFP include the vendor being financially responsible for cloud services?

No. The government will provide cloud services. Reference paragraph 2 #77 of the PWS.

17. Question: Will the vendor awarded the RFP be financially responsible for cloud services?

No. The government will provide cloud services. Reference paragraph 2 #77 of the PWS.

18. Question: If the answer is "Yes" above [will the awardee be financially responsible for cloud services], then what will the process be to convey specifications for the hosting Binder’s pricing strategy?

Not applicable.

19. Question: Will you [the Government] be using your own [Government] hardware/users hardware or do you expect contractor to source that as well?

Answer a:

The VA will provide user hardware to the VA users accessing the software solution per PWS Section 5.2.2. The contractor will be provided Government-furnished Equipment per PWS Section 6.6.

20. Question: Do you have any additional context on the VA’s enterprise architecture?

Reference PWS Sections 2, 6.1.1, and Addendum A.

21. Question: Whether we need to come over there for meetings?

Reference PWS Sections 4.2 and 4.3.

22. Question: Was is the VA HIPAA Certification Completion Process and what needs to be provided?

Upon contract award the contractor shall work with the VA COR for access to the TMS. The contractor shall complete the VA HIPAA training available in the VA Talent Management System (TMS). The contractor shall provide a certificate of completion to the VA Contracting Officer's Representative. Reference PWS Section 5.1.

23. Question: Confirming this is optional: launching the application as an option from within VA’s EHR?

Negative. The SIC solution shall open from within the VA's CPRS GUI and shall use context management and single sign-on. Reference PWS Section 5.2.

24. Question: What is the timeline for implementation of HealthShare as a replacement for the RPC broker and RPC calls?

VA intends to deprecate/replace the VA’s legacy RPC Broker solution in the near future. Reference PWS Section 5.2.

25. Question: In section 5.2.1 references a library of consent forms. How many are there total?

There are only three VA forms (VA Forms 10-041a, 10-0431b, and 10-0431c). There are 2,459 procedures that require clinical content (description of the treatment/procedure, risks, benefits, alternatives) that will be imported into the appropriate VA Form.

26. Question: Section 5.2.1 references providing English and Spanish. Will both be provided?

The contractor shall provide both English and Spanish content per PWS Section 5.2.1.

27. Question: What are the VA's Expectations regarding the informed consent documents; will VA supply completed documents? will VA supply information and the contractor create the document using VA information

The contractor shall provide a SIC solution that includes a library of consent forms for all treatments/procedures conducted by VHA for inpatient and outpatient care. Reference PWS Section 5.2.1.

28. Question: Do we really need a bilingual help system and user facing screens or is the requirement just for bilingual patient facing content?

Dual English/Spanish language content is required for patient facing documentation and presentation capabilities. Dual English/Spanish language content is not required for user facing presentations e.g., help screens. Reference PWS Sections 5.2.1 and 5.2.4.

29. Question: In section 5.2.1 references a library of consent forms. Will you share all the labeled forms before we begin development?

Exhibit A provides a list of procedures for SIC. The contractor shall be responsible for the development of the content in support of the procedures listed in PWS Exhibit A.

30. Question: Will the VA review proposal that offer signature capture devices (such as Apple iPads) not listed in Section 5.2.2.

The SIC solution shall fully support signature-capture on VA approved mobile and end user devices currently in use by VA. Reference PWS Section 5.2.2.

31. Question: Is a Wizard interface required for the application?

No. In the PWS, Wizard is in reference to the display of options presented to users. Reference PWS Section 5.2.3.

32. Question: Is the patient comprehension of the education document the existing "talk back" comprehension check or other functionality? It is our understanding this has been disabled for years.

The government will evaluate the contractors approach to meet the requirements as listed in the PWS. Reference PWS Section 5.2.5.

33. Question: Are you asking for a smartphone/tablet based solution? or ONLY web application?

Reference PWS Section 5.2.7.

34. Question: What device will the web app be displayed on?

The approved software solution will be displayed on any VA approved device running an internet browser and capable of running CPRS. Reference PWS, Section 5.2.7.

35. Question: Will contractor handle the integration or will someone on the VA side do this?

The contractor will integrate their proposed solution with the VA's application and infrastructure. Reference PWS Section 5.2.7.

36. Question: We also believe the HMPE and RPC Broker can be used simultaneously. Is that (all) correct?

Yes. HMPE will provide a replacement for RPC Broker. HMPE and RPC can be used simultaneously. Reference PWS Section 5.2.7.

