S06 - 36C10A24R0006 A00001 Questions and Answers.pdf

The answers provided below are for informational purposes, to assist potential Offerors in preparing proposals, and such answers do not themselves constitute a part of any future Request for Proposal (RFP). To the extent that any answers provided below conflict in any way with the future RFP and any Amendments, the final RFP takes precedence.

Question # Section Question Response

1. 3.0 Scope of work, 3rd paragraph

Is the Corporate Data Warehouse (CDW) owned by the VA and is this the data that comes from the 131 VistA sites?

Yes, the Corporate Data Warehouse (CDW) is owned by the VA and is on the VA's intranet.

The CDW is a standard SQL database. Every night the data from the 131 VistA sites is replicated into the CDW. The Contractor shall extract data from the CDW.

2. 5.1.1 - Contractor Project Managemen t Plan

Does the CPMP come from the VA that currently exists or we, the contractor, provide?

The Contractor shall develop and deliver the

CPMP.

3. General Question

Does the VA currently have a MUMPS developer currently available to the VA? When was the last upgrade?

The VA has two full time MUMPS developers that have been supporting VistA - Nicotra for over 10 years each. The Contractor is not required to code any MUMPS because data extract will come from the CDW SQL database.

4. 6.7 Process Asset Library

(PAL)

How will the contractor gain access to the OIT Process Asset Library

(PAL)?

Is there a specific portal or system for accessing the PAL?

Access to PAL information and content is based on users’ VA System Access Permissions. For users with full VA Access Permission, the PAL SharePoint site is the primary tool for viewing, searching, and downloading all PAL processes and related documentation. Users without full access permission can utilize the PAL internet to access process maps, request documents or process information, seek support, and submit inquiries related to PAL content by contacting Compliance, Risk, and Remediation (CRR) Office after contract award.

5. 6.7 Process Asset Library

(PAL)

Will there be any training provided on how to use the PAL and follow its processes?

Formal training will not be available; however, VA will provide knowledge transfer to demonstrate how to use the PAL post-award if required.

6. 6.7 Process Asset Library

(PAL)

How often is the PAL updated, and how will the contractor be informed of these updates?

The PAL is updated on an as needed basis, and the Contractor will be notified on an as needed basis as well.

7. 6.7 Process Asset Library

(PAL)

Are there any specific tools or software that the

The VA has a technical reference manual (TRM) located at https://www.oit.va.gov/Services/TRM/TRMH

36C10A24R0006 Questions and Answers https://www.oit.va.gov/Services/TRM/TRMHomePage.aspx

Question # Section Question Response contractor is required to use?

omePage.aspx that lists all authorized software inside the VA. Use of this software is preferred whenever possible.. Any software not on that list will be evaluated on a case-by-case basis and submitted for a review with a justification. For bug tracking, Jira is to be used. (VA will provide licenses.)

8. 6.7 Process Asset Library

(PAL)

Can you provide examples of the standards and guides included in the

PAL?

This information is located at:

https://www.va.gov/process/artifacts.as p

9. General Question

Would the government provide a two-week delay for the submission of RFPs and allow for more time to gain partnerships and more inclusive responses?

Solicitation has been extended to 6/17/2024 per this amendment.

10. General Question

If our organization is not currently FedRAMP certified, do we need to go thru the FedRAMP process to be considered for this RFP?

FedRAMP compliant is not a solicitation requirement to be considered for this RFP, however FedRAMP certification may be considered in the VA’s source selection evaluation process. The solution will initially be deployed to the VA's Enterprise Cloud (VAEC) as per paragraph 5.3. The VA included optional tasks to consider moving to a vendor hosted solution on a FedRAMP compliant cloud.

11. General Question

If so, would the VA consider a sponsorship in order to obtain our initial authorization to Operate?

Yes, Sponsoring is included in Optional tasks at paragraph 5.6 and 5.7 and related CLINS X004.

12. General Question

Can the VA provide an estimated timeframe of when all cancer registries should have all users onboarded, trained and data conversions completed?

VA has planned for 12 months to complete this task.,

13. General Question

Will the VA require the selected vendor to provide a central registry solution in addition to the individual registry solutions, in which data is regularly submitted to the

Yes, the provided solution shall be one large database that can perform central registry functions AND local registry functions at the medical center level (aka VA hospital) A data steward / registrar must be able to easily generate a VA-wide report OR a local VA medical center report.

