36C10B19R0014-002.docx
DOCX document 183 KB Posted
- Solicitation number
- 36C10B19R0014
About this file
36C10B19R0014 PWS DRAFT.docx
View the file
Other files
Show all 30
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
DRAFT
PERFORMANCE WORK STATEMENT (PWS)
DEPARTMENT OF VETERANS AFFAIRS
Office of Information & Technology Office of Electronic Health Record Modernization (OEHRM)
Veterans Data Integration and Federation (VDIF) Enterprise Platform Sustainment and Application Integration
Date: March 7, 2019
TAC-19-53433
PWS Version Number: 4.0
1.0 BACKGROUND
The mission of the Department of Veterans Affairs (VA), Office of Electronic Health Record Modernization (OEHRM) is to provide benefits and services to Veterans of the United States. In meeting these goals, OEHRM strives to provide high quality, effective, and efficient information technology (IT) services to those responsible for providing healthcare to the Veterans in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.
On May 17, 2018, the VA announced it had signed a contract with Cerner Government Services, Inc. (Cerner) to replace its Electronic Health Record (EHR) with Cerner’s EHR solution. The change will modernize the VA’s health care IT system and help provide seamless care to Veterans as they transition from military service to Veteran status, and when they choose to seek care outside the VA. Further, the VA agreed to operate an electronic health record modernization (EHRM) system with the Department of Defense (DoD) which also uses Cerner Millennium as the core of Military Health System (MHS) GENESIS – the DoD’s EHR.
The VA’s current EHR is the Veterans Information Systems and Technology Architecture (VistA). VistA’s architecture consists of more than 160 clinical applications and many non-clinical applications which support infrastructure and financial management functions. These applications interoperate, and all applications are integrated within a single database. The VA operates 130 instances of VistA.
To support the transition to the new EHRM system, the VA must migrate patient data from the legacy VistAs and synchronize the data throughout the 10-year transition. In addition, VA data must remain synchronized across all current EHR and non-EHR VA and external applications to enable access to the data allowing support for health care research, quality and performance management and reporting, and other data driven activities.
To that end, the VA has defined the Veterans Data Integration and Federation (VDIF) architecture. VDIF shall provide secure, high performance, governed access to EHRM system data and VistA Legacy data allowing multiple instances and the entire enterprise access to federated data. Federated data allows interoperability and information sharing between organizations with the ability to aggregate data from disparate sources in a virtual database so it can be used for Business Intelligence (BI) or other analysis. VDIF will support the integration of VistA data and EHRM system data with Commercial Off-The-Shelf (COTS) and non-COTS products requiring:
| Data access methods |
| Governance and standardization of tools sets |
| Governance of the Application Programming Interfaces (APIs) |
| Other technologies required for the federation of data |
The integration addresses access from legacy client-server applications and new applications based on a wide variety of technologies. It will also support the VA’s Excellence in the 21st Century approach to healthcare by implementing tools that enforce a data-driven approach for ongoing tracking, monitoring, and measurement of patient performance, and allow for the continuous analysis and design of treatment modalities.
To support the migration of patient data from the legacy VistA to the new EHRM system and to facilitate Health Information Exchange (HIE) within VA and with external partners, the VA has established the VDIF Enterprise Platform (EP) which serves as middleware (a HIE) for federating VA patient data. The VDIF is hosted on a VA HealthShare suite of applications.