37. Question: Are there any restrictions in terms of staff roster?

Reference PWS Sections 5.1 and 6.2.2.

38. Question: Is the VA Enterprise Cloud (VAEC) an isolated service or is it hosted on a third party service such as Amazon Web Services or Microsoft Azure?

The VAEC is a contracted Commercial service with Amazon and Microsoft, hosted in their (Amazon and Microsoft) commercial environments (contractor owned, contractor operated (COCO)).

39. Question: Is the VA Enterprise Cloud (VAEC) limited to an isolated service or limited to a specific third-party service such as Amazon Web Services or Microsoft Azure?

The VAEC offers a robust, mature catalog of Information Technology Infrastructure Library (ITIL) common services found on any commercial cloud offering.

40. Question: Do you expect to be invoiced for a fixed project fee followed by monthly subscription for recurring use and maintenance? What is your preference?

Reference Solicitation Section B.1.

41. Question: Will there be additional consideration if a Contractor bids on the entire project v. not bidding on the optional fields

The government will evaluate proposals in accordance with Section E of the Solicitation.

42. Question: Assumption: HMPE provides all the function calls and results available in the RPC Broker, and if the calls are not available we will fall back on the RPC Broker.

HealthShare Messaging Platform Enterprise (HMPE) will provide a replacement for Remote Procedure Call (RPC) Broker.

43. Question: The proposed implementation will be run using the VIP Process/IBM Rational Tools; however, the proposed application development will be run using the contractor’s processes and tools and delivered to the Government implementation team on 3-month increments. Is this acceptable?

The proposed approach will be evaluated in accordance with Section E of the Solicitation and the VA VIP Guide. Reference PWS Section 6.1.6.

44. Question: Can we submit the proposals via email?

Reference the solicitation, Section E.2.

45. Question: Do "packages" of documents need to be completed in one combined document/printed at one time? Or can they be available in the list for selected print?

The contractor shall provide single and combined documents. Combined documents may be restricted to combining the same kind of document, e.g., combine consent with consent. Reference PWS Section 5.2.4.

46. Question: Whether companies from Outside USA can apply for this?

Yes. Contractor resources that require access to VA systems and information will require a background investigation, and must be US citizens or possess a SSN and Federal Bureau of Investigation fingerprint report. In addition, remote access to VA’s network, required in the performance of the resulting contract, from Non-NATO foreign countries is prohibited.

47. Question: Can we perform the tasks (related to RFP) outside USA?

No, Reference PWS Section 2 #21 through #28.

48. Question: Is the primary user a healthcare professional at the VA?

Yes.

49. Question: We see there are ~13k forms submitted daily with 150 concurrent users. How many enterprise users TOTAL do you expect?

15,000 active, non-concurrent users.

50. Question: Will you provide any documentation on VistA and HealthShare Messaging Platform Enterprise ?

Yes. Non-public information available is sensitive and after contract award will provided by the VA to the contractor when the Government determines the information is required.

51. Question: Is the only interaction with VistA feeding the SICs through to be stored there?

No. VistA is the only available source for patient identifying information and is the conduit to populate the image of the SIC document into VistA imaging. VistA is the software program used to populate associated progress notes.

52. Question: Will you provide documentation on the CPRS?

Yes. Non-public information available is sensitive and after contract award will provided by the VA to the contractor when the Government determines the information is required.

53. Question: If you can answer, do you have a budget you are targeting?

The Government cost estimate is not publicly available information.

54. Question: Can we get all the latest VA documentation on HealthShare?

Yes. Non-public information available is sensitive and after contract award will provided by the VA to the contractor when the Government determines the information is required.

55. Question: Do you have other web apps that are using Imprivata for CCOW and what implementation are they using (i.e., if not using Imprivata JavaScript calls, we will require the RPC Broker and a local install)?

This is not within the scope of this requirement.

56. Question: Can you provide documentation on the interfaces required to the following systems …

- VA’s Cerner PowerChart/Millennium EHR (HMPE)

- VA’s Cerner Image and Artifact Repository

- VA’s Cerner CCOW Context Management solution

- VA’s Cerner IAM/SSO solution

- Cerner Millennium Computer Provider Order Entry (CPOE)

Yes. Non-public information available is sensitive and after contract award will provided by the VA to the contractor when the Government determines the information is required.