36C10A24R0006 Questions and Answers https://www.oit.va.gov/Services/TRM/TRMHomePage.aspx https://www.va.gov/process/artifacts.asp https://www.va.gov/process/artifacts.asp central registry and records consolidated?

14. General Question

Would any of the cases, for deceased veterans, be removed from the VA Cancer Registry database and archived?

No, the data/information needs to be available for researchers.

15. General Question

Regarding requirement ID 16 & 17 – Is moving the deleted data out of the active case database into a ‘deleted case’ database an acceptable option?

Should it be necessary the case could be moved back from the deleted case database to the active case database.

Yes, that is acceptable as long as:

A system administrator or “Power user” can easily run a report of all deleted cases A system administrator or “Power user” can easily restore a deleted case.

16. General Question

Regarding requirement ID 5 – Does the use of the VA Jira instance require a Jira license be held by the Contractor?

No, the VA will provide licenses for the contractor.

17. General Question

Will the federal government please provide a government estimate for the 5-year period of performance or an award range for the above referenced solicitation?

This information is acquisition sensitive and will not be provided.

18. General Question

Is there an incumbent? Yes

19. General Question

Who is the incumbent? University of Utah

20. General Question

What is the current contract value for the contract?

$81,483.63

21. General Question

Is this a new requirement?

Yes, the requirement has changed from the incumbent award.

22. General Question

What is the IGCE estimate?

This information is acquisition sensitive and will not be provided.

36C10A24R0006 Questions and Answers

23. General

Question What registry product is currently being used?

Rocky Mountain Cancer Data Systems (RMCDS) Central Cancer Registry Software

24. General Question

Is the requirement for the cots product to be ready to go from day 1?

Yes. The Contractor shall begin installation of the COTS product immediately once system administrator level access is granted to the contractor on the VAEC. The VA understands that configuration of the COTS product will take time along with the data import setup.

25. General Question

What is the anticipated FTE for this RFP

This information is acquisition sensitive and will not be provided.

26. General Question

Can you provide detailed technical specifications for the integration with the Veterans Data Integration and Federation Enterprise Platform (VDIF-EP)?

At this time VDIF-EP information is not needed to execute the requirements for this contract. The VA has paused the rollout of CERNER at this time and when it will resume is unknown. When the VA does decide to move forward and leverage the VDIF-EP interface the detailed technical specifications will be provided to the contractor is necessary.

27. General Question

What are the specific interoperability requirements for the CRM software with both the legacy VistA and modernized Cerner EHR systems?

The CRM will shall run SQL queries to access the legacy VistA data via the CDW. The CERNER effort is currently paused but the plan would be to leverage VDIF.

28. General Question

Could you elaborate on the expected process and technical requirements for the phased implementation of data transfer to the Corporate Data Warehouse (CDW)?

VistA is the production electronic medical record system for the VA and is at all 131 sites. Every night that data is replicated into a read-only SQL database called the CDW that we can query from.

29. General Question

What specific data formats and standards should be supported for importing external datasets (e.g., SEER, NCI)?

Yes, the NAACCR v23 and v24 at this time, and v25 . Specification here:

https://apps.naaccr.org/data-dictionary/

30. General Question

What are the detailed security requirements and standards that the CRM software must comply with, particularly regarding FISMA, HIPAA, and VA-specific directives?

FISMA - High HIPAA - yes, the VA is considered a covered entity.

VA-specific directives are in the appendixes of the solicitation

31. General

Question Can you provide clarity on the expected measures for ensuring data integrity and protection against unauthorized access, especially concerning the disabling software code provision?

The VA strives to comply with all applicable laws, regulations and VA policies in regard to cyber security. The VA has invested many resources to ensure the highest level of security to protect PII, PHI and other sensitive information.

The use of software disabling code within the VA is strictly prohibited. The software is required to comply with the following: The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the Contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the Contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

32. General Question

What are the specific Service Level Agreements (SLAs) for technical support and maintenance, particularly regarding response times for urgent and non-urgent issues?