The Contractor supporting this project will:
| a) | Sustain core components of, and applications interfaces to the VDIF EP. |
| b) | Plan, configure, develop, test, implement and migrate applications into VDIF EP to accomplish the HIE transition and migration. |
| 2.0 | APPLICABLE DOCUMENTS |
In the performance of the tasks associated with this Performance Work Statement (PWS), the Contractor shall comply with the following:
| 1. | VA Enterprise Service Desk (ESD) Information Technology Service Management (ITSM) ServiceNow Guide, https://www.servicenow.com/success/champion/itsm-process-guide.html |
| 2. | 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002” |
| 3. | “Federal Information Security Modernization Act of 2014” |
| 4. | Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules” |
| 5. | FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004 |
| 6. | FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016 |
| 7. | FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013 |
| 8. | 10 U.S.C. § 2224, "Defense Information Assurance Program" |
| 9. | Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010 |
| 10. | 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974” |
| 11. | Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters |
| 12. | 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964” |
| 13. | VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/ |
| 14. | VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs |
| 15. | VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008 |
| 16. | 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003 |
| 17. | Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016 |
| 18. | 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)” |
| 19. | An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008 |
| 20. | Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017 |
| 21. | Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004 |
| 22. | VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012 |
| 23. | VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015 |
| 24. | VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008 |
| 25. | VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016 |
| 26. | VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014 |
| 27. | VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010 |
| 28. | VA Handbook 6500.6, “Contract Security,” March 12, 2010 |
| 29. | VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011 |
| 30. | OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp |
| 31. | One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx) |
| 32. | VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014 |
| 33. | VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015 |
| 34. | VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016 |
| 35. | VA Directive 6300, Records and Information Management, February 26, 2009 |
| 36. | VA Handbook, 6300.1, Records Management Procedures, March 24, 2010 |
| 37. | NIST SP 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 5, 2014 |
| 38. | NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015 |
| 39. | OMB Memorandum, “Transition to IPv6”, September 28, 2010 |
| 40. | VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015 |
| 41. | VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014 |
| 42. | OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006 |
| 43. | OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003 |
| 44. | OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005 |
| 45. | OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011 |
| 46. | OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008 |
| 47. | Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011 |
| 48. | NIST SP 800-116 Rev 1, Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, June 2018 |
| 49. | OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007 |
| 50. | NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017 |
| 51. | NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014 |
| 52. | NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012 |
| 53. | Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014 |
| 54. | VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) |
| 55. | IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) |
| 56. | VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846 |
| 57. | Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf |
| 58. | OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007 |
| 59. | OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008 |
| 60. | VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552) |
| 61. | Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007 |
| 62. | Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005 |
| 63. | Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018 |
| 64. | Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001 |
| 65. | VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013 |
| 66. | VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013 |
| 67. | Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 |
| 68. | Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103 |
| 69. | VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 |
| 70. | VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 |
| 71. | VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 |
| 72. | “Veteran Focused Integration Process (VIP) Guide 3.1”, April 2018, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 |
| 73. | “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411 |
| 74. | “POLARIS User Guide”, Version 1.9, March 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412 |
| 75. | VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 |
| 76. | Attachment A: Sustainment of VDIF EP Core Components |
| 77. | Attachment B: VDIF EP Integration |
3.0 SCOPE OF WORK
The Contractor shall provide VA with Agile development of APIs and support for the VA API Gateway. This includes project management, product management, requirements refinement, human centered design, iterative development, user research and usability testing, automated testing support, performance metrics definition and reporting, automated monitoring and performance reporting, and continuous integration / continuous delivery (CI/CD) for the development and enhancement of APIs and the API Gateway. Through the Government’s prioritization of the sustainment and integration efforts, the Contractor shall prioritize execution of all aspects of the API Gateway.
The Contractor shall provide secure, high performance, governed access to EHRM system data and VistA Legacy data allowing multiple client applications and the entire enterprise to access federated data for those applications connected to the VDIF-EP. The goal is to integrate VistA data and EHRM system data with COTS and non-COTS solutions requiring data access methods, governance and standardization of tools sets.
The Contractor shall provide IT program management, project management, technical management, functional planning, system administration, network administration, security management and documentation analysis in support of the VDIF Program. The Contractor shall coordinate with the various VA organizations that interact with the VDIF Portfolio to provide the required support services. The Contractor shall perform and execute the tasks at various levels of support to include at the OEHRM Program and VDIF EP Project level.
4.0 PERFORMANCE DETAILS
4.1 PERFORMANCE PERIOD
The Period of Performance (PoP) shall be twelve (12) months from date of award, with four (4) 12-month option periods.
All tasks shall be performed in the base and option periods, if exercised, unless otherwise specified.
In accordance with Section B, Schedule, Optional Task 5.5, Additional Technical Support, and Optional Task 5.6 Transition Support may be exercised. If exercised, the PoP of each Optional Task exercised shall not exceed the overall 60-month contract PoP.
4.2 PLACE OF PERFORMANCE
Tasks under this PWS shall be performed at Contractor facilities.
4.3 TRAVEL OR SPECIAL REQUIREMENTS
The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.
The total estimated number of trips in support of the program related meetings for this effort is four (4) per year. Anticipated locations include the following, estimated at five (5) days in duration each:
| Location |
| # of Days |
| # of Trips Per Year |
| Number of Persons |
| Kansas City, MO |
| 5 |
| 2 |
| 15 |
| St. Petersburg, FL |
| 5 |
| 1 |
| 15 |
| Washington DC |
| 5 |
| 1 |
| 15 |
5.0 SPECIFIC TASKS AND DELIVERABLES
The Contractor shall perform the following:
5.1 PROJECT MANAGEMENT (OI&T FUNDED)
5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN
The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be delivered and concurred upon by the VA PM and COR and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.
