36C10B18R2676-A0004001.docx

36C10B18R2676 A0004

5. PROJECT NUMBER (if applicable)

CODE

7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER

3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE

OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO.

1. CONTRACT ID CODE

FACILITY CODE

CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ______1_____ copies to the issuing office.

is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

BY

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER

16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30

PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) (such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

A0004

Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

23 Christopher Way

To all Offerors/Bidders

36C10B18R2676

X x

The purpose of Amendment A0004 is to:

a. Revise the Proposal Submission Instruction to include the email file size restrictions.

b. Extend the due date for proposals to June 18, 2018 at 4 PM EST.

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS 518210

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

36C10B18R2676 5-24-2018 Lauren Sankar 732-440-9690 6-18-2018

2 4 PM EST

Department of Veterans Affairs Technology Acquisition Center

$32.5m

N/A

See Delivery Schedule

Financial Services Center PO Box 149971 Austin TX 78714-8971

Financial Services Center Healthcare Clearinghouse Services

POC: Lauren Sankar Contract Specialist lauren.sankar@va.gov

Alternate: Sharon Fernandes Contracting Officer Sharon.fernandes@va.gov

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: TBD

b. GOVERNMENT: Contracting Officer 36C10B Sharon Fernandes Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Department of Veterans Affairs Technology Acquisition Center Financial Services Center PO Box 149971 Austin TX 78714-8971

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 LIMITATIONS ON SUBCONTRACTING-- MONITORING AND COMPLIANCE (JUN 2011)

This solicitation includes FAR 52.219-4 Notice of Price Evaluation Preference for HubZone Small Business Concerns. Accordingly, any contract resulting from this solicitation will include this clause. The contractor is advised in performing contract administration functions, the CO may use the services of a support contractor(s) retained by VA to assist in assessing the contractor's compliance with the limitations on subcontracting or percentage of work performance requirements specified in the clause. To that end, the support contractor(s) may require access to contractor's offices where the contractor's business records or other proprietary data are retained and to review such business records regarding the contractor's compliance with this requirement. All support contractors conducting this review on behalf of VA will be required to sign an “Information Protection and Non-Disclosure and Disclosure of Conflicts of Interest Agreement” to ensure the contractor's business records or other proprietary data reviewed or obtained in the course of assisting the CO in assessing the contractor for compliance are protected to ensure information or data is not improperly disclosed or other impropriety occurs. Furthermore, if VA determines any services the support contractor(s) will perform in assessing compliance are advisory and assistance services as defined in FAR 2.101, Definitions, the support contractor(s) must also enter into an agreement with the contractor to protect proprietary information as required by FAR 9.505-4, obtaining access to proprietary information, paragraph (b). The contractor is required to cooperate fully and make available any records as may be required to enable the CO to assess the contractor's compliance with the limitations on subcontracting or percentage of work performance requirement.

B.3 SUBCONTRACTING COMMITMENTS--MONITORING AND COMPLIANCE (JUN 2011)

This solicitation includes VAAR 852.215-70, Service-Disabled Veteran-Owned and Veteran-Owned Small Business Evaluation Factors, and VAAR 852.215-71, Evaluation Factor Commitments. Accordingly, any contract resulting from this solicitation will include these clauses. The contractor is advised in performing contract administration functions, the CO may use the services of a support contractor(s) to assist in assessing contractor compliance with the subcontracting commitments incorporated into the contract. To that end, the support contractor(s) may require access to the contractor's business records or other proprietary data to review such business records regarding contract compliance with this requirement. All support contractors conducting this review on behalf of VA will be required to sign an “Information Protection and Non-Disclosure and Disclosure of Conflicts of Interest Agreement” to ensure the contractor's business records or other proprietary data reviewed or obtained in the course of assisting the CO in assessing the contractor for compliance are protected to ensure information or data is not improperly disclosed or other impropriety occurs. Furthermore, if VA determines any services the support contractor(s) will perform in assessing compliance are advisory and assistance services as defined in FAR 2.101, Definitions, the support contractor(s) must also enter into an agreement with the contractor to protect proprietary information as required by FAR 9.505-4, obtaining access to proprietary information, paragraph (b). The contractor is required to cooperate fully and make available any records as may be required to enable the CO to assess the contractor compliance with the subcontracting commitments.

