VPA2_Draft PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

U.S. Department of Veterans Affairs

VistA Point-of-Care Application Analytics

(VPA2)

VA-24-00054128

PWS Version Number: 1.6

March 8, 2024

1. Background

In March 2023, VHA and OIT leadership testified to the House Veterans Affairs Committee on Technology Modernization that “maintaining VistA is essential to ensure VA preserves the standard of care … and continues innovation to serve the Veteran. VA embraces the responsibility to consistently and constantly drive modernization and look for efficient ways to maintain VistA.”

To aid maintenance and manageability, VistA systems are being migrated to the VA Enterprise Cloud (VAEC), a federally certified U.S. GovCloud managed by Amazon Web Services (AWS). In and of itself, this migration does not enhance VistA’s efficiency or usability for clinical staff or other VistA users. However, given the breadth of built-in tools and facilities in VAEC, this migration provides ample opportunity for improvements to the system outside of the VA’s traditional VistA development approach.

This Vista Point-of-Care Application Analytics (VPA2) task order will leverage the current VAEC facilities to capture the remote procedure call (RPC) traffic VAEC-based VistA systems, and based on this data provide analytics on the users and usage of Vista point-of-care applications. This analysis will guide and prioritize provider application acceleration and security to deliver performance and security improvements for Vista point of care applications.

On completion, VHA will possess a fully re-usable, non-invasive, VAEC-based suite of tools for monitoring and analyzing the remote procedure call interface of any cloud-based VistA, and a set of concrete, actionable recommendations, and demonstrations for improving the performance of VistA’s Point of Care applications.

In FY22 VHA clinical staff provided over 115 million veteran care encounters using VistA point-of-care applications. Accelerating VistA's point-of-care applications has a large positive impact on clinical efficiency and veterans' access to care.

2. Scope and Purpose

The Contractor shall configure cloud-native, non-invasive traffic capture and analysis of the remote procedure call (RPC) interfaces of a representative sample of VAEC-based VistA systems using this capability in the VAEC. The Contractor shall provide an analysis of the VistA RPC traffic that defines the range of point-of-care applications, user behaviors, patterns of interface use, and areas of concern. The Contractor shall automate the generation of this analysis from mirrored data and produce actionable analysis of the top VistA Point-of-Care Applications including CPRS.

3. Tasks

3.1 Contractor Project Management Plan

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

3.2 Monthly Contractor’s Progress, Status and Management Report The Contractor shall provide a monthly progress report to the Contracting Officer (CO) and Contracting Officer’s Representative (COR) via electronic mail. This report shall include: (1) a summary of all project milestones and their anticipated completion dates, (2) invoicing data, (3) an assessment of current month and future month activities, and (4) a discussion of any issues related to contract performance or administration.

Deliverable:

A. Monthly Contractor’s Progress, Status and Management Report

3.3 Kickoff Meeting

The Contractor shall conduct a Technical Kick-Off Meeting with the Government including the PM, COR, and contracting office. A technical kickoff meeting is required within ten (10) calendar days after task order award. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five (5) calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three (3) calendar days after the meeting).

Deliverables:

A. Kickoff Meeting presentations B. Kickoff Meeting Minutes

3.4 Staffing Roster

The Contractor shall manage and track all staffing and onboarding activities and shall provide a quarterly Staffing Roster Report to the government for review.

The onboarding process shall include VA Privacy and Information Security Awareness training, Rules of Behavior, fingerprints, background investigation submission and status, VistA account request, Personal Identity Verification (PIV) card, Active Directory account, Remote Access Request, Elevated Privileges Request per environment, and any other information deemed necessary for tracking by the Contractor, VA PM and COR.

A. Staffing Roster Report

3.5 RPC Traffic Capture and Analysis

3.5.1 RPC Traffic Capture and Analysis – VAEC-based Test VistA The Contractor shall use the existing VAEC-native non-invasive facilities to capture and analyze all RPC traffic sent to and from a VAEC-based Test VistA. As a non-invasive method, it must not require any change, reconfiguration, development, or plugins in the VistA system itself. To ensure the RPC traffic capture is complete and correct, the Contractor shall test the configured RPC capture and provide an RPC Analysis Test Output Report describing traffic volumes and types. This report shall establish that capture is complete (all RPC traffic) and sufficiently detailed (distinguishes users, connections and RPC and RPC contents). The report shall be delivered in GitHub compatible Markdown. The Contractor shall provide an AWS compatible script to automatically deploy the RPC capture to any specified VistA. The Contractor shall create and update an RPC Capture Manual that provides instructions on the deployment and use of the RPC capture for any VAEC-based VistA.

Deliverables:

A. RPC Traffic Test Output Report B. AWS Compatible Script C. RPC Capture Manual

3.5.2 RPC Traffic Capture – Three Production VistAs

The Contractor shall capture all the RPC traffic of three VAEC-based production VA VistAs (“Analyzed VistAs”) using the same non-invasive, cloud-native monitoring mechanism used on the Test VistA. At least one of the VistAs should support a large integrated medical facility.

The Contractor shall:

a) In collaboration with the Government, identity three VistAs and obtain permission from their managers to capture their RPC traffic.

b) Deploy, and as necessary improve the configuration of the RPC Traffic capture to capture all RPC traffic for these three VistAs.

c) Continue traffic capture of each of the three identified VistAs for at least one month and store all captured data in VAEC for analysis.