Deliverable:
A. Contractor Project Management Plan
5.1.2 CONTRACTOR STAFFING PLAN
The purpose of the Staffing Plan is to make certain the project has sufficient staff with the right skills and experience to ensure a successful project completion. The Contractor shall present its staffing plan, to include project organization chart, project team roles, project responsibilities, associated skillsets, and number of staff required per assignment, estimated start dates, breakdown in terms of staff’s Full Time Equivalent (FTE) for each role, and contact information for TO Contractor staff.
The Contractor shall ensure established staffing levels are maintained on each reporting period, shall monitor performance, and shall report any deviations. The Staffing Plan shall be delivered to the VA PM and COR for review. The Staffing Plan shall be updated when changes are warranted.
The Contractor shall provide staff that possess experience in the disciplines and technical areas described in each task which are related to the sustainment and integration for the VDIF EP, which serves as middleware (a HIE) for federating VA patient data. To support the migration of patient data from the legacy VistA to the new EHRM system and to facilitate Health Information Exchange (HIE) within VA and with external partners, the VA established the VDIF-EP. The VDIF design is based upon the HealthShare suite of applications It is the responsibility of the Contractor to provide contractor support staff and subcontractors who have the required educational background, HealthShare suite of application expertise, VA security clearance (when authorized), and access authorization or combination thereof to meet the VDIF-EP sustainment and integration requirements. Additionally, based on the importance of HealthShare as the HIE – otherwise referenced as middleware, the Contractor shall be required to be a current InterSystems Certified HealthShare implementation partner, whose membership in the program is contingent upon the partner developing and maintaining a high level of InterSystems technology expertise. InterSystems is the original equipment manufacturer of the HealthShare suite of applications. Furthermore, the Contractor shall maintain the Certified Implementation Partnership throughout the periods of performance.
The Contractor agrees that the staff identified as HealthShare application suite experts shall not be removed from the effort, replaced or added to the effort without a compelling reason and without written notification to the Contracting Officer (CO) and COR/VA PM.
If any change to HealthShare application suite experts becomes necessary (substitutions or additions), the Contractor shall immediately notify the CO and COR/VA PM in writing, accompanied by the resume, if applicable, of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individuals currently performing in that capacity. It is expected that substitution or replacement of the HealthShare experts will not occur within the first 90 days after date of TO award.
Deliverable:
A. Staffing Plan
5.1.3 REPORTING REQUIREMENTS
The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.
The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.
The Contractor shall adhere to the VA Veteran Focused Integration Process (VIP) Guide for all VDIF development activities and deliverables. The Contractor shall utilize VA-approved toolsets and repositories for managing project execution details and for the management, storage and delivery of all project artifacts unless otherwise specified. The Government will provide the Contractor access to VA’s GitHub repository in which the Contractor shall deliver all source code to VA. The VA GitHub repository is linked to IBM Rational Collaborative Application Lifecycle Management (CALM) Toolset (hereinafter referred to as Rational).
In addition, the Contractor shall provide all project documentation and artifacts in Rational on a daily basis to provide a single Agile project/product application lifecycle management toolset to track project execution details. All checked out artifacts shall be checked back in daily and any data updated daily. Rational synchronizes changed information immediately for team members to access work proficiently without the concern of working on aged information. Contractor personnel shall complete the required Rational training in the VA Talent Management System (TMS) in order to be provided VA access to Rational in accordance with Section 5.1.4 below.
Hereinafter, the VA GitHub and/or Rational repositories are referenced as the VA repository.
If the VA approved toolsets or VA repository required by VA change during the PoP of this project, VA will provide Contractor access to the updated VA approved toolsets and VA repositories.