B.4 GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. §3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this Clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this Clause shall prevail. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ). 28 U.S.C. § 516. At the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by contract/order modification (Standard Form 30) and shall only be effected by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.5 PERFORMANCE WORK STATEMENT

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Financial Services Center (FSC) is authorized by the Government Management Reform Act of 1994 (Public Law 103-356) to provide common administrative support services on a reimbursement basis to VA and Other Government Agencies (OGA’s), as a Franchise Fund. The goals of the Franchise Fund organization include:

One of the FSC product offerings is receipt and processing of medical claims. The FSC currently utilizes a Contractor to transmit incoming and outgoing electronic transactions to the national Payer community. Various transaction formats are utilized, such as Health Insurance Portability and Accountability Act (HIPAA) Healthcare Claim Payment (X12) and National Council for Prescription Drug Program (NCPDP) transactions. FSC transactions are completed as batch and real-time transfers. The Contractor provides reports to Veterans Health Administration (VHA) on transaction activity for reconciliation, auditing and billing purposes.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

3. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

4. 10 U.S.C. § 2224, "Defense Information Assurance Program"

5. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

6. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

7. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

8. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

9. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

10. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

11. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

12. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

13. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

14. National Uniform Billing Committee (NUBC), http://www.nubc.org/

15. National Uniform Claim Committee (NUCC), http://www.nucc.org/

16. National Council for Prescription Drug Programs (NCPDP), https://www.ncpdp.org/

17. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

22. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

24. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

25. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

26. VA Handbook 6500.6, “Contract Security,” March 12, 2010

27. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

28. OI&T ProPath Process Methodology (Transitioning to Process Asset Library (PAL) (reference process maps at http://www.va.gov/PROPATH/Maps.asp and templates at http://www.va.gov/PROPATH/Templates.asp

29. One-VA Technical Reference Model (TRM) (reference at http://www.va.gov/trm/TRMHomePage.aspx)

30. National Institute Standards and Technology (NIST) Special Publications (SP)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

33. VA Directive 6300, Records and Information Management, February 26, 2009

34. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

35. OMB Memorandum, “Transition to IPv6”, September 28, 2010

36. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

37. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

38. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

39. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

40. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

41. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

43. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

44. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

45. NIST SP 800-63-2, Electronic Authentication Guideline, August 2013

46. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

47. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

49. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. VA Memorandum, VAIQ # 7011145, VA Identity Management Policy, June 28, 2010 (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

53. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

54. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

55. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

56. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

57. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

58. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade”, dated March 19, 2015

59. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

60. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

61. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

62. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

63. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

64. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. “Veteran Focused Integration Process (VIP) Guide 1.0”, December, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

68. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

69. “POLARIS User Guide”, Version 1.2, February 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

70. Office of Information Security (OIS) “Authorization Requirements” SOP v3.13, October 03, 2017

3.0 SCOPE OF WORK

The Financial Services Center (FSC) requires electronic healthcare clearinghouse services. The Contractor shall provide support for all of FSC’s current electronic claims transactions across the United States and its territories. The Contractor shall assist the VHA in continuing its mission to implement electronic claims transactions and to support printing of standard claim forms in certain situations where electronic transmission is not feasible. As such, VHA is required to comply with the Health Insurance Portability and Accountability Act (HIPAA) Act of 1996 Transaction and Code Set (TCS) regulations.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance for the base period shall be one (1), 12-month base period with three (3) 12- month option periods. Each performance period shall include optional tasks to support additional claim transactions in accordance with PWS Paragraph 5.2.2.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities within the United States.

4.3 TRAVEL

The Government does not anticipate any travel.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the period of performance.