3.5.3 Produce Detailed Analysis of the RPC traffic of VistA

Using the traffic captured, the Contractor shall produce a Traffic Analysis Report of the complete RPC traffic of each of the three Analyzed VistAs. In addition, the Contractor shall produce a Cross VistA Analysis Report distinguishing cross-VistA from VistA specific traffic patterns. All four reports shall be composed in GitHub compatible markdown with embedded graphics where appropriate. The Contractor shall store all four reports as markdown in the VA Enterprise GitHub.

Each per-VistA Traffic Analysis Report shall characterize:

a) User types and volume of use

b) Client types and volume of use

c) Connection volumes, frequency, and duration

d) Types of user authentication/security and relative use

e) Machine from end Users

f) RPC usage frequency and execution times

g) VistA-specific from cross-VistA RPCs

h) Isolation of RPCs supported in VistAs but never used

Deliverables:

A. Traffic Analysis Reports B. Cross VistA Analysis Report

3.5.4 RPC Traffic Analyzer

The Contractor shall package all VistA/RPC specific scripts and/or configurations used to produce the Traffic Analysis from captured VistA RPC traffic. Combined with any required utilities and tools, this package makes a reusable “RPC Traffic Analyzer”. This analyzer as a whole shall run in the VAEC. The package of all scripts, configurations and documentation shall be posted to a Git in the VA Enterprise GitHub. The Contractor shall provide a RPC Traffic Analyzer User Guide and Technical Guide.

To ensure the comprehensiveness of the analyzer, the Contractor shall reproduce the Traffic Analysis Reports of all three Analyzed VistAs using the analyzer.

Deliverables:

A. RPC Traffic Analyzer Scripts and Configurations B. RPC Traffic Analyzer User Guide C. RPC Traffic Analyzer Technical Guide

3.5.5 Produce Detailed Analysis of the RPC traffic of Key Point-of-Care Clients Based on the traffic and client types isolated during VistA traffic analysis, the Contractor shall produce a detailed analysis of the RPC Interactions in a Client Traffic Analysis Report of the three top VistA point-of-care applications ("Clients"). CPRS shall be one of the three. All three reports shall be composed in GitHub compatible markdown with embedded graphics where appropriate. The Contractor shall store the three reports in a git in the VA Enterprise GitHub.

The per Client Traffic Analysis shall include:

a) User volumes and types

b) Connection volume

c) Types of user authentication/security and relative use

d) Isolate authentication/security issues with the RPC interface as used

e) Enumeration of all RPCs used, grouped in task sets

f) Distinction of clinical data from non-clinical data RPCs

g) Distinction of slow running, high overhead and variable overhead RPCs

h) Isolate troublesome performance issues with specific RPCs

A. Client Analysis Reports

3.5.6 Point-of-Care Client Improvement Report

Based solely on the Client Traffic Analysis reports, the Contractor shall provide recommendations to improve the performance, security and reliability of the use of the RPC interface for each of the top three RPC-using Point-of-Care VistA Clients. These recommendations shall be documented in Client Improvement Reports for each Client in Microsoft Word and a supporting PowerPoint presentation.

A. Client Improvement Reports

3.6 Contract Type

Firm Fixed Price

3.7 Place of Performance

This work will be performed at the Contractor site.

3.8 Period of Performance

The Period of Performance shall be twelve (12) consecutive months, from date of award.

3.9 Travel

The total estimated number of trips and anticipated locations in support of the program related meetings for this effort is: Washington, DC or other VA location as appropriate - two trips with two contractors traveling per trip for 2 – 3 days per trip.

3.10. Government-Furnished Information, Equipment, and Facilities

· System access required to interface with content and data as required. This will include appropriate VAEC and VA Enterprise GitHub access.

· VPN access to the VA network (RESCUE)

· Citrix Access Gateway (CAG)

· The final deliverable of VAM 2020

3.11. Security Requirements

All VistA data and user-identifying analysis must be kept in an appropriately secure section of the VAEC.

For personal requirements, see section 3.1.3.

3.12. Key Personnel

· Commercial cloud functional analysts with five years Amazon Web Services (AWS) experience including configuring and managing cloud based containers and storage.

· VA Vista/M experts with 10+ years’ experience with detailed knowledge of the format, operation, and interpretation of all of VistA’s Remote Procedure Call (RPC) interface and routines.

· Analysts with 10+ years experience profiling and interpreting the communications and internal operations of VA VistA.

Standard Surveillance Method Outcome

Delivery of artifacts and services

Deliverables are on time 100% of the time per the Delivery Schedule.

Any change to the delivery schedule must be approved by the Customer and/or COR at minimum 30 days in advance with documented reason and remedy.

100% inspection.

The government PM will review each Deliverable for quality/ timeliness according to criteria established in this task order.

The contractor will be given an opportunity to correct non-conforming services at no cost to the Government if the services are non-conforming or the contract requirement is unacceptable.

The Government will not pay for services that do not conform or do not meet performance standards or have not been properly rendered.

The government PM will review each Deliverable for quality/ timeliness according to criteria established in this task order.

The contractor will be given an opportunity to correct non-conforming services at no cost to the Government if the services are non-conforming or the contract requirement is unacceptable.

The Government will not pay for services that do not conform or do not meet performance standards or have not been properly rendered.

- 1 -image1.jpeg