RFI Product Description RIRAS DRAFT.docx

Radiotherapy Incident Reporting and Analysis System Software License & Sustainment

VA-FY-24-00052409

PRODUCT DESCRIPTION

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration National Radiation Oncology Program

Radiotherapy Incident Reporting and Analysis System Software License & Sustainment

Date: March 11, 2024

VA-24-00052409

PD Version Number: 1.0

Contents

PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Under Secretary for Health (USH), through the National Radiation Safety Committee, requires the VA National Radiation Oncology Program (NROP) office, in cooperation with the National Health Physics Program (NHPP), to acquire software licenses, maintenance, and support for the Radiotherapy Incident Reporting and Analysis System (RIRAS) software which was established in 2014. RIRAS has the capability to electronically collect clinical radiotherapy adverse events and good catch (near miss) event data for approximately 15,000 Veterans treated with radiotherapy annually at 41 VHA facilities that offer radiation oncology services. The deployment of RIRAS will enhance the quality and safety of radiotherapy delivered to Veterans at facilities.

The RIRAS medical software encompasses the entire feedback loop by reporting an incident, analyzing the event for root causes, and developing interventions to prevent a recurrence. This medical event reporting software shall have tools to perform analysis of radiotherapy incidents and good catches and the ability to define corrective actions and policy guidance for the field and the relevant and Radiation Oncology. The analysis reports with corrective, learning actions shall be shareable with the reporter/facility and made public to the community (after de-identification) as part of the learning process. The Radiotherapy Incident Reporting and Analysis Software shall have the following functionalities:

The RIRAS medical software shall use dataset radiotherapy specific medical taxonomies and data dictionaries defined in AAPM and ASTRO reports on error reporting. The peer review publication on these taxonomies can be found at https://www.ncbi.nlm.nih.gov/pubmed/23231278. The RIRAS software records clinical, event-based data and clinicians will be able to derive clinical best practices and practice improvements.

The RIRAS software has the workflow to analyze the radiotherapy reported incidents, identify vulnerabilities of clinical processes, provide tools to identify system wide vulnerabilities and suggest substantial improvements in radiation oncology clinical workflow. The RIRAS software encompasses the entire feedback loop of reporting an incident, analyzing it for salient details, and developing interventions for the clinicians and technical medical staff to prevent these events from happening again. Additionally, the RIRAS software provides national level trends that can be viewed by the senior leaders, and suggest process improvements.

The RIRAS software records analysis reports from subject matter experts (consists of Radiation Oncologists/Physicians, Therapeutic Medical Physicists, Dosimetrists, and therapy team members) with sections on corrective, learning, and preventative actions which shall be shared with the reporters/facility, and deidentified data are made public to the radiotherapy and medical community as part of the learning process.

VA requires the RIRAS Enterprise software license as well as ongoing support. This license shall include unlimited number of clients to access the website and unlimited number of facility licenses to use the software within the VA intranet.

Additional training as well as remote access & phone support shall be included as Optional Tasks.

PROGRAM MANAGEMENT AND REPORTING

The Contractor shall hold conference calls as needed to address any issues/concerns raised by the NROP team and its subject matter experts. The Contractor shall define a point of contact who will coordinate the conference calls, when needed. Virtual Meeting Summary of such interactions shall be provided by the contractor to the VA for each remote interaction.

Deliverable:

A. Meeting Summary Reports

RIRAS SOFTWARE LICENSES AND ONGOING SUPPORT

The Contractor shall provide Radiotherapy Incident Reporting and Analysis System enterprise software license (TSG-RIRAS-v1) for one year. The licenses shall allow an unlimited number of users access to the software at an unlimited number of VA facilities.

The Contractor shall resolve any issues resulting from the use of the RIRAS software for one year after acceptance by the Government. The Contractor shall respond to any issues (bug fixes), and shall make all attempts to resolve the issues within 15 business days of notification of the problem from the Government PM or COR. Any updates to the software’s current version will be provided to the Government as part of this contract. The Contractor shall provide status of any maintenance activities including software updates in the Quarterly Status Report.

Deliverable:

A. Radiotherapy Incident Reporting and Analysis System enterprise software license (Yearly)

INSTALLATION, IMPLEMENTATION AND CONFIGURATION

Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program).

The Contractor shall provide installation, implementation and configuration of the Radiotherapy Incident Reporting System web software and the Structured Query Language (SQL) database. The Contractor shall decide to accomplish this remotely. This shall include the download of the software and license on a VA provided Windows server, and installation and testing of the database tables in the VA provided database tables in the current VA provided SQL Server to match required VA baseline. In addition, the VA will provide SSL (HTTPS) security certificates that the Contractor shall implement and deploy on the software. The Contractor shall create Admin level user accounts and provide them to the VA subject matter experts and program office representative.

The Contractor shall resolve any issues resulting from the installation, implementation, and configuration of the RIRAS software, and shall make all attempts to resolve the issues within 5 business days of notification of the problem from the Government PM. The Contractor shall test and provide a status in the Quarterly Status Report to show successful remediation of the problem.