Deliverables:

A. Contractor Project Management Plan

5.1.2 PROJECT KICK-OFF MEETING

The Contractor shall conduct a project kick-off meeting with a project advisory group comprised of key stakeholders and subject matter experts (SMEs) to be identified by the VA PM. The Contractor shall schedule the kick-off meeting to be held within ten (10) business days after contract award. At the Kick-Off Meeting, the Contractor shall present the details of its intended approach, work plan and project schedule including deliverable dates for review and approval by the advisory group. Work shall not commence until the VA PM approves the approach/methodology, work plan and schedule on behalf of the project advisory group. The Contractor shall produce and distribute pertinent information that documents the conduct, actions, and decisions resulting from the kick off meeting as part of the monthly status report.

5.1.3 REPORTING REQUIREMENTS

The Contractor shall deliver a Daily Status Report which shall consist of the following elements:

· 837 Claims sent (Institutional, Professional, Dental) by batch, Payer Identification (ID) and source.

· 835 Health Care Payment / Advice Transactions received by payer ID and 835 picked up by provider/submitter.

· Optical Character Recognition (OCR) files submitted and received by the Healthcare Clearinghouse (HCCH) with count by type of image (professional, institutional, dental), single or multi page, claims rejected, date received, date 837 file is returned and claim count.

The Contractor shall deliver a Weekly Status Report which shall consist of the following elements:

· 837 Claims sent (Institutional, Professional, Dental) by batch, Payer ID and source.

· 835 Health Care Payment / Advice Transactions received by payer ID and 835 picked up by provider/submitter.

The Contractor shall deliver a Monthly Status Report which shall consist of the following elements:

1. Summary of 837 Claims reports by Payer ID and source (Institutional, Professional, Dental).

2. Summary of 835 Health Care Payment / Advice Transactions received by payer ID and 835 picked up by provider/submitter.

3. Monthly Summary Paper Claim Report (for network submitters sending paper to payer by payer ID.

4. Identify inconsistencies and irregularities that impact ongoing deliverables.

The Contractor shall deliver on an annual basis rendered images of electronic claims received for auditing purposes; which shall consist of the following elements:

1. Convert the 837 electronic claim to a rendered image to look like a claim submitted on the appropriate form.

2. Up to 500 rendered images may be delivered, based on the claim numbers provided by the Government.

Deliverables:

A. Daily Status Report B. Weekly Status Report C. Monthly Status Report D. Annually Rendered Images

5.1.4 KEY REQUIREMENTS

The Contractor shall adhere to Federal Information Security Management Compliance (FISMA) at the time of proposal submission and maintain compliance for the duration of the contract.

The Contractor shall be a fully “Accredited Healthcare Network” (HNAP-EHN and ePAP-EHN accredited) by the Electronic Healthcare Network Accreditation Commission (EHNAC) (https://www.ehnac.org/) at the time of proposal submission and maintain accreditation for the duration of the Contract.

The Contractor shall be certified by the Council for Affordable and Quality Healthcare (CAQH), as a CORE Phase II Certified Contractor for both batch and real-time eligibility benefits HIPAA Eligibility Transactions (270/271) and maintain certification for the duration of the Contract.

The Contractor shall work towards future Committee of Operating Rules and Information Exchange (CORE Phase III) and any other future phase certifications within two (2) years from the award date.

An Interconnection Security Agreement (ISA)/Memorandum of Understanding (MOU) (ISA/MOU) and Business Associate Agreement (BAA) are required. The Contractor shall be required to work with the necessary VA staff to complete these documents and support the approval process for the ISA/MOU within six (6) months from award date.

5.1.5 PRIVACY TRAINING

The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the task. The status reporting shall identify: a single Contractor Security Point of Contact (POC), the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. This information shall be submitted as part of the -Weekly Status Report.

The Contractor shall submit VA Privacy and Information Security training certificates in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. VA Privacy and Information Security Training Certificates

5.2 CLEARINGHOUSE SERVICES

The Contractor shall perform the following tasks within the base period of performance and option periods, if exercised:

1. Receive and document receipt date of electronic medical claims from providers.

2. Validate the electronic medical claims data using FSC provided required information (a.k.a. edits).

3. Create HIPAA compliant 837 transaction files based on the validated electronic medical claims data.

4. Receive encrypted TIFF images from the FSC and convert those TIFF images into HIPAA compliant 837 transaction files within two (2) business days of receipt of the TIFF images.