The Contractor shall input and manage data such as that listed below using the VA repository in accordance with the appropriate user guides:
| 1. | Project/product agile requirements backlog. |
| 2. | Scheduled project/product sprints, builds and releases. |
| 3. | Project/product risks and issues. |
| 4. | Project/product configurations and changes. |
| 5. | Project/product test plans, cases/scripts, and results. |
| 6. | All other project/product planning and engineering documentation. |
| 7. | Traceability of requirements to: |
| a. | Change orders. |
| b. | Configurable items. |
| c. | Risks, impediments, and issues. |
| d. | Test cases. |
| e. | Test results. |
Deliverable:
A. Monthly Progress Report
5.1.4 VA TOOLS TRAINING
Contractor personnel shall complete the following VA Talent Management System (TMS) training courses before access can be granted to the VA repository (currently Rational). All Rational Training Certificates shall be provided to the COR. If the VA-approved toolset changes, then the Contractor shall take equivalent training to that listed below:
| 1. | TMS ID 3878248 - IBM Rational Team Concert - Agile Sprint, Configuration/Change Management Level 1 |
| 2. | TMS ID 3878249 - IBM Rational Team Concert - Agile Sprint, Configuration /Change Management Level 2 |
| 3. | TMS ID 3878250 - IBM Rational DOORS Next Generation - Requirements Management Level 1 |
| 4. | TMS ID 3897036 - IBM Rational DOORS Next Generation - Requirements Management Level 2 |
| 5. | TMS ID 3897034 - IBM Rational Quality Manager - Quality Management Level 1 |
| 6. | TMS ID 3897035 - IBM Rational Quality Manager - Quality Management Level 2 |
Contractor personnel who have completed these VA training courses within the past 24 months from date of award and have furnished Rational Training Certificates will not be required to re-take the training courses.
Deliverable:
A. Rational Training Certificates
5.1.5 PRIVACY & HIPAA TRAINING
The Contractor shall submit TMS training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training, and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, Contract Security. All certificates and documents shall be provided to the COR.
Deliverables:
| A. | VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate |
| B. | Signed Contractor Rules of Behavior |
| C. | VA HIPAA certificate of completion |
5.1.6 CONTRACTORS ONBOARDING/OFF-BOARDING
The Contractor shall be responsible for executing and managing the contactor requirements in VA approved tool(s), currently Just-In-Time.
A single Contractor Onboarding POC shall be designated by the Contractor that tracks and reports the onboarding status of Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of required Government onboarding paperwork to the COR. The Contractor shall provide an Onboarding Status Report weekly for any staff with outstanding onboarding requests for review by the:
| COR |
| Government PM or designee |
In the option periods, if exercise, the Contractor shall update the Contractor Staffing Plan, required in 5.1.2, with any onboarding changes or exceptions. At the conclusion of this contract, the Contractor shall be responsible for executing and managing the contactor requirements for off-boarding in accordance with the VIP Process.
Deliverable:
A. Onboarding Status Report
5.1.7 TECHNICAL KICKOFF MEETING
The Contractor shall hold a technical kickoff meeting within 10 days after contract award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five (5) calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three (3) calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and the VA PM.
5.1.8 CONFIGURATION MANAGEMENT
The Contractor shall:
| 1. | Identify the standard and unique aspects of configuration management to be performed for sustainment tasks and for each application interface project by establishing a VDIF EP Product Configuration Management (CM) Plan (CMP), which meets the VIP CM plan requirements. The Contractor shall provide the CM Plan in the VA repository for review and notify the VA PM and COR of delivery. The Contractor shall document in the CM plan those elements common to all tasks, including software versioning, tracking, and management. The Contractor shall also reflect CM required activities and standards at the project-level for unique aspects of a project which may require individualized CM procedures. |
| 2. | Establish and implement a configuration management process in accordance with the CMP, and coordinate meetings with external entities as required. The Contractor shall denote in the CMP the process and resources with whom builds, and releases shall be created, tested, deployed, and managed through change control and captured in a change log. The Contractor shall automate the CM process to the maximum extent practicable. |
| 3. | Deliver a Recommended List of Configuration Items to the VA repository to be placed under configuration and change control and notify the VA PM and COR of delivery. The Contractor shall identify types of configuration items pertaining to each product to be placed under configuration management. Based on VDIF EP requirements application integration intake, the Contractor shall determine the components that must be under configuration control. |