For technical support:

Urgent - 1 business hour acknowledgement/response Not Urgent - 1 business day acknowledgement response For maintenance: Urgent – please refer to paragraphs 6.2.4.10 and 6.2.4.11.

33. General

Question What are the detailed expectations for the software maintenance activities, including version and release upgrades, security patches, and performance enhancements?

The Contractor shall deploy urgent security related patches as soon as possible, perform regular patches and miniatous actives on a regular cadence as agreed by both parties, such that value is being provided to the government but not so often that there is too much overhead spent on deployment related activities.

34. General Question

Can you provide more details on the performance monitoring requirements and the metrics that will be used to ensure the system meets the 99.5% uptime requirement?

The government has multiple automated monitoring tools that regularly check the status of software. Some of the things that will be monitored may include but are not limited to:

- cup, memory and network utilization

- user ability to login and use/update information

35. General Question

Are there specific technical requirements or guidelines for deploying the solution in the VA's enterprise cloud (VAEC) and ensuring it meets the VA-approved Assessment and Authorization (A&A) process?

The A&A process is very extensive. As the software is evaluated specific feedback with recommended improvements will be provided to the vendor.

36. General Question

Could you provide more details on the role-based access control system, including how user roles and permissions should be managed across different levels (facility, VISN, national)?

The VA will leverage the software's current role management functionality and map them to the VA's specific needs. At a minimum some of the roles include registrar level access, researcher/reporting access, and system administrator level access. This can be fined tuned upon contract award. The VA is moving away from VISN’s, so facility level access and national level access better align with the government's vision. Please note that a registrar may need access to multiple facilities.

37. General Question

What are the specific audit trail requirements for tracking user activities and changes within the system?

The following needs to be documented:

- The type of change

- User that performed the action

- Date/time/location/IP

- Value change (either new value, old value or both. The government understands that this may cause the audit log to grow, so the contractor may come up with optimizations to

36C10A24R0006 Questions and Answers

Cozzens, Kari L. (she/her/hers) I think this should read either with the specific process/guidelines; or VA will facilitate deployment to the VAEC.

minimize file size but still allow for activity to be tracked.)

38. General Question

What are the specific technical requirements for generating and exporting reports in various formats (e.g., Excel, NAACR XML, CSV)?

The three formats:

NAACR XML v23, v24 and newer -https://apps.naaccr.org/data-dictionary Excel (xlsx format 8.0 or newer) -https://learn.microsoft.com/en-us/openspecs/office_standards/ms-xlsx/2c5dee00-eff2-4b22-92b6- 0738acd4475e#published-version

CSV -

https://datatracker.ietf.org/doc/html/rfc4180

39. General Question

Can you provide details on the expected capabilities for the data application to support reporting, surveillance, and analytics across different levels of the enterprise?

The CRM software shall find cases (new and updates) in the CDW and assist the registrar with ascension. The VA has two levels, facility level and central registry level that need to be supported.

40. General Question

What are the technical requirements for the deployment of the CRM software, especially in terms of ensuring compatibility with existing VA infrastructure and systems?

The VA cloud has Azure and AWS, the Contractor shall use one of those technologies and follow the best practices as prescribed by Microsoft or Amazon depending on the provider selected.

41. General Question

Can you provide more details on the expectations for the training materials and sessions, particularly for the virtual Train-the- Trainer support and ongoing training for new software modules?

The Contractor may use their discretion to determine the best way to train a handful of VA employees and VA contractors on how to train the registrars and researchers. The government would requires virtual classes because the government's employees and contractors are spread across geographic locations.

42. There is reference to "Volume V" in Section E, please confirm whether this should be "Volume IV", or is there a Volume V that was omitted from Section E?

Page 81 of the solicitation has been corrected to state Volume IV.

43. 6.8 In Section 6.8 "Authoritative Data

Yes, internally the MPI is the authoritative key for identifying a veteran. However, unique to

Sources," NeuralFrame's understanding is that the VA Master Person Index (MPI) is the only in-scope Authoritative Data Source (ADS) for this project, is this correct?

this project is our requirement to be able to synchronize data with the states. Social security number, name, and date of birth must also be available because the states do not necessarily know the VA's MPI.

Additional questions may not be entertained.