5. Electronically transmit the encrypted HIPAA compliant 837 transaction files to the FSC.

6. Transmit and receive health care transactions in the currently adopted HIPAA X12 5010 or downgraded 4010 file based on product line.

7. Support at a minimum the following transactions and relevant code sets as applicable:

· CMS-1500 Claims Optical Character Recognition (OCR)

· CMS-1450 Claims Uniform Billing (UB)

· 837 Health Care Claims (Institutional and Professional, Dental)

· 835 Health Care Claim Payment/Advice

8. Send and receive electronic acknowledgements for X12 Interchange Envelopes and Standard Conformance for HIPAA X12 transactions to and from FSC or its submitters.

9. Implement the following transactions with FSC:

· 837 Professional, Dental, Institutional using batch transactions

· Acknowledgements 999, 824, 277CA

· Coordination of Benefits (COB) payer to payer claims

· Healthcare Financing Administration (HCFA) OCR Dental Other Government Agencies (OGA), HCFA OCR Dental Camp Lejeune, Pharmacy Claims, 270/271, 275 transactions, including all attachments, 276/277 and 278.

10. Provide and implement plans to migrate to future adopted versions of paper institutional and non-institutional health care claims 90 days prior to the deadline imposed by industry. The transition process shall allow VA and the Contractor ample time for testing of the new versions to assure compliance with the National Uniform Billing Committee (NUBC), National Uniform Claim Committee (NUCC) and National Council for Prescription Drug Programs (NCPDP) mandated requirements.

5.2.1 TRANSACTIONS

The Contractor shall complete the quantity of transactions as provided below for the Base, each Option Period, and Optional Tasks if exercised. The Contractor shall process batch transactions with at least a 99 percent accuracy rate on a monthly basis in accordance with FSC requirements.

2,000,001 – 5,000,000 Transactions

5.2.2 OPTIONAL TASKS – ADDITIONAL TRANSACTIONS

The Contractor shall complete the quantity of additional transactions as specified in 5.2.1 for Optional Tasks 1, 2, 3, and 4. Optional Task quantities may be exercised anytime up to the maximum for each claim type within each period of performance. The Lot size for the Optional Tasks is 500,000 claims.

5.3 INVOICING

The Contractor shall submit invoices by payer ID on a monthly basis given the quantity of transactions completed during each month.

5.4 TEMPORARY AUTHORITY TO OPERATE (TATO) / AUTHORITY TO OPERATE (ATO)

The Contractor’s hosting environment and software shall be compliant with the VA security posture and standards instituted for VA-approved Authority to Operate (ATO) systems through Assessment and Accreditation (A&A) activities within 6 months of award. Details regarding the VA A&A process and the guidelines for a VA-approved ATO are documented in the VA Handbook 6500.3 HB Certification of Information Systems. The VA 6500 Handbook and the agency’s Information Security Program should be used as primary sources for accreditation and authorization compliance. The deliverables as noted below shall be updated with input, coordination and approval from an assigned agency Information Security Officer (ISO) and an agency Service, Delivery, and Engineering (SDE) representative.

The Contractor shall support the Temporary Authority to Operate (TATO) / ATO requirement to ensure there are no interruptions.

The Contractor shall execute and provide technical input and support for all necessary data, files, documents to the agency with the goal of attaining commercial and/or organization specific certifications/authorizations for new or modified systems, applications, designs, equipment or installations, as well as meeting all operational readiness requirements, in accordance with applicable organization standards specified in the PWS. Specific activities include security certifications, or comprehensive assessments of the management, operational, and technical security controls in an information system to determine the extent to which the controls are implemented correctly.

The Contractor shall ensure that its software information systems meet all VA A&A requirements needed to connect to the VA network. Currently, the ATO package documentation required to perform an A&A include: Risk Assessment, System Security Plan, Master Test Plan, Test Evaluation Summary, Disaster Recovery Plan, Deployment Plan, IS Contingency Plan, Product Architecture, Security Management and Reporting Tool (SMART) entry. The Contractor shall provide the ATO Package to the COR for final coordination and approvals required.