| 4. | Use the VA repository for software source code and electronic artifact configuration and version management. The Contractor shall manage change, activity, issue, action, risk, and other project data as prescribed by VA standards and processes. If transition to a new, VA repository begins after this project has been initiated, the Contractor shall assist the VA Tools Team in migrating projects using other Change and/or Configuration Management tools to the new VA repository. |
| 5. | Ensure that all project software and non-software artifacts are versioned correctly according to Government standards and follow a build/release promotion versioning approach which identifies all major, minor, and update changes to the components. |
| 6. | Create Project and Product Artifacts baselined and versioned in the VA repository to allow the tool to show active and past histories of the check-ins and check-outs of all software components, data, and software project engineering documents. Maintain all baselines of software, software builds, and electronic artifacts in the VA repository, labeling updates and versions according to CM procedures. |
| 7. | Develop, verify and submit with all project build deliveries, a Version Description Document (VDD) that conforms to VIP website standard templates and addresses the manifest of the contents of all software builds created for project releases outside the development environment. The Contractor shall deliver VDD(s) to the VA repository and notify the VA PM and COR of delivery. |
| 8. | Establish and maintain status reporting on change and configuration management activity and ensure data records and artifacts are filed and updated daily in the VA repository. |
Deliverables:
| A. | Product Configuration Management Plan (CMP) |
| B. | Recommended List of Configuration Items |
| C. | Version Description Document (VDD) |
5.1.9 TASK MANAGEMENT
The Contractor shall create, deliver and maintain a schedule for the activities described in Section 5 and Attachments A and B to this PWS, including the schedule of deliverables to the VA PM and COR. The Contractor shall identify, using a COR-approved tool with input from the VA PM, all VIP Process and project tasks that are required to execute the activities described in Section 5 of this PWS. The Contractor shall create a Work Breakdown Structure (WBS) to define and represent in a GANNT chart project tasks at a level acceptable level to the PM/COR for each sustainment and integration project. The Contractor shall provide at a minimum bi-weekly (occurring every two weeks) schedule updates and burn-down charts.
Deliverable:
A. Project Schedule
5.2 VDIF EP ENVIRONMENT SUSTAINMENT (OI&T FUNDED)
VA has established the VDIF EP, which serves as middleware (a HIE) for federating VA patient data. The Health Level-7 (HL7) HealthConnect (HC) production system replaces the current functionality provided by the Vitria Interface Engine (VIE) via an incremental migration of messaging from VIE to InterSystems HealthShare/HealthConnect (HS/HC) HL7 Messaging. VA applications are incrementally added to the VDIF EP through VA stakeholder collaboration, submission and prioritization of interface requests submitted through the Enterprise Services Collaboration Portal (ESCP).
The Contractor shall follow the VIP Agile process described in PWS section 5.4 for all VDIF EP sustainment efforts. Tailoring of the process and deliverables required to match the specific sustainment tasks shall be coordinated with the PM/COR for review and approval, as well as other VA stakeholders as required.
The Contractor shall provide an Operations and Maintenance scrum team comprised of approximately 7-8 FTEs. The Contractor shall break the team out into an appropriate set of agile scrum teams to sustain core components of, and applications interfaces to the VDIF EP. The technical skill sets comprising each scrum team shall evolve to match the requirements of the tasks, to include the phases of the VIP agile process, being performed. Each scrum team shall work on the sustainment tasks, as prioritized by VA.
5.2.1 VDIF CORE COMPONENTS
There are several core components of the VDIF EP that are standardized at the enterprise level. Refer to the shaded blue areas in Attachment A, Figure 1 for a depiction of the current main VDIF EP components. The current snapshot of component descriptions and Contractor-specific sustainment tasks for each component is detailed in Table 1. Tasks supporting the sustainment of these components, as well as any new components identified by VA and added to the VDIF HealthShare platform will evolve to match VA requirements.
Table 1: VDIF EP Core Components
| Component |
| Status |
| Component Description/Contractor tasks |
HealthShare Information Exchange (HSIE):
| Summary Document Architecture (SDA) |
| Implemented |
| This is a proprietary feature of InterSystems HSIE and is integral with other components. This includes SDA Extensions for additional fields required by VA partners internal and external. |
The Contractor shall add and modify SDA extensions as needed as new applications/systems are integrated with the VDIF EP.
| Edge Gateways |
| Implemented |
| This includes the Edge Cache Repository (ECR), InterSystems proprietary SDA Implementation, and SDA Extensions. |
The Contractor shall add and modify ECR functionality as needed as new applications/systems are integrated with the VDIF EP.