The Contractor shall remotely install, implement, and configure the RIRAS software and database located at the CRRC (Martinsburg, W.V.) facility, using the EWIS “server farm” to enable use by the VA at any location by an unlimited number of users. The Contractor shall provide an Installation Report that includes details on how the software was installed, implemented, and configured. The Contractor shall provide the detailed installation instructions as part of the installation report for the web-based product and SQL server database.

Deliverable:

A. Status report of the successful installation of license (Yearly)

RIRAS TESTING

After successful installation, implementation and configuration, the Contractor shall then test the RIRAS software to ensure proper operation for all users at any location. The Contractor shall use remote testing procedures if they decide. The Contractor shall provide a test report that provides confirmation that the RIRAS software works as intended to meet the requirements of this Product description defined in section A. VA prohibits the installation and use of personally owned or contractor/subcontractor owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW/PD or contract. All of the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned OE.

Deliverable:

A. RIRAS Test Report (Initially and upon software upgrades)

VA CYBER SECURITY COMPLIANCE:

The Contractor shall provide support for Authority to Operate the software, as well as cybersecurity work and routine maintenance of the software.

Deliverable:

A. Provide yearly documentation of the RIRAS ATO progress, maintenance, cybersecurity reviews and audits with the software.

TRAINING (Optional Task) The Contractor shall provide one virtual web-based application-based training course to the one designated VA staff from the program office on the technical aspects of the RIRAS software. The training shall include the instruction on the use and administration of the RIRAS software. Upon completion of the training, the Contractor shall provide a hard copy of the RIRAS Training Materials and a RIRAS User Guide that can be shared with other team members in the program office as an aid for Government training. The training material shall include the instructions to access the software, enter reports, perform analysis, and provide feedback to the reporters. Documentation shall also include the specifics of the database inner workings and deployment procedures.

Deliverable:

A. RIRAS Training Materials (Initially and upon software upgrades) B. RIRAS User Guide (Initially and upon software upgrades)

REMOTE SERVICE (Optional Task)

Additional support shall be provided by remote access and phone support by the hour.

SYSTEM ACCEPTANCE (PRE-PRODUCTION) TESTING

RIRAS GOVERNMENT ACCEPTANCE TESTING SUPPORT

The RIRAS software will be tested by the Government to ensure the Government requirements are met. The Contractor shall be available for support on call to answer questions for the VA during Government Acceptance Testing (GAT). The RIRAS software shall pass GAT once the Government determines that RIRAS meet its requirements.

The GAT will include the following:

1. Software functionality testing

a. Ability to report an incident/good catch/unsafe condition via the system.

b. Test for determining all the data elements for error reporting defined in the AAPM error reporting publication (https://www.ncbi.nlm.nih.gov/pubmed/23231278) is present in the software.

c. Email notifications on submission of incident and completion of the patient safety work product report.

d. Ability to analyze the reported events and provide a patient safety work product report for each reported event.

e. Display graphs and charts displaying statistics on the reported events reports and sub categorization of the analysis elements.

f. Ability to search the incident database based on all reporting elements as query parameters.

2. Software performance testing

a. Ability to record all the elements and necessary documents in the reporter’s form.

b. Ability to create and approve user logins,

c. Ability to edit the permissions for user login access.

d. Ability to lock accounts on multiple incorrect logins attempted and procedure to unlock and change the password for these accounts.

e. Check the user rights and access controls.

f. Ability to download the incident reports in an XML format on the user’s desktop computer.

3. Overall software quality testing

a. The front end of the software shall be accurately displayed on VA approved web browsers.

b. Display of the VA logo on the front page on the software

c. Adding boilerplate information on the front page of the software giving details of the VA program for radiotherapy incident reporting.

4. Software security testing

a. Implementation of VA provided HTTPS certificates on this software.

TYPE OF CONTRACT:

Firm Fixed Price (FFP)

PERIOD OF PERFORMANCE:

The Period of Performance shall be June 24, 2024, through June 23, 2025, and shall include four 12-month option periods. The Contractor shall deliver enterprise Software licenses within 30 days after receipt of order. Ongoing maintenance and support will be provided by the vendor in addition to the enterprise software license.

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

Information Technology using Energy Efficient product compliance is not required in this acquisition.

3.1 EPEAT

EPEAT product compliance is not required in this acquisition.

3.2 ENERGY STAR

Energy Star compliance is not required in this acquisition.

3.3 femp

FEMP or FEMP low standby power product compliance is not required in this acquisition.

GENERAL REQUIREMENTS

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

POINTS OF CONTACT

VA Program Manager/COR

Contracting Officer:

Office of Procurement, Acquisition and Logistics Department of Veterans Affairs 23 Christopher Way Eatontown, New Jersey 07724

Contract Specialist:

Office of Procurement, Acquisition and Logistics Department of Veterans Affairs 23 Christopher Way Eatontown, New Jersey 07724

INFORMATION SECURITY CONSIDERATIONS:

The Assessment and Authorization (A&A) requirements do not apply and a Security Accreditation package is not required. The IT security requirements for clarification and accreditation (authorization) (C&A) do not apply and are not required.

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.

image1.jpeg