57. Question: Can the system provide the clinical data content in UTF8 format instead of ASCII format? If not, can an explanation of any other uses outside of the SIC system of the ASCII formatted content data would be.

Yes.

58. Question: What is the timeline for implementation of Cerner in the VA?

Cerner is scheduled to replace legacy VistA EHR at 3 locations in March of 2020. SIC Integration timeline with Cerner is to be determined.

59. Question: Will the VA be using Cerner's imaging repository, continue using VistA Imaging, or move to a different repository (HAMES, etc.)?

VA will use VistA Imaging (VIX/CVIX) and Cerner's vendor neutral archive (VNA).

60. Question: Is the respondent responsible for deployment, auditing and monitoring of the SIC application in the Azure cloud or does OI&T maintain this responsibility?

The contractor will use the VAEC common services for auditing and monitoring. Deployment will be a shared responsibility between the SIC vendor and the VAEC.

61. Question: In the VAEC Technical Guide it is apparent that today there are ZERO production implementations i the Azure (or AWS) cloud. What is the timeframe expected for the first production deployment of software to the production container?

Incorrect; there are several production implementations in the VA's contracted cloud environments.

62. Question: Is there a SLA for response times for RPC calls, fileshare writes and/or HealthShare calls across the VA WAN? If so, what are these and can we rely on these?

Service Level Agreements (SLAs) are an internal VA process and will be determined at time of integration.

63. Question: Could you clarify the due date for the response, on the original posting is was December 14th but with the update it seems to have changed to December 7th. I just want to confirm that this wasn't a typographical error.

The solicitation document has the definitive date in block 8 (December 14, 2018, 1:00 PM Central Daylight Time).

64. Question: Are the number of beds associated with the RFP available?

Currently VHA has 56,535 beds.

65. Question: We request a 2-week extension to the due date to allow for sufficient time to respond to this Solicitation.

The Government is not able to extend the due date for proposals.

66. Question: We are interested in responding to the Cloud-based Signature Informed Consent for Clinical Treatments and Procedures Enterprise Solution solicitation. We migrate Government applications to the commercial cloud; however, we are not familiar with the signature informed consent portion of this effort. Do you have a list of interested vendors that we can contact to discuss partnering? If not, would it be considered responsive if we only address the cloud aspect of the solution? Thank you for your assistance.

Interested party’s information will not be released. The VA will review proposals in accordance with the Governments requirements as outlined in the PWS.

67. Question: We would like to know who is the incumbent providing this services today.

Taylor Communications, Inc.

600 Albany Street Dayton, OH 45417

68. Question: Please provide the incumbent solicitation and contract numbers.

Solicitation #VA118A-17-R-0135 Contract #VA118A-17-C-0010.

69. Question: Please provide the reason for stopping to work with the incumbent.

10 U.S.C. 2304 and 41 U.S.C. 3301 require that Contracting Officers promote and provide full and open competition in soliciting offers and awarding Government contracts.

70. Question: We are interested in submitting a proposal in response to 36C10A19R0063- Cloud-based Signature Informed Consent for Clinical Treatments and Procedures Enterprise Solution. We have a great fit for the VA's requirements, but are not currently registered in SAM. Is SAM registration required before the proposal is submitted, or is it required by the time the contract is awarded? We are in the process of finishing our SAM registration and are confident we will have it completed to be eligible in time for contract award.

In accordance with Federal Acquisition Regulation clause 52.212-1(j): Unique entity identifier. (Applies to all offers exceeding $3,500, and offers of $3,500 or less if the solicitation requires the Contractor to be registered in the System for Award Management (SAM).) If the Offeror does not have a unique entity identifier, it should contact the entity designated at www.sam.gov for unique entity identifier establishment directly to obtain one. The Offeror should indicate that it is an offeror for a Government contract when contacting the entity designated at www.sam.gov for establishing the unique entity identifier.

71. Question: Is it possible to receive a draft/model contract based on this solicitation? I did not see one in the solicitation?

The solicitation document serves as the draft contract. Reference the solicitation attachment (36C10A19R0063) to the posting on the Federal Business Opportunities website.

72. Question: A portion of this contract that is entitled "SIC Clinical Database Content." Is the VA expecting contractors to write up the information required for these consent forms? Or does this mean changing the pre-existing consent forms from PDF to an editable version that can be stored in the cloud?

The contractor shall provide the clinical content needed to populate the description of the treatment/procedure, risks, benefits and alternatives for the consent forms. Reference paragraph 5.2 of the PWS.