The Contractor shall troubleshoot issues related to the specified formats, transmissions (send/receive) between internal and external systems and create SDA mapping modifications and extensions.
| Access Gateways |
| Implemented |
| This includes Consolidated Clinical Document Architecture (C-CDA). This includes the following formats: |
CCDAv2.1 and My HealtheVet (MHV) Filtered C-CDA v2.1 CCDAv1.1 and MHV Filtered C-CDA v1.1 C32 Health Summary C62 Unstructured Document Single Encounter Summary C-CDA v2.1 Referral Note C-CDA v2.1 Discharge Summary C-CDA v2.1 Care Plan C-CDA v2.1 History & Physical C-CDA v2.1 Operative Note C-CDA v2.1 Procedure Note C-CDA v2.1 Consultation Note C-CDA v2.1 Transfer Summary C-CDA v2.1 Unstructured Document C-CDA v2.1 Progress Note C-CDA v2.1 Diagnostic Imaging Report
The Contractor shall troubleshoot issues related to the specified formats, transmissions (send/receive) between internal and external systems, and create SDA mapping modifications and extensions.
| Information Health Exchange (IHE) Bus |
| Implemented |
| This includes xslt code for C-CDA generation. |
The Contractor shall troubleshoot issues related to the specified formats and transforms.
| Health Share (HS) Registry |
| Implemented |
| This includes implementation with Master Veteran Index (MVI) correlated patient information, Terminology integration, and Facilities integration. The Registry will interact with the Edge Gateways, the ECR in particular. |
The Contractor shall support and troubleshoot issues related to patient data including MVI, Terminology Mapping, Consent Management, and Enrollment Services Re-Design Secondary Demographics.
| HS Audit Repository |
| Implemented |
| This includes HealthShare Audit Trail and Node Authentication (ATNA) functionality. In addition, integration with the VA Data Quality Tool is included. |
The Contractor shall monitor and track issues related to audit logging.
| XDS.b Document Repository |
| TBD |
| This is expected to be needed during the Veterans Health Information Exchange (VHIE) Phase II – III Implementations. C-CDA document storage will be the first to be implemented. |
The Contractor shall monitor and track issues related to the management and storage of C-CDA documents.
| Regional HS/Health Connect (HC) |
| Implemented |
| Located in the four Regional Data Centers with mirror backups. This includes Virtual Patient Record (VPR) Utilities and functionality. This component is critical in keeping ECR data synchronized with local VistA systems. |
The Contractor shall support and troubleshoot server issues affecting data synchronization (HS/HC Server).
| Regional HS/HC HL7 |
| Implemented |
| Located in the four Regional Data Centers with mirror backups. |
The Contractor shall support and troubleshoot server issues affecting HL7 messaging (HL7/HC Server).
| Preload HS/HC |
| Implemented |
| Component needed to load the ECR in the Edge Gateways. This component also uses the VPR Utility. |
The Contractor shall support and troubleshoot issues regarding preload and synchronization activities with the Edge Gateways.
| Preload VistA Production Cache Shadow |
| Implemented |
| This provides live VistA data to enable load to Edge Gateways. |
The Contractor shall support the troubleshooting any issues regarding preload data to the Edge Gateways.
| Enterprise HC HL7 Messaging |
| Implemented |
| Some applications will use the Regional HL7 Server, which will connect to the Enterprise HL7 Messaging server. Some applications may connect directly to the Enterprise server, bypassing the Regional server. |
The Contractor shall support and troubleshoot server issues affecting HL7 messaging (HL7/HC Server).
| Enterprise HC X12 Messaging |
| Implemented |
| This component is used for applications that transmit Electronic Data Interchange (EDI) messages (e.g., X12). |
The Contractor shall support and troubleshoot server issues affecting X12 messaging
| HC Service Bus |
| Pending |
| We expect this functionality will be needed before the base period ends. |
The Contractor shall support and troubleshoot issues regarding REST and SOAP web services residing in the HC Service Bus.
The Contractor shall provide the following services as required to support each VDIF EP core component:
| 1. | Maintain the existing environments, |
| 2. | Monitor log files, manage alerts, |
| 3. | Perform COTS product upgrades of the core HIE platform and other component upgrades, |
| 4. | Provide Tier support as described below. VDIF-EP is currently stood up in Austin Information Technology Center (AITC) with a Development (Dev)/ Software Quality Assurance (SQA)/Preproduction/Production environment. Philadelphia Information Technology Center (PITC) is the Disaster Recovery site. Eventually, AWS VA Enterprise Cloud (VAEC) will provide the Primary VA production environment, at which time AITC will provide the disaster recovery (DR)/failover environment. PITC's VDIF-EP environment(s) will be decommissioned after this transition. Estimated transition to be completed by March 2020. The Enterprise and region shall achieve a 99 percent or greater remediation rate on a monthly basis. The 99 percent or greater remediation rate includes both fixes and creation of Plans of Action and Milestones (POAMs). The severity levels to security threats and the threats backlog will be prioritized and managed by the Enterprise Service Desk (ESD) and VA VDIF EP Team. |
| a. | Tier 2/3 support for Pre-Production and Production environments. |
| b. | Provide Tier 2 support on Development and SQA environments. |
| c. | Provide Tier 2 and Tier 3/4 remote support to remediate incidents/requests for VDIF EP components and integrated applications/systems including: i) AWS VAEC; ii) AITC; and iii) Regions 1 – 4 Regional Data Centers (RDC) |
| 5. | Monitor updates/changes to the One VA TRM and execute necessary upgrades to core components to ensure each VDIF EP component / application operates within VA-defined versions and constraints. Monitor updates/changes to non-Contractor managed VA applications that are needed by the core components and report any non-TRM compliance issues to the PM and TRM Board. |
| 6. | Monitor software updates issued by VA resulting from VA-developed products and services as well as those for COTS products comprising the VDIF EP and execute necessary upgrades to enterprise application platforms to ensure each application operates on the most current VA approved software and hardware base. |
| 7. | Provide sustainment of existing interfaces and interoperability testing of HL7 interfaces to verify commercial devices connected to VistA comply with the HL7 standard. |
| 8. | Resolve application integration defects. |
| 9. | Attend meetings regarding the decommissioning of the VIE as it pertains to the transition to the HC production system. |
As part of the services described above, the Contractor shall be required to provide sustainment intake, software license, Health Level-7 (HL7) integration, change management, Inter and Intra-Agency coordination, periodic maintenance, defect management, testing and validation, and Authority to Operate (ATO) services. These services are further detailed below. These processes may evolve over time and may be tailored to match the nature of the sustainment work being performed.
5.2.1.1 SUSTAINMENT INTAKE
The Contractor shall provide product intake support of the full portfolio baseline (PWS 5.2.1, Table 1 to date) as well as products that are subsequently transitioned to the VDIF organization as requested and prioritized through the ESCP. For each application taken in by VDIF, the Contractor shall acknowledge receipt of Application Baseline Government Furnished Information (GFI). At the time of transition, the Contractor shall perform intake testing of the application and verify or update the defect log as detailed below in Defect Management tasks.
The Government shall provide access to the VA repository in which all relevant, federated data access code will be placed. The Contractor shall aid the VA PM/COR in verifying that new application integration intakes are compliant with the TRM, VA Security Manual 6500, and VDIF Governance. The Contractor shall provide a Transition Acceptance Gap Analysis Report as a Section of the Monthly Sustainment Update Report IAW PWS 5.2.5, briefly describing any gaps between the application intake and the guidance and criteria for transition acceptance.
The Contractor shall produce a Sustainment Intake Plan, required as a Section in the Monthly Sustainment Update Report IAW PWS 5.2.5, detailing the staffing of all roles required by the O&M sustainment team and its approach to testing any pre-existing application interface code and updating the defect list, if applicable. At the time of transition, the Contractor shall perform intake testing of the application and verify or update the defect log as detailed below in Defect Management tasks. The plan shall give a schedule of integration code transfer to the VDIF EP Development (DEV), Pre-Production (Pre-Prod), and SQA environments, any demonstrations of the software application which are required for training to include Question & Answer (Q&A) or side by side review(s), and planned date of full transfer. The Contractor shall update all applicable documentation pertaining to the applications being supported under this effort in its Sustainment Intake Plan, including review of the VA repository and artifacts, and the results of any Q&A, Demo, or side by side review.
Within 45 days of initial intake of each application (or group of applications taken in at one time), the Contractor shall indicate signoff of integration code transfer indicating sufficient knowledge transfer is received in order to support the application(s) integration and that the assets transferred match those as referenced in the ESCP.
The Contractor shall not proliferate repositories except at the express guidance of the VA nor shall the Contractor create proprietary repositories for the purpose of maintaining VA software documentation.
5.2.1.2 SOFTWARE LICENSE ACTIVITIES
The Contractor shall coordinate commercial product software activities associated with indicated applications to ensure the effective coordination of license renewal, integrated testing, and release. The Contractor shall coordinate software license renewal requirements with VA Information Technology Operations (ITOPS).
The Contractor shall provide the status of license renewal, integrated testing and release implementation in the Product Sustainment Report, required as a Section of the Monthly Sustainment Update report IAW PWS 5.2.5.
5.2.1.3 HEALTH LEVEL-7 (HL7) INTEGRATION
The Contractor shall maintain indicated applications’ compliance with the HL7 messaging standard. In addition, the Contractor shall maintain HL7 compliance of any new application interfaces accepted through the sustainment intake process.
HL7 is a set of international standards for transfer of clinical and administrative data between software applications used by various healthcare providers. The HL7 standards are produced by the HL7 International organization. This data standard enables diverse healthcare IT systems and applications to communicate with each other when they receive new information or when they wish to retrieve information.
The Contractor shall provide interoperability testing of HL7 interfaces to verify commercial devices connected to VistA comply with the HL7 standard. At present, these commercial devices include Pharmacy Automated Dispensing Equipment (PADE) (as provided by Omnicell, Pyxis, and Acudose Other Equipment Manufacturers (OEMs)) and Out Patient Automated Integration (OPAI) (as provided by ScriptPro and Optifill OEMs). The Contractor shall analyze and resolve all HL7 message data format issues, and any interface failures between systems. The Contractor shall resend previously failed HL7 messages between systems to ensure HL7 message flow functions correctly. The VA may select new or replace existing commercial devices to connect to VistA on a case-by-case basis, not to exceed two per year.
5.2.1.4 CHANGE MANAGEMENT
Applications may have dependencies or down-stream impacts beyond VA or may require coordination among various VA organizations to track and manage changes that may require adaptive maintenance support IAW PWS 5.2.2.
5.2.1.4.1 INTER-AND INTRA-AGENCY COORDINATION
The Contractor shall provide the necessary coordination with external commercial entities or Government agencies (hereinafter collectively External Entities) to assure that the VA software application baselines or external systems are synchronized with VA system interfaces.
The Contractor shall also provide the necessary coordination with other VA projects and VA Organizations external to VDIF (collectively other VA entities) to assure that the VA software application baselines or external systems are synchronized with VA system interfaces.
The Contractor shall provide coordination to include participation in joint meetings with External Entities and enrollment with specification change update notification bulletins (if available). The Contractor shall assist in developing any external Memoranda of Understanding (MOUs) as necessary to maintain consistency (e.g., specifications, interface control documents, schedules, governance, etc.) across the interface(s). The Contractor shall integrate all inter-agency coordination specific activities and deliverables with the overall schedule of deliverables for the indicated applications.
The Contractor shall maintain interface documentation and develop Integrated Schedules, which are required in 5.4.1.1 under VIP Agile Process, showing relationships and interdependencies with VA and external entities as they affect application interface sustainment. The Contractor shall track defects in a defect log in accordance with the Defect Management Plan (required in 5.2.3.1) and indicate how any changes initiated by Interagency Coordination are aligned to the corresponding application updates to the VDD (IAW PWS Section 5.1.8). The VA shall provide access to a test environment to modify and test updates/changes to the interfaces driven by specification changes with interfaced systems.
The Contractor shall create or update any Other Documentation per MOU (e.g., External MOU(s) and associated documentation), which are required in 5.4.1.1 under VIP Agile Process.
The Contractor shall provide the necessary coordination to define, approve, and communicate data standards, procedures, and metrics. The Contractor shall research and produce documentation of established data standards, as well as any on-going changes. The Contractor shall track and enforce conformance to data standards as necessary and manage and resolve related issues if they arise.
In the event of changes to the VA software application baseline, the Contractor shall provide the necessary coordination to assure that changes are compliant with any Federal regulatory, statutory or policy requirements (e.g., Food and Drug Administration (FDA)) and obtain the requisite approvals prior to release. The Contractor shall participate in joint meetings with the external entities, as required, to assure adequate understanding of the requirements and approval process. The Contractor shall obtain any required external approval/acceptance prior to releasing any change to the VA software application baseline and create and disseminate progress reports.
Upon request, the Contractor shall create and disseminate Ad-Hoc Progress Reports, which are required in 5.4.1.1 under VIP Agile Process, throughout performance; historically on a quarterly basis to the VA PM/COR. At the conclusion, the Contractor shall document process improvement recommendations and provide Process Improvement and Best Practices Documentation and Technical Guides, which are required in 5.4.1.1 under VIP Agile Process, for Inter-Agency Coordination to both Internal and External Entities.
5.2.2 PERIODIC MAINTENANCE
The Contractor shall plan for and perform routine and/or periodic maintenance on all VDIF EP integrated applications/systems supported, in…
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it.