The Contractor shall ensure that the application security policies are implemented as required by a moderate system baseline according to NIST SP 800-53. VA will identify the relevant inheritable security controls that must be implemented; and the Contractor shall ensure that the policies and controls are implemented within 30 days after contract award. The Contractor shall be responsible for maintaining the documentation related to these controls and shall identify a Contractor representative to the COR/VA PM who can act as a signatory on security related deliverables.

The Contractor shall support audits regarding the implementation of these policies and assist in the collection and preparation of related compliance evidence. The Contractor shall retain and maintain referenced, applicable documents and deliverable documentation and make it available for review. The Contractor shall provide support to assist in meeting security requirements including:

The Contractor shall document security assessment and authorization policies that address purpose and will also document procedures to facilitate the implementation of the security assessment and authorization policies and associated security assessment and authorization controls. The security assessment and accreditation plan shall provide actual text input and/or information/consultation for the completion of all application-specific sections of all security documentation to be created.

The Contractor shall work with the VA-FSC to complete all tasks under the ATO Checklist located at Addendum C of the PWS.

Deliverables:

A. ATO Package

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OI&T Technical Reference Model (One-VA TRM). One-VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. One-VA TRM includes the Standards Profile and Product List that collectively serves as a VA technology roadmap. Architecture, Strategy, and Design (ASD) has overall responsibility for the One-VA TRM.

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software development is compliant with the VA Enterprise Technical Architecture (ETA), and specifically for compliance and integration with Identity and Access Management (IAM) requirements and IAM enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/docs_design_patterns.asp. The Contractor shall ensure all Contractor delivered applications and systems are compliant with VA Identity Management Policy (VAIQ# 7011145) and VA IAM enterprise identity management requirements (IAM Identity Management Business Requirements Guidance document, https://www.voa.va.gov/). The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with NIST Special Publication 800-63-2 and VA IAM enterprise requirements for both direct and assertion based authentication. Direct authentication at a minimum must include PKI base authentication supportive of both Personal Identity Verification (PIV) and Common Access Card (CAC). Specific Identity and Access Management Personal Identity Verification (PIV) requirements as set forth in OMB Memoranda M-04-04 (http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy04/m04-04.pdf), M-05-24 (https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf), M-11-11 (http://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf), National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) 201-2, and supporting NIST Special Publications. Assertion authentication at a minimum must include SAML token authentication and authentication/account binding based on trusted headers.

The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 (http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf) and September 28, 2010 (https://cio.gov/wp-content/uploads/downloads/2012/09/Transition-to-IPv6.pdf). IPv6 technology, in accordance with the USGv6 Profile (NIST Special Publication (SP) 500-267 http://www-x.antd.nist.gov/usgv6/index.html), the Technical Infrastructure for USGv6 Adoption (http://www.nist.gov/itl/antd/usgv6.cfm), and the NIST SP 800 series applicable compliance (http://csrc.nist.gov/publications/PubsSPs.html) shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 users, and all internal infrastructure and applications shall communicate using native IPv6 operations. Information concerning IPv6 transition in addition to OMB/VA Memoranda can be found at https://www.voa.va.gov/.

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 7 (64bit), Internet Explorer 9 and Microsoft Office 2010. In preparation for the future VA standard configuration update, end user solutions shall also be compatible with Internet Explorer 11, Office 2013, and Windows 8.1. However, Internet Explorer 11, Office 2013 and Windows 8.1 are not the VA standard yet and are currently not approved for use on the VA Network, but are in-process for future approval by OI&T. Upon the release approval of Internet Explorer 11, Office 2013, and Windows 8.1 individually as the VA standard, Internet Explorer 11, Office 2013, and Windows 8.1 will supersede Internet Explorer 9, Office 2010, and Windows 7 respectively. Applications delivered to the VA and intended to be deployed to Windows 7 workstation shall be delivered as a signed .msi package and updates shall be delivered in signed .msp file formats for easy deployment using System Center Configuration Manager (SCCM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provide certificate that is trusted by the VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that its solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) specific to the particular client operating system being used.

6.2 POSITION/TASK RISK DESIGNATION LEVEL(S) AND CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with its submitted proposal.

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel…