36C10B23Q0021_Questions to Industry_DSCSA Solution Provider.pdf

Request for Information/Sources Sought Solicitation # 36C10B23R0021

DSCSA Solution Provider

A. Set up and implementation

1. Describe your company’s history and how long they’ve provided products and services in the Track and Trace field, including lot-level product tracing and serialization?

2. Can your company prepare and submit a project management plan that lays out a high-level approach and timeline to be used in the execution of the contract, displaying the schedule, milestones and resource support?

3. Can your company provide a monthly progress report?

4. Does the Vendor have or is in the process of meeting all security requirements for

FEDRAMP approval?

5. Does the Vendor have or is in the process of meeting all security requirements for

VA approved Software as a Service (SaaS)?

a. What are the supported hosting models? (On-Premises, Private Cloud, Public

Cloud, other)

b. For SaaS, who are the providers (Azure, AWS, Google, private, etc.) for the data center platform?

c. Please provide details around Single Tenant, Multi-Tenant, data segregation, etc.

6. For SaaS solutions, what operational monitoring is in place for you to monitor your

SaaS solution? How long are these records maintained?

7. Describe your ability to provide system access? Specifically, providing a web-based portal or app to access serialization information.

8. Is Data storage in the "Cloud"?

9. Does the vendor have or is in process of obtaining VA Cloud approval?

10. Does the Vendor have a plan to coordinate with NABP’s Authorized Trading

Partner (ATP) repository via their established APIs?

11. Describe your existing client base and number of DSCSA clients? What is your current number of active dispenser customers?

12. Is your software solution currently operational in at least one VA, please list

13. Is your software solution compatible with iOS, Android other handheld device-please list

14. Does your software solution allow for multi-level access from global to end user for actions and reports?

15. Explain your training plan to encompass ALL 155 VA sites with measurable competencies-will this be high level “train the trainer”, or end user training?

16. Describe your ability to conduct vendor mapping? Specifically, on-boarding, mapping and maintenance of ~300 existing trading partners onto serialization via EPCIS V1.2 or higher.

17. Describe your software’s validation errors identification process?

18. Describe your process for non-compatible data exchange.

19. Describe your data exceptions process.

20. In addition to the ~300 authorized trading partners mentioned above, describe your ability to map requesting company’s primary wholesale distributor?

DSCSA Solution Provider

a. Establish daily EPCIS serialization feed from Wholesaler () for all shipped products (on EPCIS V1.2 or higher).

b. Establish daily EDI 856 feed from wholesaler

21. Is your software solution interoperable with, and will proactively remain updated to, the latest standards for GS1 EPCIS (ex, 1.2 or higher)?

22. Explain your ability to use a Single Sign-On (SSO) authentication method for requesting company end-user authentication.

a. Can the application or hardware appliance create an audit trail for log-ons, transactions, transmissions and file name access?

23. Are data centers located outside of the United States? If yes, do these data centers store data other than training/test data?

24. Does this Solution require planned outages and how are they communicated?

25. Explain your plan to alert VA prior to any upgrade or update and the plan for accessing data during this timeframe

B. Compliance with DSCSA requirements: Interoperable Data Exchange

I. Data Exchange/Receipt

1. Describe your ability to implement and maintain single or multiple VA Global Location Number(s) centrally for all requesting VA shipments.

2. Explain how your software solution is capable of electronic EPCIS data exchange for all VA dispensing facilities, Consolidated Mail Outpatient Pharmacies (CMOPs) and Emergency Pharmacy Service in compliance with DSCSA requirements

3. Is your software solution currently capable of establishing daily EPCIS serialization feed from wholesalers and distributors on EPCIS 1.2 or higher?

4. Can your software solution identify and display to user if an item is DSCSA required or not (based on a flag from the Master catalog)?

5. Explain your software solution’s process for establishing daily Electronic Data Interchange (EDI) 856 Advanced Shipping Notice (ASN) from wholesaler and other vendors

6. Is your data retrieval and processing in real or “near” real time, please explain

7. Are you able to complete real-time Authorized Trading Partner verification, prior to

VA receipt of product?

8. Please provide monitoring and alert mechanisms for API failure scenarios.

a. Explain the possibility of running ad-hoc reports for data stored in the cloud provider?

b. Explain the possibility of running performance reports for data stored in the cloud provider?

c. Explain the possibility of running scheduled jobs for data stored in the cloud provider?

9. Describe your ability receive serialized product, per the following VA receiving procedures:

a. Scanning and receiving at the pallet, case, tote or individual item level.

DSCSA Solution Provider

b. Scanning and receiving a pallet or case and inferring contents (ie -aggregation).

c. Scanning and receiving a tote from wholesaler and inferring contents (by using a Standardized Shipping Container Code - SSCC).

d. Setting a percentage or absolute number of items to scan per PO.

e. Setting a range / random scan amounts.

f. Setting a scanning requirement for all controlled substances.

i. Setting scanning requirements by item (i.e. - setting scan rates for specific NDCs that may be at risk).

g. Showing whether an item is DSCSA required or not (based on a flag from the requesting company Item Master catalog).

h. Comparing receipt quantity against EPCIS quantity.

i. Easily handling exceptions.

ii. Missing product.

iii. Missing EPCIS: Receiving off of an ASN for items, flag missing

EPCIS.

iv. Handling multiple receivers at the same time.

i. Handling multiple receivers at the same time against same PO

j. Flagging exceptions, overriding and sending the error to your system.

k. Serialization solution provider to follow-up with vendor to retrieve EPCIS file.

i. Ability to not stage a receipt against a closed PO number.

ii. When loading an EPCIS file as a staged receipt, confirming the PO line is not fully received (if a line is already fully received, we do not want to stage an additional receipt).

iii. If the line is already fully received, storing the EPCIS information for historical purposes (not as a staged receipt).

l. Receiving via web interface on a PC (if handhelds are unavailable).

10. Describe your ability to receive non-serialized product (ie - OTC’s, Grand-fathered

Product, Products Missing Serialized Barcodes) per the following VA receiving procedures:

a. Receiving against an ASN for items (when EPCIS data doesn’t exist).

b. Manually searching for a PO number, or scanning-off the invoice or tote.

c. Selecting from multiple open PO’s for the same item (i.e. - the item being received is on multiple open PO’s).

d. Performing blind receiving (no ASN) for non- items (end-users need to type in quantity on the handheld or PC).

11. Does your software solution have a process to open closed POs for editing, and include an audit report or tool for this action?

12. Does your software solution allow for manual addition of received items not included on Advanced Shipping Notice?

13. Does your software solution allow for the ability to manually adjust quantity received?

14. Does your software allow for the ability to manually adjust expiration date for items requiring monitoring and removal prior to expiration or extension of expiration date?

DSCSA Solution Provider

15. Is your software solution prepared for the upcoming updated NDC to 6-4-2 format?

16. Describe your scanning ability to translate 11-digit NDC numbers into 14-digit GTIN numbers, and vice-versa as required.

II. Data Storage

1. Describe your ability to store all EPCIS and receipt information in a secure environment per DSCSA guidelines for all VA dispensing facilities, Consolidated Mail Outpatient Pharmacies (CMOPs) and Emergency Pharmacy Service

2. Is your software solution capable of storing all transaction data for any investigated receipt for 6 years from time of investigation request?

3. If the VA’s contract for your solution is terminated, are you able to archive / return data related to the VA and purge this data from your systems?

a. The VA requires ownership of all data it sends to the Cloud, and the ability to access and retrieve its data and content at the end of the term in machine-readable language.

4. If the VA changes Pharmaceutical Prime Vendors, would your company be able to export all VA data in storage?

III. Data Tracing/Retrieval

1. Vendor has current process to respond to request for information

a. Within 24 hours for authorized auditing body (e.g. Office of the Inspector General, Federal Drug Administration)

b. Within 2 days for an ATP in the event of a recall or investigation into suspected illegitimate product

2. Describe your support model if / when there’s an FDA audit and large amounts of VA data are required immediately.

3. Does your software solution allow for selecting of multiple POs for the same item search?

4. Will the stored data remain available for retrieval in the case of PPV contract change, expiration, termination, etc?

5. Will VA stored data be available to export, manipulate, and process at VA’s sole discretion?

6. Will VA stored data be archived at any point in time and inaccessible for immediate retrieval?

7. Is there a mechanism to ensure that requesting company data is backed-up within requesting company prior to the termination of any contractual agreements?

8. VA stored data will not include any Protected Health Information (PHI) or Personally Identifiable Information (PII)

9. Will the vendor ensure VA stored data will be available to ATP for use in complying with the DSCSA requests?

DSCSA Solution Provider

10. Does the software solution include access to 3911 from the software?

11. Is the software solution capable of pre-populating the 3911 information?

12. Does the software solution currently have a process to link returns with original invoice for correct price credit in case of price change?

13. Does the software solution provide tracking of expiration date of receipts outside of an internal vendor inventory system?

C. Maintenance and Support

1. Describe your ability to perform end-user support, including the following functions:

a. Providing a support line for requesting company end-users to call to report missing or inaccurate DSCSA information.

b. Providing full-service support of failed or missing supplier transmissions.

c. Monitoring and resolving any transmission errors.

d. If necessary, contacting offending supplier(s) to resolve the issue.

2. Explain the vendor’s process for continuity of operations due to planned or unexpected system unavailability, regardless of cause

3. Describe your ability to generate system alert notifications, specifically for the following scenarios:

i. Recalls

ii. Drug Shortages

iii. Grandfathered product

iv. Suspect or Illegitimate product

v. Mis-shipments

vi. Expiration date notifications

vii. Unauthorized trading partners

4. Explain the vendor’s approach to data exchange for drop-shipped items

5. Does the vendor have a plan to provide technical support to operate and maintain the Cloud environment?

6. Is the vendor capable of providing customer support during business hours (0800-

1700 Mon-Fri) for VA in all time zones (includes continental US, Alaska, Hawaii, the Philippines Islands, Guam, America Samoa, Puerto Rico, and the Virgin Islands)

a. Describe your company on-call availability or back-up plan, should a serialization system issue occur on a US holiday?

7. Will the vendor act as liaison between VA and Authorized Trading Partners

(ATPs) in coordination with VA designee, to resolve

a. Reports of suspect or illegitimate product

b. Incorrectly formatted or incompatible data

c. Issues related to mis-picked/mis-packed or missing items

d. Data exceptions- Describe your daily review of exceptions and follow-up with manufacturers

e. Communications related to suspected illegitimate products

DSCSA Solution Provider

8. In addition to the ~300 authorized trading partners mentioned above, describe your ability to conduct additional mapping for newly acquired trading partners on-boarded during the duration of the contract.

9. Describe your ability to conduct reporting, including the following functions:

a. Do you have a list of standard reports, and can the VA create any additional custom reports?

b. Will reports have the functionality to drill down to specific VA locations?

c. Describe whether your system reporting capability pulls data for enhanced cost optimization and cost avoidance?

d. Are there any printer compatibility limitations (including label type)?

e. VA custom reports include (but aren’t limited to):

i. Daily exception reports of unreceived orders.

ii. All lines received without serialization data.

iii. Controlled substances received and by whom, trended.

iv. A full file of total receipt units, missing receipts and faulty GTIN’s.

10. Describe your error monitoring process, including the following functions:

a. Resending / receiving EPCIS data for mis-shipped, short-shipped over shipped product.

b. How do you plan to handle shipments sent to an incorrect location?

11. Describe your actions taken by error type, including turn-around time where applicable?

12. Explain your process for monitoring and alert mechanism for Application Programming Interface (API) failures

13. Describe your ability to conduct extensive end-to-end serialization testing and pilots for Pharmaceutical Prime Vendor and direct vendors

D. Add-on services

1. Describe your ability to provide scanning capability, per the following VA procedures:

i. Supplying of 2D hand-held scanners

ii. Linking a PO number to a unique EPCIS (or ASN) file.

2. Describe your ability to process returns (sellable and non-sellable), including the following VA procedures:

i. Initiating returns from a handheld, if applicable

ii. Scanning an item and having the system pull up the last PO number.

iii. Capability to link returns to original invoice for correct price credit

3. Upon the final EPCIS event, describe your system’s ability to decommission serial numbers (or SNI’s) in a central database and report same to manufacturer?

4. Explain your software’s capability to identify and track recalled products?

5. Explain your software’s mechanism for tracking item removal from quarantine for diversion prevention, either by hard-stop or audit process

6. Explain your software’s mechanism for tracking pricing corrections and rebills

7. List current Application Programing Interfaces (APIs) and any contract and security requirements for APIs.

DSCSA Solution Provider

8. Is the vendor willing and capable to develop additional APIs if needed (ex.

Reverse Distributor)

9. Is the charge for service by line items (serial numbers) received/stored or by number of VA identified GLNs?

10. Describe any company plans to track serial numbers down to the patient-level at the point of dispense.

E. Future Enhancements

1. How can your company support the VA beyond the 2023 serialization requirement and well into the future?

2. Is your company prepared to move toward integration and implementation of interfacing with government system, VistA, to include participation in planning meetings and testing?

3. Is your company prepared to move toward integration and implementation of interfacing with government EHR system, Oracle/Cerner, to include participation in planning meetings and testing?

4. Does your software have a mechanism for testing or troubleshooting with non-production data for HER integration and development?

Acquisition Strategy/Market Research

1. If able, please provide a Rough Order of Magnitude with basis of estimate.

2. Identify existing contract vehicles (GSA, NASA SEWP,T4NG, etc.) in which you are a contract holder?